A practical GDPR compliance map for deciding whether the law applies, assigning controller and processor duties, and keeping evidence for lawful basis, notices, rights, DPIAs, RoPA, contracts, breaches, transfers, retention, security, and enforcement risk.
Built for privacy, legal, product, security, procurement, support, HR, marketing, and data governance teams that need operating controls rather than a generic policy summary.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use this guide as a GDPR compliance operating checklist. For each processing activity, record the scope decision, controller or processor role, lawful basis, notice text, rights workflow, DPIA result, RoPA entry, processor contract, transfer mechanism, retention and erasure rule, security controls, and breach escalation path. The goal is a reviewable evidence set, not a one-time policy document.
Start with the facts that make the GDPR relevant: personal data, a processing purpose, an actor that decides purposes and means or processes on another party's instructions, and a territorial connection through EU establishment, EU-facing offering, or monitoring of people in the EU. Do not treat a vendor list as the role map; the same organisation can be a controller for one workflow, a processor for another, and a joint controller where purposes and means are decided together.
The first evidence record should say what personal data is processed, whose data it is, which entity is controller or processor, which services or countries are in scope, and which planned product or supplier changes would reopen the analysis.
Every processing purpose needs a lawful basis before collection or use. Consent must be evidenced and withdrawable; legitimate interests need the specific interest and balancing rationale; contract, legal obligation, vital interests, and public-task bases should be tied to the exact processing purpose rather than the whole product.
Transparency controls should match the data flow. Notices must identify purposes, legal bases, recipients, transfers, storage periods or criteria, rights, and complaint routes. For rights handling, maintain an intake, identity-check, search, exemption, response, and completion log so access, rectification, erasure, restriction, portability, objection, and automated-decision requests can be handled within the GDPR response period.
A GDPR compliance file should be organised around processing activities, not departments. The RoPA should identify controller or processor contacts, purposes, data-subject and data categories, recipient categories, third-country transfers, erasure time limits where possible, and a general description of security measures.
Run a DPIA before high-risk processing, especially systematic profiling with significant effects, large-scale special-category data, criminal-offence data, or large-scale systematic monitoring. If residual high risk remains after mitigation, escalate for prior consultation rather than treating the DPIA as complete. Processor contracts should cover documented instructions, confidentiality, Article 32 measures, subprocessor controls, rights assistance, breach and DPIA support, return or deletion, audits, and compliance information.
Security and incident response must be connected. Article 32 expects measures appropriate to risk, including confidentiality, integrity, availability, resilience, restoration, and regular testing. The breach workflow should start when the organisation becomes aware of a personal-data breach, triage risk to individuals, preserve facts, involve processors quickly, and decide whether supervisory-authority or data-subject notification is required.
International transfers need a separate control from vendor onboarding. Identify the recipient country, transfer role, transfer tool, onward-transfer chain, and whether an adequacy decision, SCCs, binding corporate rules, or another Article 46 mechanism is being used. Where SCCs are used, keep the transfer assessment and recipient-country risk review with the contract record.
GDPR enforcement risk is not limited to fines. Supervisory authorities can investigate, order compliance, restrict processing, suspend data flows, and impose administrative fines. Article 83 ties fines to factors such as gravity, duration, intentional or negligent character, mitigation, responsibility, previous infringements, cooperation, affected data categories, notification, and aggravating or mitigating factors.
The highest fine tier reaches up to EUR 20,000,000 or 4% of total worldwide annual turnover, whichever is higher, for infringements including basic processing principles, data-subject rights, and transfer rules. A lower tier reaches up to EUR 10,000,000 or 2% for obligations including controller and processor duties in Articles 25 to 39. Escalate before launch when a control owner cannot prove lawful basis, notice accuracy, rights handling, retention, processor terms, transfer safeguards, breach readiness, or security testing.
It should contain the processing inventory, controller or processor role decision, lawful basis per purpose, notice text, rights workflow logs, RoPA entry, DPIA screening and assessment, Article 28 processor terms, breach log, transfer mechanism and assessment, retention and erasure rule, security control evidence, approvals, and review triggers.
For controller notifications to the supervisory authority, Article 33 uses awareness of a personal-data breach and requires notification without undue delay and, where feasible, not later than 72 hours unless the breach is unlikely to result in risk to rights and freedoms. Late notifications need reasons for the delay.
Sorena can turn the GDPR controls on this page into cited answers, owner assignments, evidence requests, and reusable review steps for privacy, product, security, procurement, and legal teams.
Ask source-linked questions about GDPR scope, lawful basis, rights, DPIAs, RoPA, processor terms, breaches, transfers, security, and penalties using the cited sources on this page.
Review your GDPR compliance workflow, source gaps, evidence files, and next implementation steps with Sorena.
"free, specific, informed and unambiguous"
"controller and processor"
"risk-based approach"
"pre-approved by the European Commission"
"likely to result in a high risk"
"Records of Processing Activities"
"effective, proportionate and dissuasive"
"personal data breach notification"
"clear and plain language"