The General Data Protection Regulation (GDPR) applies to any organisation that processes personal data of EU residents — regardless of where the organisation is based. Non-compliance carries fines up to €20 million or 4% of global annual turnover. This checklist walks through the core obligations.

1. Lawful Basis for Processing

  • Identify and document a lawful basis for every processing activity (consent, contract, legitimate interest, legal obligation, vital interests, or public task).
  • Where you rely on consent, ensure it is freely given, specific, informed, and unambiguous. Maintain consent records.
  • Conduct a Legitimate Interests Assessment (LIA) for each processing activity that relies on legitimate interests.
  • Never use consent as a fallback when another basis is more appropriate.

2. Data Subject Rights

  • Right of access (Article 15): Respond to Subject Access Requests within one calendar month.
  • Right to erasure (Article 17): Build a documented deletion procedure and test it.
  • Right to rectification (Article 16): Enable corrections to inaccurate data.
  • Right to data portability (Article 20): Export personal data in a machine-readable format on request.
  • Right to object (Article 21): Stop processing where the individual objects and you cannot demonstrate compelling legitimate grounds.
  • Log all DSR requests and responses as evidence of compliance.

3. Privacy Notice

  • Publish a privacy notice that covers: who you are, purposes and legal bases, data categories, retention periods, third-party sharing, and data subject rights.
  • Make it easily accessible — not buried in terms and conditions.
  • Update the privacy notice whenever processing activities change.

4. Records of Processing Activities (ROPA)

  • Maintain a ROPA (Article 30) documenting: processing purposes, categories of data subjects and data, recipients, transfers to third countries, retention schedules, and security measures.
  • Keep the ROPA up-to-date and available for supervisory authority inspection.

5. Data Protection Impact Assessments (DPIA)

  • Conduct a DPIA before starting any high-risk processing (large-scale profiling, systematic monitoring of public areas, processing of special category data at scale).
  • Involve your DPO in the DPIA process where applicable.
  • Consult the supervisory authority if the DPIA identifies residual high risk that cannot be mitigated.

6. Data Processor Agreements

  • Sign Data Processing Agreements (DPAs) with all processors that handle personal data on your behalf (cloud providers, SaaS tools, payroll providers, etc.).
  • Ensure DPAs include the mandatory Article 28 clauses: processing only on instructions, confidentiality, security measures, sub-processor rules, assistance with data subject rights, and deletion/return obligations.
  • Maintain a register of all processors and sub-processors.

7. International Data Transfers

  • Identify all transfers of personal data outside the EEA.
  • Use an adequacy decision, Standard Contractual Clauses (SCCs), Binding Corporate Rules, or other approved mechanism for each transfer.
  • Conduct Transfer Impact Assessments (TIAs) where SCCs are used.

8. Security Measures (Article 32)

  • Implement pseudonymisation and encryption where appropriate.
  • Ensure ongoing confidentiality, integrity, availability, and resilience of processing systems.
  • Have a tested restoration process for data after a technical incident.
  • Regularly test, assess, and evaluate the effectiveness of technical and organisational measures.

9. Breach Notification

  • Notify the supervisory authority within 72 hours of becoming aware of a personal data breach (unless unlikely to result in risk to individuals).
  • Notify affected data subjects without undue delay where the breach is likely to result in high risk.
  • Document all breaches, including those not reported, in a breach register.

10. Data Protection Officer (DPO)

  • Appoint a DPO if you are a public authority, carry out large-scale systematic monitoring of data subjects, or process special category data at large scale.
  • Publish the DPO's contact details on your privacy notice and register them with your supervisory authority.
  • Ensure the DPO has the resources and independence to perform their tasks.

Automating your ROPA, DPIA workflows, and DSR tracking significantly reduces the manual burden of GDPR compliance. Platforms like Barafaa centralise evidence, automate expiry reminders, and generate audit-ready reports.