GDPR Compliance Checklist
A practical GDPR checklist for small businesses: map personal data, set legal bases, update notices, sign DPAs and prepare for access requests and breaches.
- Typical schedule annually
- The checklist 5 sections, 22 items
Use this checklist when you set up data protection for the first time, and then once a year to check that it still matches reality. It is written for small companies and agencies that process personal data of people in the EU, such as customers, newsletter subscribers, job applicants and staff. It also helps Swiss companies, because the revised Swiss data protection act follows many of the same ideas.
Who owns it
A founder, operations lead or appointed privacy contact runs the review. If you have a Data Protection Officer, they advise and check. Each team confirms the data it handles. Adapt this to your jurisdiction and your situation; it is a practical checklist, not legal advice. Ask a lawyer when in doubt.
Common pitfalls
- Writing a privacy policy before knowing your data. Map what you collect and where it goes first. The notice then describes reality.
- Consent for everything. Consent is only one legal basis and is hard to manage. Contract and legitimate interest are often more fitting, with a documented balancing test.
- Forgotten processors. Analytics, support chat, email marketing and file sharing tools all process personal data and need a data processing agreement.
- Keeping data forever. Without retention periods, old CVs and exports pile up and increase your risk.
- No plan for requests. A data subject request or a breach is not the time to design a process.
Run the annual review as a scheduled checklist so you have a dated record of each check.
The checklist: Annual GDPR compliance review
Know your data
-
Update the record of processing activities with each purpose, data category and system
Even when the formal record is not strictly required for a small company, it is the basis for everything else.
-
Document the legal basis for each processing purpose
-
Record a legitimate interest assessment where you rely on legitimate interest
-
Identify special category data (e.g. health data) and confirm the extra condition that applies
-
Define and record a retention period for each data category
Processors and transfers
-
List all vendors that process personal data on your behalf
-
Confirm a signed data processing agreement exists with each processor
-
Identify transfers outside the EU/EEA and record the transfer mechanism used
For example an adequacy decision or Standard Contractual Clauses, with a transfer assessment where needed.
-
Remove or replace tools that process personal data without a valid agreement
Transparency and consent
-
Update the privacy notice so it matches the current processing and vendors
-
Check that consent is opt-in, specific and as easy to withdraw as to give, where you rely on it
-
Check that the cookie banner blocks non-essential cookies until consent is given
-
Confirm forms collect only the fields you actually need
Rights and incidents
-
Confirm the data subject request process is documented and has an owner
-
Confirm the personal data breach procedure is documented and staff know how to report
-
Review the breach and request log for the past year and close open items
Security and accountability
-
Confirm access to personal data is limited to people who need it
-
Check that laptops are encrypted and accounts use multi-factor authentication
-
Delete or anonymise data that is past its retention period
-
Carry out a data protection impact assessment for new high-risk processing optional
-
Confirm whether you need a Data Protection Officer or an EU representative, and record the decision
-
Complete data protection training for staff who handle personal data
Checklist as Markdown
Frequently asked questions
Does the GDPR apply to small businesses?
Yes. The GDPR applies to organisations of any size that process personal data of people in the EU in the context of offering them goods or services or monitoring them. Some duties are lighter for small companies, but legal bases, transparency, security and data subject rights apply to everyone.
What documents does a small business need for GDPR?
Most small businesses need a privacy notice, a record of processing activities, data processing agreements with their vendors, a retention schedule and short procedures for data subject requests and breaches. Depending on the processing, you may also need consent records or impact assessments.
How often should we review GDPR compliance?
Review it at least once a year and whenever you add a new tool, a new purpose or a new market. The annual review catches drift, such as a new analytics tool that nobody added to the privacy notice.
Updated