The checklist
Organisation / site: · Reviewed by: · Date: · Next review due:
Mark each item done or gap. Every gap becomes an action with an owner and a due date.
1. Scope and ownership
| # | Check | GDPR reference | Done | Gap | Notes |
|---|---|---|---|---|---|
| 1 | We have confirmed whether GDPR applies to us (EU establishment, or offering goods or services to or monitoring people in the EU) | Art. 3 | ☐ | ☐ | |
| 2 | A named person owns data protection and reports to senior management | Art. 24 | ☐ | ☐ | |
| 3 | We have checked whether we must appoint a data protection officer (DPO), and appointed one if so | Arts. 37–39 | ☐ | ☐ | |
| 4 | If we are outside the EU, we have checked whether we need an EU representative | Art. 27 | ☐ | ☐ |
2. Know your data
| # | Check | GDPR reference | Done | Gap | Notes |
|---|---|---|---|---|---|
| 5 | A record of processing activities lists what personal data we hold, why, where it sits, who can see it and how long we keep it | Art. 30 | ☐ | ☐ | |
| 6 | The record covers operations data, not just customer and HR systems: incident reports, training records, visitor and contractor logs, CCTV, access cards | Art. 30 | ☐ | ☐ | |
| 7 | Special category data (health, biometrics, union membership and others) is identified and has a separate condition for processing | Art. 9 | ☐ | ☐ | |
| 8 | We collect only the data we need for each purpose and do not reuse it for unrelated purposes | Art. 5(1)(b)–(c) | ☐ | ☐ |
3. Lawful basis, consent and transparency
| # | Check | GDPR reference | Done | Gap | Notes |
|---|---|---|---|---|---|
| 9 | Each processing activity has one documented lawful basis | Art. 6 | ☐ | ☐ | |
| 10 | Where we rely on consent, it is specific, informed, freely given, recorded and as easy to withdraw as to give | Art. 7 | ☐ | ☐ | |
| 11 | Privacy notices for customers, staff, contractors and website visitors say what we collect, why, the lawful basis, who receives it, retention and people's rights | Arts. 12–14 | ☐ | ☐ |
4. People's rights
| # | Check | GDPR reference | Done | Gap | Notes |
|---|---|---|---|---|---|
| 12 | Staff know how to recognise and pass on a request for access, correction, erasure, restriction, portability or objection | Arts. 15–21 | ☐ | ☐ | |
| 13 | Requests are logged and answered within one month (extendable by two months for complex cases) | Art. 12(3) | ☐ | ☐ | |
| 14 | Any solely automated decision with legal or similarly significant effects has safeguards, including human review | Art. 22 | ☐ | ☐ |
5. Processors and international transfers
| # | Check | GDPR reference | Done | Gap | Notes |
|---|---|---|---|---|---|
| 15 | Every supplier that processes personal data for us has a written data processing agreement | Art. 28 | ☐ | ☐ | |
| 16 | Transfers outside the EU rely on an adequacy decision, standard contractual clauses or another approved safeguard | Arts. 44–49 | ☐ | ☐ |
6. Security, design and retention
| # | Check | GDPR reference | Done | Gap | Notes |
|---|---|---|---|---|---|
| 17 | Access to personal data is limited by role and reviewed when people change jobs or leave | Art. 32 | ☐ | ☐ | |
| 18 | Security measures fit the risk: encryption or pseudonymisation where suitable, backups, and regular testing | Art. 32 | ☐ | ☐ | |
| 19 | New systems, forms and processes are checked for privacy before go-live (data protection by design and default) | Art. 25 | ☐ | ☐ | |
| 20 | A data protection impact assessment (DPIA) is done before high-risk processing, such as large-scale monitoring | Art. 35 | ☐ | ☐ | |
| 21 | A retention schedule is followed and old data is deleted or anonymised on time | Art. 5(1)(e) | ☐ | ☐ | |
| 22 | Staff who handle personal data are trained, and the training is recorded | Arts. 24, 39 | ☐ | ☐ |
7. Breaches and accountability
| # | Check | GDPR reference | Done | Gap | Notes |
|---|---|---|---|---|---|
| 23 | A breach procedure covers reporting to the supervisory authority within 72 hours where required | Art. 33 | ☐ | ☐ | |
| 24 | Affected people are told without undue delay when a breach is likely to result in a high risk to them | Art. 34 | ☐ | ☐ | |
| 25 | Every breach, reported or not, is logged with its facts, effects and remedial action | Art. 33(5) | ☐ | ☐ | |
| 26 | Policies, records and this review are kept as evidence, and the review is repeated at least yearly | Art. 5(2) | ☐ | ☐ |
Gaps found: · Actions / owner / due: · Sign-off:
This checklist is general information to help you organise a review. It is not legal advice; check specific questions with your DPO, privacy lead or a lawyer.
Who does GDPR apply to?
Any organisation established in the EU that handles personal data, whatever its size, and any organisation outside the EU that offers goods or services to people in the EU or monitors their behaviour there (Article 3). Personal data means any information about an identifiable living person, so a name on a training record, a staff number on an incident report or a face on CCTV all count. An Australian or US company with an EU site, EU customers or EU staff is likely to be in scope.
What are the seven GDPR principles?
Article 5 sets the principles every item on the checklist comes back to:
- Lawfulness, fairness and transparency: have a lawful basis and tell people what you do with their data.
- Purpose limitation: collect data for a stated purpose and do not repurpose it unfairly.
- Data minimisation: collect only what you need.
- Accuracy: keep it correct and up to date.
- Storage limitation: keep it no longer than needed.
- Integrity and confidentiality: protect it against loss, misuse and unauthorised access.
- Accountability: be able to show you comply.
Where does operations and frontline data fit in?
GDPR reviews often stop at the CRM and the HR system. Operations teams hold plenty of personal data too: injury and incident reports (often health data under Article 9), skills and training records, shift rosters, contractor inductions with licence numbers, visitor sign-in sheets, CCTV and vehicle telematics. Include these in the data map, give each a retention period and limit who can see the sensitive ones.
How often should you review GDPR compliance?
Run the full checklist at least once a year, and again when something changes: a new system, a new supplier, a new site or country, or a breach. Many organisations split it into smaller recurring checks, such as a quarterly access review and a monthly breach and rights request log review, so problems are found between annual reviews.
Step by step
- Confirm scope and owner. Check whether GDPR applies to you, name the person who owns data protection and decide whether you need a DPO or an EU representative.
- Map your personal data. Build a record of processing activities covering every system and paper form, including operations data such as incident reports, training records and CCTV.
- Set a lawful basis for each use. Document one lawful basis per processing activity, and a separate condition for any special category data such as health information.
- Update privacy notices. Make sure customers, staff, contractors and website visitors are told what you collect, why, who receives it, how long you keep it and their rights.
- Set up rights and breach procedures. Give staff a simple way to pass on rights requests and suspected breaches, with a log and the one-month and 72-hour deadlines built in.
- Check suppliers, security and retention. Put data processing agreements in place, review access and security controls, and delete data that is past its retention date.
- Track gaps to closure and repeat. Turn every gap into an action with an owner and due date, keep the evidence and repeat the review at least yearly.
A worked example
A packaging manufacturer with sites in Australia and Ireland ran its first GDPR review across HR, IT and operations. The data map found personal data the office team had not counted: injury reports naming staff and describing their injuries, contractor induction records with licence numbers, and loading dock CCTV kept with no end date. Because injury details are health data, access was limited to the safety and HR leads. The site set a fixed CCTV retention period, contractor records were given a deletion date tied to the end of each contract, and the Irish site's staff privacy notice was rewritten to cover all three. Each gap was tracked as an action with an owner until it was closed.