Mattakushi432 GDPR Compliance Checklist
Disclaimer: This is informational only and does not constitute legal advice. Consult qualified legal counsel for your specific situation.
Applicability
GDPR applies if you:
- Are established in the EU/EEA
- Offer goods/services to EU residents (regardless of payment)
- Monitor behavior of EU residents
1. Lawful Basis for Processing
You must identify and document a lawful basis before processing begins.
| Basis | When to Use |
|---|---|
| Consent | Marketing, non-essential cookies, optional features |
| Contract | Fulfilling a contract the data subject is party to |
| Legal obligation | Compliance with law (tax, employment) |
| Vital interests | Life-or-death emergencies only |
| Public task | Government/public authority functions |
| Legitimate interests | Business need that doesn't override individual rights — requires LIA |
Legitimate Interests Assessment (LIA)
- Purpose test: Is the purpose legitimate?
- Necessity test: Is processing necessary for that purpose?
- Balancing test: Do individual interests override yours?
Consent Requirements
- Freely given (no bundling with service terms)
- Specific (separate consent per purpose)
- Informed (plain language, named third parties)
- Unambiguous (affirmative action, no pre-ticked boxes)
- Withdrawable at any time as easily as given
- Documented with timestamp, method, and version
2. Data Subject Rights (8 Rights)
Right to Be Informed (Articles 13–14)
- Privacy notice at point of collection
- 13 mandatory elements in notice
- Update notice within 1 month of changes
Right of Access (Article 15)
- Respond within 1 month (extendable to 3 months for complex requests)
- Provide copy of data in machine-readable format
- Include: purposes, categories, recipients, retention, source
- Cannot charge fee (unless manifestly unfounded/excessive)
Right to Rectification (Article 16)
- Correct inaccurate data within 1 month
- Complete incomplete data
- Notify third parties you've shared data with
Right to Erasure / "Right to be Forgotten" (Article 17)
Applies when:
- Data no longer necessary for original purpose
- Consent withdrawn and no other basis
- Objection upheld
- Unlawfully processed
- Legal obligation requires deletion
Exceptions: freedom of expression, legal obligation, public health, scientific/historical research, legal claims.
Right to Restrict Processing (Article 18)
- Mark data as restricted (do not process, only store)
- Notify before lifting restriction
- Triggers: accuracy contested, unlawful processing, controller no longer needs data, objection pending
Right to Data Portability (Article 20)
- Provide data in structured, commonly used, machine-readable format (JSON, CSV)
- Transfer directly to another controller where technically feasible
- Applies only to data provided by the subject, processed by consent or contract
Right to Object (Article 21)
- Immediately stop processing when objection received
- Burden on you to demonstrate compelling legitimate grounds
- Absolute right to object to direct marketing processing
Rights Related to Automated Decision-Making (Article 22)
- Do not make solely automated decisions with legal/significant effect without human review option
- Provide meaningful information about the logic
- Allow right to contest the decision
3. Data Protection by Design and Default
By Design
- Consider data protection at system design stage
- Data minimization: collect only what is necessary
- Pseudonymization by default where possible
- End-to-end encryption for sensitive data in transit and at rest
By Default
- Default settings should be most privacy-protective
- Opt-in (not opt-out) for non-essential processing
- Minimum retention periods enforced automatically
4. Data Protection Impact Assessment (DPIA)
Mandatory when processing is "likely to result in high risk":
- Systematic profiling with legal/significant effects
- Large-scale processing of special category data
- Systematic monitoring of publicly accessible areas
- New technologies with unknown risks
DPIA Process
- Describe the processing (purpose, nature, scope, context)
- Assess necessity and proportionality
- Identify and assess risks to data subjects
- Identify measures to mitigate risks
- Consult DPA if residual risk remains high
- Document and review annually or on change
5. Data Breach Notification
Timeline
- 72 hours: Notify supervisory authority (DPA) from becoming aware
- Without undue delay: Notify affected data subjects if high risk
Notification to DPA Must Include
- Nature of the breach (categories and approximate number of records)
- Name and contact details of DPO
- Likely consequences
- Measures taken/proposed to address the breach
Notification to Data Subjects (High-Risk Breaches)
- Plain language description of the breach
- DPO contact details
- Likely consequences
- Measures taken to mitigate harm
Breach Log (Even if No Notification Required)
Maintain internal record of all breaches including: description, effects, remediation, decision rationale.
6. International Data Transfers
Transfer outside EEA only when:
| Mechanism | Notes |
|---|---|
| Adequacy decision | UK, Switzerland, Japan, Canada (commercial), Israel, South Korea, New Zealand |
| Standard Contractual Clauses (SCCs) | 2021 SCCs — 4 modules available |
| Binding Corporate Rules (BCRs) | For intra-group transfers, requires DPA approval |
| Approved certification | APEC CBPR, EU-US Data Privacy Framework |
| Derogations | Explicit consent, contract performance, public interest, legal claims, vital interests |
Transfer Impact Assessment (TIA)
Required for SCCs: assess destination country's law and practice against EU standards.
7. Data Protection Officer (DPO)
Mandatory when:
- Public authority or body
- Core activities require large-scale systematic monitoring of individuals
- Core activities require large-scale processing of special category data
DPO Requirements
- Expert knowledge of data protection law
- Independent (cannot be dismissed for performing DPO tasks)
- Report to highest management level
- Published contact details (register with DPA)
- Involved in all data protection matters from earliest stage
8. Record of Processing Activities (RoPA)
Required for organizations with 250+ employees OR processing that is not occasional / involves special categories / risks to individuals.
RoPA Must Contain (Article 30)
- Controller name and contact details
- Processing purposes
- Categories of data subjects and personal data
- Categories of recipients (including third countries)
- Retention schedules
- Security measures description
- International transfers and safeguards
9. Data Processing Agreements (DPAs)
Required when engaging processors (vendors who process data on your behalf).
Mandatory Clauses (Article 28)
- Process only on documented instructions
- Confidentiality obligations on personnel
- Appropriate security measures (Article 32)
- Subprocessor approval requirement
- Assist controller with data subject rights
- Delete or return data at end of service
- Provide audit assistance
10. Special Category Data
Extra protection required for:
- Racial/ethnic origin
- Political opinions
- Religious/philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data (for unique identification)
- Health data
- Sex life/sexual orientation
Additional lawful basis required (Article 9): explicit consent, employment law, vital interests, legitimate activities of nonprofit, made public by subject, legal claims, substantial public interest, health/social care, public health, archiving/research.
Quick Compliance Checklist
- Privacy notice published and up to date
- RoPA maintained
- Lawful basis documented for each processing activity
- Consent records with timestamps stored
- DPAs signed with all processors
- Data subject request process documented and tested
- Breach response procedure documented
- DPIA completed for high-risk processing
- International transfer mechanisms in place
- DPO appointed (if required) and registered
- Data retention schedule enforced
- Privacy by design in SDLC process