Track the GDPR dates and response clocks for applicability, rights requests, breach notification, DPIA review, prior consultation, transfer assessments, and retention checks.
Use this as an EU-level operating calendar, then add verified national authority procedures and sector-specific timelines for the jurisdictions and processing in scope.
Use this calendar to calculate each GDPR deadline from the event that starts it. It separates fixed dates, the for rights requests, breach awareness and the 72-hour notification assessment, DPIA and transfer review triggers, and recurring accountability work. Each row should identify the responsible actor and evidence and label any internal service level separately. National procedures and sector rules may add further steps.
The GDPR was adopted in 2016 and applies from 25 May 2018. Use 25 May 2018 as the baseline applicability date for EU GDPR calendar records and avoid treating adoption, publication, or corrigendum dates as separate operational compliance deadlines unless a specific cited task depends on them.
Directive 95/46/EC was repealed with effect from the same 25 May 2018 date. For legacy privacy program records, keep that as a migration context date rather than a recurring deadline.
Sources (1)
Supports the GDPR applicability date and the repeal date for Directive 95/46/EC.
It shall apply from 25 May 2018.
The two clocks most likely to need operational routing are the data subject request clock and the personal data breach clock. Start each from its documented legal trigger, not from the next privacy meeting.
For requests under Articles 15 to 22, the controller must provide information on action taken without undue delay and in any event within one month of receipt. The EDPB explains that the period starts on the receipt date and ends on the corresponding date in the next month; if there is no corresponding date, it ends on that month's last day. If the last day is a weekend or public holiday, the deadline moves to the next working day.
The controller may extend the response period by two further months where necessary, taking account of the complexity and number of requests. It must tell the data subject about the extension and reasons within the first month. If it does not act, Article 12(4) requires the reasons and complaint and judicial-remedy information without delay and at the latest within one month.
For a personal data breach, the controller must notify the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. A short initial investigation may establish with reasonable certainty whether a breach occurred, but it should start promptly. If notification is late, the controller must give reasons; Article 33(4) permits information to be supplied in phases without undue further delay when it cannot be supplied at once.
No. Calculate it by calendar month from the receipt date. A request received on 31 August is due by 30 September because September has no corresponding 31st. If the calculated last day is a weekend or public holiday, the EDPB says the controller has until the next working day.
Receipt starts the period. EDPB Guidelines 01/2022 say time may be suspended until the controller obtains the information needed when it has reasonable doubts about identity and asks for necessary additional information without undue delay. The request must be proportionate. Record the original receipt, the prompt identity request, the suspension interval, the response, and the recalculated endpoint rather than treating the later reply as a new request.
No weekend pause appears in Article 33. Treat the period as 72 consecutive hours from awareness and route incidents outside business hours. If all required information is not available, notify in phases without undue further delay where Article 33(4) applies; if notification is late, give reasons.
No. Authority notification is not required when the breach is unlikely to result in a risk to individuals' rights and freedoms. The controller must still document the breach, its effects, and the remedial action under Article 33(5). Communication to affected people has the higher Article 34 threshold of likely high risk, subject to the listed exceptions.
Sources (4)
Supports Article 12 response timing and Article 33 breach-notification timing.
within one month of receipt
Provides official EDPB routing context for national data breach notification forms and supervisory authority contacts.
Explains how to calculate the one-month period, including shorter months, weekends and public holidays, and when a two-month extension may be necessary.
Explains awareness, short initial investigations, controller and processor routing, the 72-hour assessment, and phased notification.
Use worked cases to test the calendar logic before an urgent request or incident arrives. Save the receipt or awareness timestamp, the rule applied, the calculated legal endpoint, any adjustment or extension, the internal target, and the person who checked the calculation.
These examples illustrate the EU-level rules cited on this page. Confirm the public-holiday calendar, competent authority procedure, time zone, and any national procedural rule that applies to the real case.
Sources (3)
Supports the one-month request period, 72-hour breach period, processor handoff, and prior-consultation timing used in the cases.
without undue delay
Provides the 31 August to 30 September example and the next-working-day calculation rule.
the last day of the following month
Supports the reasonable-certainty awareness test, prompt processor notice, risk assessment, and phased notification.
reasonable degree of certainty
Schedule the DPIA before processing starts when the planned type of processing is likely to result in a high risk to individuals. The calendar trigger should be a project, product, supplier, architecture, data-category, or scope change that may create high-risk processing, not a fixed annual date.
If a DPIA shows that residual high risk remains after the planned mitigation, consult the supervisory authority before processing. Where the authority considers that the intended processing would infringe the GDPR, it must provide written advice within up to eight weeks from receipt of the consultation request. That period may be extended by six weeks for complex processing and suspended while requested information is outstanding.
After implementation, review the DPIA where necessary at least when the risk represented by processing operations changes. Treat major design changes, new data categories, expanded monitoring, changed sharing, or changed safeguards as calendar reopen triggers.
Sources (2)
Supports Article 35 DPIA timing, Article 35 review triggers, and Article 36 prior consultation timing.
prior to the processing
Supports early project lifecycle DPIA planning, ongoing DPIA review, and consultation where residual high risk remains.
as early as practicable
Do not put a generic annual SCC deadline in the GDPR calendar unless the organisation has adopted that cadence internally. The legal workflow is event-driven: before concluding SCC-based transfers, check the module and, where Clause 14 applies, assess the specific transfer, destination-country laws and practices, and safeguards. Then monitor developments that could affect that assessment.
Where Clause 14 applies, the European Commission Q&A explains that the parties must complete a transfer impact assessment before concluding the SCCs and that the exporter must suspend the transfer if appropriate safeguards cannot be ensured. Section III does not apply to a Module 4 transfer that only returns data received from a non-EEA controller to that controller; if the dataset also contains personal data originating in Europe, Section III applies to the whole transferred dataset. The EDPB supplementary-measures roadmap adds an ongoing re-evaluation obligation at appropriate intervals and continuous vigilance for developments affecting protection.
Calendar transfer reviews should therefore be tied to new transfer tools or importers, changed destinations or processing chains, government-access developments, importer notices that it cannot comply, adequacy-decision changes, or material changes to supplementary safeguards. An internal periodic review date can support this monitoring, but it should be labelled as an internal control rather than a universal GDPR deadline.
Sources (3)
Supports the use of Commission pre-approved SCCs for EU-to-third-country transfers.
Standard Contractual Clauses
Supports transfer impact assessment timing before concluding SCCs and suspension where safeguards cannot be ensured.
prior to concluding the SCCs
Supports ongoing re-evaluation of transfer protection and monitoring developments affecting third-country transfers.
re-evaluate at appropriate intervals
The GDPR does not give one universal retention period for all personal data. Attach calendar retention work to purposes, legal bases, data categories, systems, contracts, applicable statutory retention needs, and deletion or anonymisation controls.
Use the storage limitation principle as the calendar anchor: personal data must not be kept in identifiable form for longer than necessary for the processing purposes, subject to the GDPR's longer-storage conditions for archiving in the public interest, research, or statistical purposes with safeguards.
Article 24 also requires controllers to implement measures to ensure and demonstrate GDPR compliance and to review and update those measures where necessary. That supports recurring operational reviews, but it does not create a single fixed EU-wide date for every organization.
Sources (1)
Supports storage limitation, accountability, and review/update operations where necessary.
reviewed and updated where necessary
Add national-authority timelines and sector procedures only after checking the rule for the relevant jurisdiction and processing context. For cross-border processing, confirm whether the lead supervisory authority or another competent authority is the correct route before an incident.
Internal teams can adopt shorter service levels and periodic reviews, but label them as internal controls rather than GDPR deadlines.
No single annual date applies to every GDPR control. Article 24 requires measures to be reviewed and updated where necessary, Article 35 links DPIA review to changed processing risk, and transfer guidance calls for re-evaluation at appropriate intervals and when developments affect protection. An annual review can be an internal control, but the calendar must also capture event-driven triggers.
No. Keep both. An internal target creates working time for review and escalation; the cited legal deadline remains the compliance endpoint. If the internal target is missed, escalate while the legal clock continues.
Record the source timestamp and time zone, the calculation time zone, and the authority or data-subject context used. The GDPR provisions cited here do not create a universal operational time-zone convention, so the organisation should adopt a consistent rule and confirm any national procedural requirement for the real filing.
Sources (1)
Primary legal source for the included GDPR timing rules and source limits.
binding in its entirety
Sorena can help convert these cited GDPR clocks into request queues, incident runbooks, DPIA gates, transfer reviews, and retention checks with owner and evidence fields.
Ask questions tied to cited sources about GDPR deadlines, breach notification, DSAR timing, DPIAs, transfers, and retention using the cited sources on this page.
Review your GDPR calendar, source gaps, and operational evidence model with Sorena.
"It shall apply from 25 May 2018."
"within one month of receipt"
"without undue delay"
"prior to the processing"
"reviewed and updated where necessary"
"binding in its entirety"
"the last day of the following month"
"reasonable degree of certainty"
"re-evaluate at appropriate intervals"
"prior to concluding the SCCs"
"Standard Contractual Clauses"
"as early as practicable"
A concrete GDPR scope test for personal data, controller and processor roles, EU establishment, EU targeting or monitoring, special-category and child data, transfers, vendors, and evidence.
This GDPR Article 30 RoPA intake workflow helps capture controller and processor fields, owners, transfers, retention, security measures, and evidence before a processing activity goes live.
GDPR guide to profiling and Article 22 decisions: scope, transparency, lawful basis, DPIA triggers, safeguards, human intervention, challenge rights, and evidence.
EU GDPR breach notification workflow covering awareness, 72-hour supervisory authority notices, processor escalation, high-risk data-subject communication, delay reasons, and evidence logs.
A concrete EU GDPR breach notification workflow for detecting and triaging incidents, starting the awareness clock, assessing risk, notifying authorities or data subjects, and keeping Article 33 records.
This GDPR checklist helps review scope, lawful basis, notices, DSAR handling, DPIAs, RoPA, processor contracts, SCC transfers, breach notification, retention, security, and evidence.
GDPR guide to children's consent and special-category data: Article 8 national age variation, Article 9 conditions, transparency, DPIA triggers, safeguards, and evidence.
Practical EU GDPR compliance guide for mapping scope, lawful basis, notices, data-subject rights, DPIAs, RoPA, processor terms, breaches, transfers, retention, security, and penalties.
Classify GDPR controllers, processors, and joint controllers from actual decision-making, then document Article 26 allocation, Article 28 terms, instructions, and vendor evidence.
GDPR rights-request workflow for intake, identity checks, request scope, the one-month response clock, extensions, refusals, processor coordination, and evidence.
Screen high-risk processing, run a GDPR Article 35 DPIA, record mitigation, and identify when Article 36 prior consultation is required.
EU GDPR DPIA guide covering Article 35 triggers and contents, CNIL and DPC PIA methods, residual risk, mitigation records, and prior consultation limits.
Run a GDPR DSAR workflow for intake, identity checks, rights scoping, one-month response timing, extensions, refusals, processor handoffs, and evidence records.
Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers.
GDPR Chapter V guide to adequacy decisions, SCCs, transfer assessments, supplementary measures, Article 49 derogations, and EU-US DPF checks.
Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records.
Assess GDPR legitimate interests with a purpose, necessity, balancing, Article 21 objection, and evidence-record workflow based on Article 6(1)(f).
How GDPR main establishment, cross-border processing, Article 56 lead authority competence, and Article 60 cooperation fit together.
This EU GDPR legitimate interests assessment template helps document Article 6(1)(f) purpose, necessity, balancing, safeguards, objection rights, and evidence.
EU GDPR penalties guide covering Article 83 fine ceilings, the EDPB calculation method, CJEU conditions, Article 58 powers, and evidence.
EU GDPR Article 28 guide for processor contracts, sub-processor controls, controller-processor role boundaries, vendor evidence, and SCC transfer clauses where applicable.
Build a GDPR Article 30 record of processing activities with separate controller and processor fields for purposes, data categories, recipients, transfers, erasure time limits, and security measures.
Overview of core EU GDPR requirements covering scope, principles, lawful basis, notices, data-subject rights, processors, RoPA, security, breaches, DPIAs, and international transfers.
Build an EU GDPR retention and erasure schedule with purpose-based periods, expiry actions, Article 17 decisions, recipient notices, and deletion evidence.
A GDPR workflow for checking adequacy, selecting SCC modules, documenting transfer impact assessments, and recording supplementary measures for third-country transfers.
GDPR privacy-notice guide for Articles 12, 13, and 14: direct collection, other data sources, purposes, lawful bases, recipients, transfers, retention, rights, and timing.
Compare EU GDPR and Brazil LGPD scope, actors, legal bases, rights timing, security incidents, international transfers, evidence, regulators, and penalties.
Compare EU GDPR and California CCPA scope, roles, consumer rights, response times, sale and sharing opt-outs, risk assessments, contracts, transfers, and enforcement.
Compare the EU GDPR and ePrivacy Directive for personal data processing, consent and lawful basis, cookies and terminal access, electronic communications, and parallel compliance.
Compare the EU GDPR and amended UK GDPR across scope, rights, automated decisions, accountability, breaches, regulators, and international transfers.
Map the GDPR work that remains necessary when an AI system processes personal data, including lawful basis, notices, DPIAs, Article 22, rights, security, records, and transfers.
Compare GDPR privacy duties with EU Data Act rights and duties for connected-product data, third-party access, data holders, users, contracts, cloud switching, and enforcement.
A GDPR Article 3 territorial-scope FAQ covering EU establishment, non-EU targeting, monitoring in the EU, public-international-law cases, and Article 27 representatives.
FAQ on the six Article 6 GDPR lawful bases, consent caveats, legitimate interests, public-task and legal-obligation limits, and Article 9 special-category data.
FAQ on when EU GDPR controllers may extend, charge for, narrow, redact, or refuse a data subject access request under Articles 12 and 15.
FAQ on when SCC transfer impact assessments are needed, what Clause 14 records, and when supplementary safeguards or transfer suspension are required.
Decide whether a party is a GDPR controller, processor, or joint controller using purpose-and-means tests, Article 28 terms, Article 26 arrangements, and Article 30 records.
Answer the EU GDPR DPIA threshold question with Article 35 triggers, high-risk criteria, supervisory-authority list checks, and DPIA content requirements.
GDPR breach-awareness FAQ covering the Article 33 clock, processor escalation, delayed or phased notifications, risk assessment, and records to keep.