GDPR Compliance Checklist

Answer the questions below to evaluate your organization's GDPR compliance posture across six key areas and generate a compliance report.

Lawful Basis for Processing

Every use of personal data needs an identified legal justification under Article 6 (and Article 9 for special category data).

Have you identified and documented a lawful basis (Article 6) for each processing activity?

Yes

For any processing based on legitimate interests, has a Legitimate Interest Assessment (LIA) been completed?

We don't rely on legitimate interests

Yes

Do you maintain a Record of Processing Activities (ROPA) as required by Article 30?

Yes

Consent Mechanisms

Where consent is used as the lawful basis, it must meet GDPR's standards for being freely given, specific, and revocable.

Where consent is used as a lawful basis, is it collected via a clear affirmative action (no pre-ticked boxes) and is it specific and informed?

Yes

Can users withdraw consent as easily as they gave it?

Yes

Are consent records stored with a timestamp and a reference to the policy version consented to?

Yes

Data Subject Rights

Individuals have rights to access, correct, delete, and port their personal data.

Is there a documented process to fulfill Right of Access requests (Article 15) within one month?

Yes

Is there a documented process for the Right to Erasure / "right to be forgotten" (Article 17)?

Yes

Can users request and receive their data in a structured, commonly used, machine-readable format (Article 20)?

Yes

Is there a documented process for the Right to Rectification (Article 16) and Right to Object (Article 21)?

Yes

Data Retention & Deletion

Personal data must not be kept longer than necessary, and must be deleted or anonymized once it's no longer needed.

Are documented retention periods defined for each category of personal data you hold?

Yes

Is there a process to delete or anonymize personal data once its retention period expires?

Yes

Is there a documented data breach response procedure that supports notifying the supervisory authority within 72 hours (Article 33)?

Yes

Cookie Compliance & Consent Banners

Non-essential cookies and trackers require informed, granular consent before they're set.

Does your site display a consent banner before setting non-essential cookies or trackers?

Yes

Does the banner let users accept or reject cookie categories individually (not just "Accept All")?

Yes

Is an up-to-date privacy and cookie policy published and linked from your site?

Yes

Is rejecting non-essential cookies as easy as accepting them (no dark patterns, no repeated re-prompting)?

Yes