Achieving GDPR compliance can feel overwhelming – but it shouldn’t have to be a struggle. To simplify matters, we’ve put together this checklist to help you understand and strengthen your GDPR compliance.
Please note that the contents of this checklist do not constitute legal advice. If you are looking for advice relating to the interpretation of this information and its accuracy, or you need help applying the GDPR laws to your specific circumstances, we recommend that you consult an attorney specializing in GDPR compliance.
Data Controllers, Data Processors, and Data Subjects
Before you go through this checklist, you need to determine what GDPR items apply to you and your company or organization. Here, we distinguish between items relevant to the data subject, the data controller, and the data processor.
To quickly navigate the checklist below, select your role to view only the checklist items relevant to you and your organization.
The Data subject
The data subject is the user: the natural person or individual whose personal data is collected, stored, or processed. This means that the data subject is any individual who can be identified – directly or indirectly – via an identifier such as a name, an ID number, location data, or via factors specific to the individual’s physical, physiological, genetic, mental, economic, cultural, or social identity.
The Data controller
The data controller is the entity – the person, organization, etc. – that determines the purposes for which and how personal data is processed. This means that if your company or organization decides ‘why’ and ‘how’ the personal data should be processed, it is the data controller.
If your company or organization jointly determines the ‘why’ and ‘how’ of personal data processing together with one or more organizations, it is a joint controller. Joint controllers must enter into an arrangement that specifies the respective roles and responsibilities for complying with the GDPR rules.
The Data processor
The data processor processes personal data only on behalf of the data controller. Thus, the data processor is usually a third party external to the company. The duties of the data processor towards the controller must be specified in a contract or another legal act.
In some situations, an organization may have both roles.
Even if your technical security is robust and operational security can still be a weak link. To minimize security risks, train your staff to be aware of data protection. Employees who have access to personal data and non-technical employees should receive extra training in GDPR requirements.
To identify and minimise the data protection risks of a project, you must do a DPIA for processing that is likely to result in a high risk to the rights and freedoms of natural persons. You must consider both the likelihood and the severity of any impact on individuals in order to assess the level of risk.
In the event of a personal data breach, you should notify the violation to local authority within 72 hours after discovery. In addition, you should report the nature of the data breach, the number of data subjects involved, the likely consequences of the data breach, and the measures you have taken to address the personal data breach. Unless the personal data leaked was encrypted, you should also communicate the data breach to the data subject whose data you lost.
Transfers of personal data to third countries or international organisations
The European Commission has the power to decide whether a country outside the EU offers an adequate level of data protection. Only if the Commission determines that an adequate level of protection is ensured may you transfer personal data to a third country or international organisation. Derogations for specific situations include, but are not limited to conditions where the data subject has explicitly consented to the proposed transfer, and where the transfer is necessary for important reasons of public interest.
Your customers have the right to see what personal data you have on them, how you are using them, how long you plan to store them, and why you keep them for that duration.
This is only applicable if you use automated processes to help you make decisions about people that have legal or ‘similarly significant’ effects. If you think this applies to you, you are required to set up a procedure to ensure the protection of people’s rights, freedoms, and legitimate interests.
For children younger than 16, a legal guardian must give consent for data processing. If consent is provided via your website, you should, to the best of your capability, make sure that approval was actually given by the legal guardian and not by the child.
