ChecklistEU

EU GDPR Checklist

A checklist designed for execution: owners, evidence, acceptance criteria.

Use it to build a compliance program that is provable under pressure.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 21, 2026

Updated

Feb 21, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 21, 2026

Updated Feb 21, 2026

Overview

GDPR is not a policy exercise. It is a set of controls, registers, and timed workflows that need to survive product change, vendor change, transfer change, and incident pressure. This checklist is strongest when used as a program backbone: scope and role mapping, lawful-basis control, rights workflows, RoPA upkeep, DPIA governance, breach readiness, vendor clauses, transfer packs, and a single evidence index.

Section 1

1) Scope, roles, and inventory (foundation)

Goal: a defensible applicability decision and a processing inventory baseline.

If you cannot explain scope, everything else becomes inconsistent.

Article 2-3 applicability memo (material + territorial scope) with facts and evidence.
Role mapping per activity: controller vs processor vs joint controller (owners and obligations).
Processing inventory: systems, data categories, purposes, recipients, and retention (baseline).

Section 2

2) Lawful basis, consent, and transparency (make the legal model real)

Goal: each processing purpose has a lawful basis and a corresponding transparency record.

Avoid lawful basis drift where teams change the purpose but keep the old basis.

Lawful basis map per purpose (Article 6) with decision rationale and owner.
Consent design (where used): capture, withdrawal, versioning (Article 7) + consent proof schema.
Privacy notices and layered transparency (Articles 12-14) tied to product flows and data collection points.

Section 3

3) DSAR workflow (Articles 12-22) - operationalize requests

Goal: DSAR handling is measurable, consistent, and explainable across systems and vendors.

DSAR failures are usually process failures: intake, identity checks, search scope, and deadline tracking.

DSAR intake channels and identity verification rules with abuse protections.
Search playbook: systems to search, log formats, and response format standards.
SLA tracking: 1-month target + extension criteria and notification templates.
Evidence: request logs, decisions, response packages, and escalation approvals.

Section 4

4) DPIA and risk management (Articles 35-36) - high-risk governance

Goal: identify high-risk processing early and control it with documented assessments.

DPIAs must be usable by engineering teams: controls, mitigations, and residual risk decisions.

DPIA triggers and screening checklist; DPIA template and review workflow.
Mitigation tracking linked to product backlog (privacy by design controls).
If needed: prior consultation process artifacts and decision records.
Evidence: DPIA register, approvals, and residual risk sign-offs.

Section 5

5) Security of processing + breach response (Articles 32-34)

Goal: security controls are mapped to personal data processing risks and are testable.

Breach response must be executable: awareness timekeeping, risk tests, and notification templates.

Security controls mapped to data and threats (access control, encryption, logging, monitoring).
Breach workflow: classification, awareness timestamp, Article 33 risk test, Article 34 high-risk test.
Evidence pack: incident timeline, logs, decisions, communications, and remediation.

Section 6

6) Vendor/processor contracts (Article 28) + ongoing vendor governance

Goal: vendor contracts and oversight reflect actual processing and transfer reality.

A signed DPA without operational controls is a common enforcement failure.

Article 28 contract clauses present and tailored to processing reality (sub-processors, audits, security).
Vendor inventory mapped to processing purposes, data categories, and transfer destinations.
Ongoing monitoring: SOC/ISO evidence, incident reporting, sub-processor change notifications.

Section 7

7) International transfers (Chapter V) - SCCs, TIA, supplementary measures

Goal: Chapter V compliance is engineered: transfer map, mechanism choice, and operational controls.

Treat SCCs as an implementation project: configuration, logging, and governance-not a legal PDF.

Transfer map: exporters/importers, data categories, destinations, and onward transfers.
Mechanism selection: adequacy vs SCCs vs other safeguards; document decisions.
TIA + supplementary measures playbook; evidence of implementation and monitoring.

Section 8

Evidence index (the fastest way to be audit-ready)

Goal: export evidence quickly and consistently. Aim for coherence, not volume.

Scope memo + role mapping + processing inventory baseline.
Lawful basis map + notice versions + consent logs (if applicable).
DSAR logs + response packages + search playbooks.
DPIA register + mitigations + approvals.
Breach playbook + incident logs + notification artifacts.
Vendor contracts + sub-processor list + audit evidence.
Transfer map + SCC packs + TIA + supplementary measures evidence.

Recommended next step

Turn EU GDPR Checklist into an operational assessment

Assessment Autopilot can take EU GDPR Checklist from turning this checklist into an operational workflow to a reusable workflow inside Sorena. Teams working on EU GDPR can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Assessment workflow

Open Assessment Autopilot for EU GDPR Checklist

Start from EU GDPR Checklist and turn the guidance into owned tasks, evidence requests, and review checkpoints.

Explore next step

Talk to Sorena

Talk through EU GDPR

Review your current process, evidence gaps, and next steps for EU GDPR Checklist.

Explore next step

Primary sources