A practical GDPR compliance map for deciding whether the law applies, assigning controller and processor duties, and keeping evidence for lawful basis, notices, rights, DPIAs, RoPA, contracts, breaches, transfers, retention, security, and enforcement risk.
Built for privacy, legal, product, security, procurement, support, HR, marketing, and data governance teams that need operating controls rather than a generic policy summary.
Structured answer sets in this page tree.
Cited legal and guidance references.
This guide is a GDPR compliance operating checklist. For each processing activity, record the scope decision, controller or processor role, lawful basis, notice text, rights workflow, DPIA result, entry, processor contract, transfer mechanism, retention and erasure rule, security controls, and breach escalation path. Keep that evidence current and reviewable as the processing changes.
Start with the facts that make the GDPR relevant: personal data, a processing purpose, an actor that decides purposes and means or processes on another party's instructions, and a territorial connection through EU establishment, EU-facing offering, or monitoring of people in the EU. Do not treat a vendor list as the role map; the same organisation can be a controller for one workflow, a processor for another, and a joint controller where purposes and means are decided together.
The first evidence record should say what personal data is processed, whose data it is, which entity is controller or processor, which services or countries are in scope, and which planned product or supplier changes would reopen the analysis.
Every processing purpose needs a lawful basis before collection or use. Consent must be evidenced and withdrawable; legitimate interests need the specific interest and balancing rationale; contract, legal obligation, vital interests, and public-task bases should be tied to the exact processing purpose rather than the whole product.
Transparency controls should match the data flow. Notices must identify purposes, legal bases, recipients or categories of recipients, transfers, storage periods or criteria, rights, and complaint routes. For rights handling, maintain an intake, identity-check, search, exemption, response, and completion log so access, rectification, erasure, restriction, portability, objection, and automated-decision requests can be handled within the GDPR response period.
A GDPR compliance file should be organised around processing activities, not departments. The should identify controller or processor contacts, purposes, data-subject and data categories, recipient categories, third-country transfers, erasure time limits where possible, and a general description of security measures. Organisations with fewer than 250 staff are exempt only where the Article 30(5) conditions are met; non-occasional processing, processing likely to create risk, and processing that includes Article 9 or Article 10 data remain in scope.
Run a DPIA before high-risk processing, especially systematic profiling with significant effects, large-scale special-category data, criminal-offence data, or large-scale systematic monitoring. If residual high risk remains after mitigation, escalate for prior consultation rather than treating the DPIA as complete. Processor contracts should cover documented instructions, confidentiality, Article 32 measures, subprocessor controls, rights assistance, breach and DPIA support, return or deletion, audits, and compliance information.
Screen both controllers and processors for the Article 37 DPO triggers: public-authority or public-body processing other than courts acting judicially, core activities that require large-scale regular and systematic monitoring, or core activities that consist of large-scale Article 9 or Article 10 processing. Union or Member State law may add cases. A designated DPO advises and monitors independently; management and operational owners remain responsible for compliance.
Security and incident response must be connected. Article 32 expects measures appropriate to risk, including confidentiality, integrity, availability, resilience, restoration, and regular testing. The breach workflow should start when the organisation becomes aware of a personal-data breach, triage risk to individuals, preserve facts, involve processors quickly, and decide whether supervisory-authority or data-subject notification is required.
International transfers need a separate control from vendor onboarding. Identify the recipient country, transfer role, transfer tool, onward-transfer chain, and whether an adequacy decision, SCCs, binding corporate rules, or another Article 46 mechanism is being used. Where SCCs are used, keep the transfer assessment and recipient-country risk review with the contract record.
GDPR enforcement risk is not limited to fines. Supervisory authorities can investigate, order compliance, restrict processing, suspend data flows, and impose administrative fines. Article 83 ties fines to factors such as gravity, duration, intentional or negligent character, mitigation, responsibility, previous infringements, cooperation, affected data categories, notification, and aggravating or mitigating factors.
For an undertaking, the highest fine tier reaches up to EUR 20,000,000 or 4% of total worldwide annual turnover for the preceding financial year, whichever is higher, for infringements including basic processing principles, data-subject rights, and transfer rules. A lower tier reaches up to EUR 10,000,000 or 2% for obligations including controller and processor duties in Articles 25 to 39. These are statutory ceilings, not automatic penalties; authorities apply the Article 83 factors in the circumstances of each case. Escalate before launch when a control owner cannot prove lawful basis, notice accuracy, rights handling, retention, processor terms, transfer safeguards, breach readiness, or security testing.
It should contain the processing inventory, controller or processor role decision, lawful basis per purpose, notice text, rights workflow logs, entry, DPIA screening and assessment, Article 28 processor terms, breach log, transfer mechanism and assessment, retention and erasure rule, security control evidence, approvals, and review triggers.
For controller notifications to the supervisory authority, Article 33 uses awareness of a personal-data breach and requires notification without undue delay and, where feasible, not later than 72 hours unless the breach is unlikely to result in risk to rights and freedoms. Late notifications need reasons for the delay.
Sorena can turn the GDPR controls on this page into cited answers, owner assignments, evidence requests, and reusable review steps for privacy, product, security, procurement, and legal teams.
Ask questions tied to cited sources about GDPR scope, lawful basis, rights, DPIAs, RoPA, processor terms, breaches, transfers, security, and penalties using the cited sources on this page.
Review your GDPR compliance workflow, source gaps, evidence files, and next implementation steps with Sorena.
"free, specific, informed and unambiguous"
"controller and processor"
"personal data breach notification under GDPR"
"risk-based approach"
"pre-approved by the European Commission"
"likely to result in a high risk"
"Records of Processing Activities"
"effective, proportionate and dissuasive"
"clear and plain language"