GDPR checklist

Done 0 / 14

You know what personal data you process, where it comes from and whyCustomers, employees, job applicants, suppliers, website visitors.Article 5(2) GDPR (accountability)
Every purpose has a legal basisContract, legal obligation, legitimate interest, consent…Article 6 GDPR
You keep records of processing activities (if they apply to you)The exemption for companies with fewer than 250 employees is narrow — it does not apply to regular processing (e.g. payroll).Article 30 GDPR
You have set retention periods and deletionDo not keep data “just in case”.Article 5(1)(e) GDPR

You inform people when you collect their dataInformation on the website, in contracts, when recruiting staff.Articles 13 and 14 GDPR
You can handle a request for access, rectification or erasure within 1 monthThe deadline can be extended by two further months under certain conditions.Article 12(3), Articles 15–22 GDPR
You send marketing only with consent, or to existing customers under the conditions set by lawAnd with an easy way to unsubscribe.Article 21 GDPR; Act No. 452/2021 Coll.

Only people who need access to the data have itAccounts, passwords, two-factor authentication.Article 32 GDPR
Laptops and phones are encrypted, and backups existEncryption can decide whether a breach has to be communicated to the people affected.Article 32, Article 34(3) GDPR
You have an Article 28 agreement with your processorsAccountant, payroll agency, hosting, CRM, e-mailing.Article 28 GDPR
Your transfers outside the EU are coveredAn adequacy decision or standard contractual clauses.Chapter V GDPR

You know who decides on notifying a breach within 72 hoursWeekends included.Article 33 GDPR
You keep a register of personal data breachesIncluding those you did not notify.Article 33(5) GDPR
You have assessed whether you need a data protection officerUse the “Do I need a data protection officer?” tool.Article 37 GDPR

Overview and documentation 0 / 4