# Gdpr Compliance Checklist > Creates GDPR compliance checklists with data mapping, consent mechanisms, and breach response procedures. Use when ensuring your business complies with GDPR requirements. - Skill: `reaperinvest/gdpr-compliance-checklist` (Agent Skill) - Install (CLI): `npx skillmds@latest add reaperinvest/gdpr-compliance-checklist` - Raw SKILL.md: https://api.skillmd.com/api/skills/reaperinvest/gdpr-compliance-checklist/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: reaperinvest (https://skillmd.com/u/reaperinvest) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/reaperinvest/gdpr-compliance-checklist --- # GDPR Compliance Checklist ## When to Use This Skill Use this skill when you need to: - Assess GDPR compliance for a business that serves EU customers - Create a data mapping inventory of personal data processing activities - Establish consent mechanisms, data subject rights procedures, and breach response plans - Build a compliance checklist to track your GDPR readiness **DO NOT** use this skill as a substitute for legal counsel or a Data Protection Officer. This is a compliance planning tool. Consult a GDPR specialist for complex data processing scenarios. --- ## Core Principle GDPR COMPLIANCE IS NOT A ONE-TIME PROJECT — IT IS AN ONGOING COMMITMENT TO TRANSPARENCY, DATA MINIMIZATION, AND RESPECT FOR INDIVIDUAL PRIVACY RIGHTS. --- ## Phase 1: Business Assessment ### Required Inputs | Input | What to Ask | Default | |-------|------------|---------| | **Business location** | "Where is your business based?" | No default — must be provided | | **EU customers** | "Do you have customers or website visitors from the EU?" | Yes | | **Personal data collected** | "What personal data do you collect? (names, emails, IPs, payment info)" | No default — must be provided | | **Processing activities** | "How do you use this data? (marketing, analytics, service delivery)" | No default — must be provided | | **Third-party tools** | "What third-party services process your data? (email, analytics, payments)" | No default — list all | | **Team size** | "How many people access personal data?" | 1-5 | **GATE: Do not proceed without personal data inventory and processing activities.** --- ## Phase 2: Data Mapping ``` ## Data Processing Inventory ### Personal Data Map | Data Category | Specific Data | Source | Purpose | Legal Basis | Storage Location | Retention | |--------------|--------------|--------|---------|-------------|-----------------|-----------| | Contact info | Name, email | Signup form | Service delivery | Contract | [Cloud provider] | Account lifetime + [X] months | | Payment | Card details | Checkout | Payment processing | Contract | [Stripe/processor] | As required by law | | Analytics | IP, device, pages | Website | Site improvement | Legitimate interest | [Analytics tool] | [26] months | | Marketing | Email, name | Opt-in form | Email marketing | Consent | [Email platform] | Until unsubscribe | ### Third-Party Processors | Processor | Data Shared | Purpose | DPA in Place? | Location | |-----------|-----------|---------|--------------|----------| | [Email platform] | Name, email | Email marketing | [Yes/No] | [Country] | | [Analytics] | IP, behavior | Website analytics | [Yes/No] | [Country] | | [Payment processor] | Payment data | Transactions | [Yes/No] | [Country] | | [Cloud hosting] | All stored data | Infrastructure | [Yes/No] | [Country] | ``` --- ## Phase 3: Compliance Checklist ``` ## GDPR Compliance Checklist ### Lawful Basis for Processing - [ ] Identified a lawful basis for each processing activity (consent, contract, legitimate interest, legal obligation, vital interest, public task) - [ ] Documented the lawful basis in the data processing inventory - [ ] Where consent is the basis, consent is freely given, specific, informed, and unambiguous - [ ] Consent records are stored (who, when, what they consented to) - [ ] Legitimate interest assessments documented where applicable ### Privacy Notice / Policy - [ ] Privacy policy published and easily accessible on website - [ ] Policy explains: what data is collected, why, how long it is kept, who it is shared with - [ ] Policy written in clear, plain language (not legal jargon) - [ ] Policy lists all third-party processors and their purposes - [ ] Policy explains data subject rights and how to exercise them - [ ] Policy includes contact information for data protection inquiries - [ ] Policy updated when processing activities change ### Consent Management - [ ] Cookie consent banner implemented (opt-in, not pre-checked) - [ ] Marketing email consent is separate from terms acceptance - [ ] Consent can be withdrawn as easily as it was given - [ ] Records of consent are maintained - [ ] Double opt-in used for email marketing (recommended, not required) ### Data Subject Rights - [ ] Process exists to handle access requests (Article 15) within 30 days - [ ] Process exists to handle rectification requests (Article 16) - [ ] Process exists to handle erasure requests (Article 17) — "right to be forgotten" - [ ] Process exists to handle data portability requests (Article 20) - [ ] Process exists to handle objection to processing (Article 21) - [ ] Process exists to handle restriction of processing (Article 18) - [ ] Identity verification procedure before fulfilling requests - [ ] Response templates created for each request type ### Data Security - [ ] Data encrypted at rest and in transit - [ ] Access controls implemented (least privilege principle) - [ ] Strong passwords and multi-factor authentication enforced - [ ] Regular security assessments conducted - [ ] Employee/contractor access to personal data is logged - [ ] Data processing agreements (DPAs) signed with all processors ### Data Breach Response - [ ] Breach detection and reporting procedures documented - [ ] Supervisory authority notification process (within 72 hours) - [ ] Data subject notification process (without undue delay for high-risk breaches) - [ ] Breach response team identified - [ ] Breach log maintained ### Data Minimization and Retention - [ ] Only necessary data is collected (no "just in case" data) - [ ] Retention periods defined for each data category - [ ] Automated deletion or anonymization after retention period - [ ] Regular review of stored data for necessity ### International Transfers - [ ] Data transfers outside EEA identified - [ ] Appropriate safeguards in place (Standard Contractual Clauses, adequacy decisions) - [ ] Transfer impact assessments conducted where required ### Organizational Measures - [ ] Staff trained on GDPR obligations and data handling - [ ] Data Protection Officer appointed (if required — 250+ employees or large-scale sensitive data processing) - [ ] Regular compliance reviews scheduled (at least annually) - [ ] Privacy by design considered in new products and features ``` --- ## Phase 4: Breach Response Plan ``` ## Data Breach Response Plan ### Step 1: Detection and Assessment (0-24 hours) - Identify the breach (unauthorized access, data loss, disclosure) - Assess scope: what data, how many people, what risk - Contain the breach (revoke access, patch vulnerability) ### Step 2: Documentation (0-72 hours) - Record: nature of breach, data affected, number of subjects, likely consequences, measures taken - Maintain in breach log regardless of severity ### Step 3: Authority Notification (within 72 hours) If the breach is likely to result in risk to individuals: - Notify the relevant supervisory authority within 72 hours - Include: description of breach, categories and number of subjects, likely consequences, measures taken ### Step 4: Data Subject Notification (without undue delay) If the breach is likely to result in HIGH risk to individuals: - Notify affected individuals directly - Include: description in plain language, likely consequences, measures taken, recommendations for protection ### Step 5: Review and Improve - Conduct post-incident review - Update security measures to prevent recurrence - Document lessons learned ``` --- ## Example: SaaS Startup with EU Customers **Data collected:** Name, email, IP, usage data, payment via Stripe. **Processors:** AWS (hosting, US), Stripe (payments, US), Mailchimp (email, US), Google Analytics (analytics, US). **Actions:** Signed DPAs with all processors, implemented cookie consent with opt-in, published privacy policy listing all processors, created data export feature for portability requests, set 26-month retention on analytics data, enabled data deletion on account closure. --- ## Anti-Patterns - **Treating GDPR as a checkbox exercise** — compliance is ongoing. Revisit when you add new tools, features, or data collection. - **Relying on consent for everything** — consent is one of six legal bases. Contract performance and legitimate interest are often more appropriate and simpler. - **Privacy policy nobody can understand** — GDPR requires clear, plain language. If a user cannot understand your policy, it does not comply. - **No DPAs with processors** — if your email platform processes EU personal data and you do not have a DPA, you are both non-compliant - **Ignoring the 72-hour breach notification rule** — this is a strict deadline. Have your response plan ready before a breach occurs. --- ## Recovery - **Not currently GDPR compliant:** Prioritize: 1) Privacy policy, 2) Cookie consent, 3) DPAs with processors, 4) Data subject rights processes. Address highest-risk gaps first. - **Received a data subject access request:** Respond within 30 days. Verify identity, compile all personal data held, provide in a portable format. - **Data breach occurred:** Follow the response plan. Document everything. Notify the authority within 72 hours if risk to individuals exists. - **Using US-only tools without DPAs:** Most major SaaS tools (Stripe, AWS, Mailchimp) offer DPAs. Request and execute them immediately.