We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideEU

EU GDPR Checklist

Check whether a product, service, vendor, dataset, or workflow has the GDPR basics covered: scope, role, lawful basis, transparency, rights, DPIA, RoPA, contracts, transfers, breach response, retention, security, and accountability evidence.

Built from official EU text and regulator guidance; designed for privacy, legal, product, security, procurement, support, HR, marketing, and data governance teams.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
4 sections5 primary sources
Overview

Review this checklist before launching or materially changing processing of . It connects each purpose and lawful basis to the operational records that prove the decision, including rights handling, the RoPA, any required DPIA, processor and transfer files, breach decisions, retention rules, and security evidence. It does not replace case-specific legal analysis.

Section 1

Scope, role, lawful basis, and transparency

Start by proving that the activity is or is not GDPR processing. Record the , data subjects, processing operations, controller or processor role, establishment or EU-targeting facts, and whether any special category or criminal-offence data is involved.

For each purpose, assign one Article 6 lawful basis before collection or use. If consent is used, keep the consent wording, capture event, withdrawal route, and evidence that consent was freely given, specific, informed, and unambiguous. If legitimate interests is used, keep the interest, necessity analysis, balancing outcome, safeguards, and objection route. Article 9 special-category processing needs both an Article 6 basis and a separate Article 9(2) condition; Article 10 criminal-offence processing has its own authority and safeguard requirements.

  • Scope check: identify whether is processed by automated means or in a filing system, and document any Article 2 or Article 3 reason the GDPR does or does not apply.
  • Territorial-scope evidence: for a non-EU organisation, record the EU establishment context or the facts showing an offer of goods or services to people in the Union or monitoring of their behaviour there; a globally accessible website alone does not settle Article 3 scope.
  • Role check: name the controller, joint controller, processor, or sub-processor for each data flow and record who determines the purpose, essential means, and permitted instructions. Contract labels are evidence, not the final role test.
  • Lawful-basis check: map every processing purpose to Article 6 and record why its conditions fit. Add the Article 9 condition or Article 10 authority and safeguards where the relevant data is present.
  • Consent evidence: preserve the notice and consent-request version, purposes, controller identity, affirmative action, timestamp, withdrawal route, and downstream suppression or deletion steps. Refusal or withdrawal must not silently switch the same purpose to a reserve basis.
  • Transparency check: ensure Articles 13 and 14 notices state controller identity, DPO contact where applicable, purposes, legal basis, legitimate interests where applicable, recipients, transfers and safeguards, storage period or criteria, rights, complaint route, data source for Article 14, and automated decision-making details where relevant.
  • Notice-delivery check: give Article 13 information when data is obtained. For Article 14, provide the information within a reasonable period and no later than one month, but at the latest at the first communication if the data is used to communicate with the person, or when the data is first disclosed if disclosure to another recipient is envisaged, subject to the Article 14(5) exceptions.
  • Design check: translate purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability into product requirements, default settings, access rules, deletion jobs, and operational runbooks.
Section 2

Rights, DSARs, retention, erasure, and RoPA

Create a rights workflow that can receive, authenticate, triage, fulfil, refuse, or extend requests without relying on ad hoc inbox searches. Ask for additional identity information only when there are reasonable doubts about identity, and keep the request open across the channels the organisation has designated. The access workflow should cover confirmation of processing, the itself, required processing information, transfer safeguards, and a copy of the data where required.

Keep the RoPA close to the actual processing inventory. A useful controller RoPA is not a policy pointer; it lists processing purposes, data subject categories, categories, recipient categories, transfers, envisaged erasure time limits where possible, and a general description of security measures where possible. Processor records need their separate Article 30(2) fields.

  • DSAR intake: record request channel, receipt date, identity doubts and proportionate verification, requested right, systems and processors to search, response owner, and deadline. Article 12 generally requires action without undue delay and within one month, with a possible two-month extension for complex or numerous requests.
  • Deadline decision: tell the requester about an extension and the reasons within the first month. If no action will be taken, give the reasons and complaint or judicial-remedy information without delay and at the latest within one month.
  • Access response: include confirmation whether processing occurs, purposes, data categories, recipients, storage period or criteria, rights, complaint route, source information where data was not collected from the requester, automated decision-making information where relevant, and Article 46 safeguards for third-country transfers.
  • Rights routing: test access, rectification, erasure, restriction, portability, objection, and Article 22 requests separately because their scope, exceptions, and response work differ. Log the legal reason for any full or partial refusal.
  • Erasure and restriction: check whether Article 17 erasure grounds or exceptions apply, whether another purpose and lawful basis requires retention, whether restriction should replace deletion, and whether recipients must be told about rectification, erasure, or restriction.
  • Retention: tie each data category and copy to a purpose, start event, time limit or criteria, disposal action, legal-hold rule, and evidence that deletion or anonymisation jobs ran. Do not keep data because a future use might appear later.
  • RoPA: maintain controller and processor records in writing, including electronic form, and make sure they are self-contained enough to be provided to a supervisory authority on request. If the organisation employs fewer than 250 people, do not assume it is exempt: Article 30(5) does not excuse non-occasional processing, processing likely to create risk, or processing that includes Article 9 or Article 10 data.
  • Reconciliation check: compare the RoPA row with the notice, consent record, processor list, transfer inventory, retention schedule, DPIA, and system data map. Record and assign any mismatch rather than approving contradictory evidence.
Section 3

DPIA, processors, transfers, and breach response

Treat DPIA, vendor, transfer, and incident checks as launch gates. They should be complete before high-risk processing begins, before a processor receives data, before a third-country transfer starts, and before incident teams need to make 72-hour notification decisions.

Do not treat SCCs as a signature-only exercise. First identify whether is transmitted or otherwise made available by an exporter subject to the GDPR to a different controller or processor in a third country or international organisation. The transfer record should then identify the exporter, importer, countries, data, transfer tool, SCC module and annexes, assessment, supplementary measures, and review trigger for legal or technical changes that could affect the transfer.

  • DPIA screening: test the Article 35 high-risk threshold and the three listed examples: systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which legal or similarly significant decisions are based; large-scale Article 9 or Article 10 processing; and systematic large-scale monitoring of a publicly accessible area. Also check the competent supervisory authority's published list.
  • DPIA file: before processing, document the processing and purposes, necessity and proportionality, risks to rights and freedoms, planned safeguards, DPO advice where applicable, data-subject or representative views where appropriate, decision owner, residual risk, sign-off, and review triggers.
  • Prior-consultation gate: if the DPIA shows that residual high risk would remain after the planned measures to mitigate it, do not launch until the Article 36 prior-consultation decision and supervisory-authority process are recorded.
  • Processor due diligence: document why the processor provides sufficient guarantees, which services and locations were reviewed, the security evidence date, unresolved exceptions, approval owner, and reassessment trigger.
  • Processor contract: before a processor starts, check subject matter and duration, nature and purpose, data types and data subjects, documented instructions, confidentiality, Article 32 security, sub-processor authorisation and flow-down, rights assistance, breach and DPIA assistance, return or deletion at service end, audit cooperation, and written or electronic form. Keep this separate from the processor's direct GDPR duties, including security, records where required, cooperation, and notifying the controller of a breach without undue delay.
  • Transfer check: inventory third-country disclosures and access, including remote support and cloud administration by a separate importer; verify adequacy or another Chapter V route. For SCC transfers, keep the signed clauses, correct module, completed annexes, transfer assessment, supplementary measures, and suspension or review trigger.
  • Breach workflow: detect and escalate security incidents quickly, decide whether a breach occurred, record when the controller reached reasonable certainty, assess risk to individuals, notify the supervisory authority without undue delay and where feasible within 72 hours unless unlikely to result in risk, and communicate to individuals without undue delay when high risk is likely.
  • Breach record: document every breach, including one that is not notified, with facts, effects, remedial action, risk assessment, notification decision, awareness time, reasons for delay if applicable, communications, phased updates, and controller or processor hand-offs.
Section 4

Security, accountability, and evidence to keep

Close the checklist only when the evidence shows both compliance design and operating reality. For each processing activity, keep the source citation, control owner, reviewer, decision date, implementation proof, open exception, and reopening trigger together. A policy or contract proves design only; sample records, configured controls, logs, deletion results, response files, or test results show whether the process operates.

Security evidence should be risk-based. Article 32 points to measures such as pseudonymisation, encryption, confidentiality, integrity, availability, resilience, restoration capability, and regular testing, but the selected controls must fit the nature, scope, context, purposes, and risk of the processing.

  • Minimum evidence pack: dated processing map, role analysis, purpose and lawful-basis record, notice version and delivery evidence, rights procedure and sample case evidence, RoPA row, DPIA screening or report, processor due diligence and contract review, transfer file, breach runbook and decision log, retention schedule, and security-control mapping.
  • Security proof: record applicable access controls, privileged access, authentication, encryption or pseudonymisation decisions, key management, logging and monitoring, backup and restoration tests, vulnerability or control testing, incident escalation, staff confidentiality and training, secure disposal, and processor security evidence.
  • Control test: identify the control objective, operator, frequency, population, evidence produced, exception route, and last successful test. Do not mark a control complete solely because a policy says it should happen.
  • Accountability proof: keep approvals by the relevant privacy, legal, product, security, vendor, and business owners; record exceptions with rationale, affected data and people, compensating controls, risk owner, expiry date, and escalation owner.
  • Reopen triggers: new purpose, incompatible reuse, new data category, special-category data, new recipient, new processor or sub-processor, new third-country access, changed automated decision, high-risk processing change, incident, rights-request failure, retention change, or material security-control change.
  • Quality check: every checklist item should answer who owns and operates the control, what source supports it, what evidence proves both design and operation, where the evidence is stored, which exception remains, who approved it, and when the item must be reviewed.
Recommended next step

Use the checklist to assign owners and close evidence gaps

Sorena can turn the GDPR checks on this page into cited tasks, owner assignments, evidence requests, and reusable review records for privacy, product, security, vendor, and support teams.

Research workflow
Open Research Copilot for EU GDPR

Ask questions tied to cited sources about GDPR scope, lawful basis, DSARs, DPIAs, RoPA, processors, transfers, breach handling, and evidence using the cited sources on this page.

Explore next step
Talk to Sorena
Talk through implementation

Review your GDPR checklist owners, source support, transfer records, processor contracts, and evidence gaps with Sorena.

Explore next step
Primary sources

References and citations

Regulation (EU) 2016/679 (GDPR)
eur-lex.europa.eu5 citations
Referenced sections
  • Primary GDPR text supporting scope, roles, principles, lawful basis, transparency, data subject rights, erasure, RoPA, processors, security, breach notification, DPIA, transfers, and accountability.
  • Supports the checklist items for material and territorial scope, definitions, Article 5 principles, Article 6 lawful bases, Article 9 special-category conditions, and Articles 13-14 transparency content.
  • Supports Article 12 request timing and modalities, Article 15 access content, Article 17 erasure grounds, Article 19 recipient notification, Article 30 records, and storage limitation under Article 5.
Show 2 more
  • Supports Article 28 processor contracts, Article 32 security, Articles 33-34 breach notification and communication, Article 35 DPIA requirements, and Chapter V transfer rules.
  • Supports accountability under Article 5(2), controller responsibility under Article 24, data protection by design and default under Article 25, and security of processing under Article 32.
"able to demonstrate compliance"
More quoted passages
"lawfulness, fairness and transparency"
"without undue delay"
"not later than 72 hours"
Irish DPC - Records of Processing Activities under Article 30 GDPR
dataprotection.ie3 citations
Referenced sections
  • Supports RoPA content, maintenance, granularity, ownership, retention detail, security descriptions, and self-contained evidence.
  • Supports the RoPA checklist, including granular business-function records, retention detail, security-measure descriptions, update discipline, and self-contained records.
  • Supports keeping RoPA evidence granular, current, self-explanatory, and ready to provide on request.
"Record of Processing Activities"
More quoted passages
"living and dynamic document"
ENISA - Handbook on Security of Personal Data Processing
enisa.europa.eu2 citations
Referenced sections
  • Supports risk-based technical and organisational security measures for personal data processing.
  • Supports risk-based security checks for confidentiality, integrity, availability, and technical and organisational measures.
"confidentiality, integrity and availability"
European Commission - Standard Contractual Clauses
commission.europa.eu2 citations
Referenced sections
  • Supports international transfer checks using Commission standard contractual clauses.
  • Supports the SCC transfer-tool checklist and Commission resources for international data-transfer clauses.
"Standard Contractual Clauses"
Irish DPC - Data Protection Impact Assessments
dataprotection.ie2 citations
Referenced sections
  • Supports DPIA trigger, content, stakeholder involvement, DPO advice, processor assistance, residual-risk handling, and review practices.
  • Supports operational DPIA checks, including early project-stage assessment, stakeholder input, DPO advice, processor assistance, sign-off, and review of residual risk.
"high risk processing projects"

Related guides

EU GDPR Applicability Test for Products, Vendors, and Data Flows

A concrete GDPR scope test for personal data, controller and processor roles, EU establishment, EU targeting or monitoring, special-category and child data, transfers, vendors, and evidence.

EU GDPR Article 30 RoPA Intake Workflow

This GDPR Article 30 RoPA intake workflow helps capture controller and processor fields, owners, transfers, retention, security measures, and evidence before a processing activity goes live.

EU GDPR Automated Decision-Making and Profiling: Article 22 Scope, Safeguards, and Evidence

GDPR guide to profiling and Article 22 decisions: scope, transparency, lawful basis, DPIA triggers, safeguards, human intervention, challenge rights, and evidence.

EU GDPR Breach Notification 72 Hours: Article 33 and 34 workflow

EU GDPR breach notification workflow covering awareness, 72-hour supervisory authority notices, processor escalation, high-risk data-subject communication, delay reasons, and evidence logs.

EU GDPR Breach Notification Workflow: 72-hour clock, risk assessment, and records

A concrete EU GDPR breach notification workflow for detecting and triaging incidents, starting the awareness clock, assessing risk, notifying authorities or data subjects, and keeping Article 33 records.

EU GDPR Children and Special-Category Data Guide

GDPR guide to children's consent and special-category data: Article 8 national age variation, Article 9 conditions, transparency, DPIA triggers, safeguards, and evidence.

Show all related guides (39)

EU GDPR Compliance Checklist: scope, rights, DPIA, RoPA, transfers

Practical EU GDPR compliance guide for mapping scope, lawful basis, notices, data-subject rights, DPIAs, RoPA, processor terms, breaches, transfers, retention, security, and penalties.

EU GDPR Controller, Processor, and Joint Controller Roles

Classify GDPR controllers, processors, and joint controllers from actual decision-making, then document Article 26 allocation, Article 28 terms, instructions, and vendor evidence.

EU GDPR Data Subject Rights and DSAR Workflow

GDPR rights-request workflow for intake, identity checks, request scope, the one-month response clock, extensions, refusals, processor coordination, and evidence.

EU GDPR deadlines and compliance calendar

EU GDPR calendar for calculating rights-request deadlines, breach notification, DPIA and prior-consultation gates, transfer reviews, and retention checks.

EU GDPR DPIA and Prior Consultation Workflow

Screen high-risk processing, run a GDPR Article 35 DPIA, record mitigation, and identify when Article 36 prior consultation is required.

EU GDPR DPIA and risk management under Articles 35 and 36

EU GDPR DPIA guide covering Article 35 triggers and contents, CNIL and DPC PIA methods, residual risk, mitigation records, and prior consultation limits.

EU GDPR DSAR Workflow: Intake, Clock, Rights, and Evidence

Run a GDPR DSAR workflow for intake, identity checks, rights scoping, one-month response timing, extensions, refusals, processor handoffs, and evidence records.

EU GDPR FAQ: scope, lawful basis, rights, DPIA, breaches, transfers

Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers.

EU GDPR International Transfers and SCCs: Chapter V evidence guide

GDPR Chapter V guide to adequacy decisions, SCCs, transfer assessments, supplementary measures, Article 49 derogations, and EU-US DPF checks.

EU GDPR Lawful Basis and Consent Guide

Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records.

EU GDPR Lawful Basis and LIA Workflow for Article 6(1)(f)

Assess GDPR legitimate interests with a purpose, necessity, balancing, Article 21 objection, and evidence-record workflow based on Article 6(1)(f).

EU GDPR Lead Supervisory Authority and One-Stop-Shop

How GDPR main establishment, cross-border processing, Article 56 lead authority competence, and Article 60 cooperation fit together.

EU GDPR LIA Template for Article 6(1)(f)

This EU GDPR legitimate interests assessment template helps document Article 6(1)(f) purpose, necessity, balancing, safeguards, objection rights, and evidence.

EU GDPR penalties and fines: Article 83 tiers and evidence

EU GDPR penalties guide covering Article 83 fine ceilings, the EDPB calculation method, CJEU conditions, Article 58 powers, and evidence.

EU GDPR Processor Contracts and Vendor Management | Article 28 Evidence Guide

EU GDPR Article 28 guide for processor contracts, sub-processor controls, controller-processor role boundaries, vendor evidence, and SCC transfer clauses where applicable.

EU GDPR Record of Processing Activities Template: Article 30 RoPA Fields

Build a GDPR Article 30 record of processing activities with separate controller and processor fields for purposes, data categories, recipients, transfers, erasure time limits, and security measures.

EU GDPR Requirements: scope, rights, security, DPIA, RoPA, and transfers

Overview of core EU GDPR requirements covering scope, principles, lawful basis, notices, data-subject rights, processors, RoPA, security, breaches, DPIAs, and international transfers.

EU GDPR Retention and Erasure Schedule

Build an EU GDPR retention and erasure schedule with purpose-based periods, expiry actions, Article 17 decisions, recipient notices, and deletion evidence.

EU GDPR Transfer TIA and SCC Workflow

A GDPR workflow for checking adequacy, selecting SCC modules, documenting transfer impact assessments, and recording supplementary measures for third-country transfers.

EU GDPR Transparency Notices: Articles 12, 13 and 14

GDPR privacy-notice guide for Articles 12, 13, and 14: direct collection, other data sources, purposes, lawful bases, recipients, transfers, retention, rights, and timing.

EU GDPR vs Brazil LGPD: scope, legal bases, rights, incidents, and transfers

Compare EU GDPR and Brazil LGPD scope, actors, legal bases, rights timing, security incidents, international transfers, evidence, regulators, and penalties.

EU GDPR vs California CCPA: scope, rights, opt-outs, and evidence

Compare EU GDPR and California CCPA scope, roles, consumer rights, response times, sale and sharing opt-outs, risk assessments, contracts, transfers, and enforcement.

EU GDPR vs ePrivacy Directive: personal data, cookies, consent, and communications

Compare the EU GDPR and ePrivacy Directive for personal data processing, consent and lawful basis, cookies and terminal access, electronic communications, and parallel compliance.

EU GDPR vs UK GDPR: Scope, Rights, Transfers, and Evidence

Compare the EU GDPR and amended UK GDPR across scope, rights, automated decisions, accountability, breaches, regulators, and international transfers.

GDPR vs EU AI Act: privacy controls for AI systems

Map the GDPR work that remains necessary when an AI system processes personal data, including lawful basis, notices, DPIAs, Article 22, rights, security, records, and transfers.

GDPR vs EU Data Act: personal data, connected products, and access rights

Compare GDPR privacy duties with EU Data Act rights and duties for connected-product data, third-party access, data holders, users, contracts, cloud switching, and enforcement.

Does the EU GDPR apply outside the EU under Article 3?

A GDPR Article 3 territorial-scope FAQ covering EU establishment, non-EU targeting, monitoring in the EU, public-international-law cases, and Article 27 representatives.

EU GDPR Article 6 Legal Bases FAQ

FAQ on the six Article 6 GDPR lawful bases, consent caveats, legitimate interests, public-task and legal-obligation limits, and Article 9 special-category data.

EU GDPR DSAR Exceptions: refusal, extensions, identity checks

FAQ on when EU GDPR controllers may extend, charge for, narrow, redact, or refuse a data subject access request under Articles 12 and 15.

EU GDPR SCC Transfer Impact Assessment FAQ

FAQ on when SCC transfer impact assessments are needed, what Clause 14 records, and when supplementary safeguards or transfer suspension are required.

GDPR processor vs controller: role boundaries and evidence

Decide whether a party is a GDPR controller, processor, or joint controller using purpose-and-means tests, Article 28 terms, Article 26 arrangements, and Article 30 records.

When does the EU GDPR require a DPIA?

Answer the EU GDPR DPIA threshold question with Article 35 triggers, high-risk criteria, supervisory-authority list checks, and DPIA content requirements.

When does the GDPR 72-hour breach notification clock start?

GDPR breach-awareness FAQ covering the Article 33 clock, processor escalation, delayed or phased notifications, risk assessment, and records to keep.