GDPR Compliance Checklist
Published September 19, 2026
Use this free self-assessment to find out how close your organisation is to full GDPR compliance. Fill in your company details, work through roughly 30 audit items grouped into six categories, and get an instant readiness score with a prioritised list of gaps to close.
Company Context
These details determine which checklist items apply to your organisation. Items that are not relevant to your setup are excluded from the score.
How to Use This Checklist
Start by selecting your company details: where you are based, whether you serve EU residents, your team size, and whether you handle special-category data like health records. The checklist adapts to your answers — items that do not apply to your setup are automatically excluded. Work through each of the six sections, marking items as Yes, No, or Partial. When finished, hit Score My Readiness for your overall compliance percentage, section-by-section breakdowns, and a prioritised list of gaps with the GDPR article each one relates to. Use the Copy Summary button to save your results.
What the GDPR Requires
The General Data Protection Regulation is the EU's framework for protecting personal data. It applies to any organisation, anywhere in the world, that processes data belonging to people in the EU or EEA. Compliance is not a single checkbox — it spans how you collect, store, share, and delete data, and it requires ongoing attention rather than a one-time fix. The regulation organises its obligations into several pillars: establishing a lawful reason to process data, being transparent about what you do with it, respecting the rights individuals have over their information, keeping data secure, ensuring that vendors and international transfers meet the same standard, and documenting everything so you can demonstrate compliance to a supervisory authority on demand.
If you are unsure whether the GDPR applies to your project in the first place, our privacy law applicability checker can tell you which regulations cover your user base in a few clicks. For a deeper look at how the GDPR reaches organisations based outside Europe, see our guide on whether the GDPR applies to US companies.
Common Compliance Gaps
Even organisations that have invested in GDPR compliance often stumble on the same set of issues. Retention periods are one of the most frequently cited gaps: many privacy policies say data is kept "as long as necessary" without defining what that means, which fails the storage-limitation principle under Article 5. Another common shortfall is around data subject requests — having a contact email is not enough if no one monitors it, and missing the 30-day response window is treated as a violation in its own right. Vendor management is the third area regulators consistently flag: if you use third-party analytics, hosting, or email services that touch personal data, each one needs a written Data Processing Agreement in place before data flows to them, not after an audit reveals the gap.
When to Seek Professional Help
This checklist gives you a structured starting point, but it is not a substitute for legal advice. If your organisation processes special-category data at scale, operates in multiple EU member states, or handles data that could trigger a Data Protection Impact Assessment, working with a qualified data protection professional is strongly recommended. The same applies if you discover critical gaps in this assessment — a data protection consultant or a DPO-as-a-service provider can help you prioritise remediation and avoid the most costly enforcement risks.
Frequently Asked Questions
What is GDPR compliance?
GDPR compliance means meeting all the requirements of the EU's General Data Protection Regulation when your organisation processes the personal data of individuals in the European Union or European Economic Area. It covers how you collect, store, use, and share personal data, and it requires transparency, security safeguards, and respect for individual data rights.
Does the GDPR apply to businesses outside the EU?
Yes. The GDPR applies to any organisation worldwide that offers goods or services to people in the EU or monitors their behaviour, regardless of where the organisation is based. A company in the United States with EU website visitors must comply just the same as one headquartered in Berlin.
What are the penalties for GDPR non-compliance?
GDPR fines can reach up to 20 million euros or four percent of an organisation's global annual turnover, whichever is higher. Beyond fines, supervisory authorities can order you to stop processing data entirely, which can shut down core business operations.
Do small businesses need to comply with the GDPR?
Yes. There is no revenue or employee-count exemption in the GDPR. If you process personal data of EU residents, the regulation applies regardless of your company's size. Some obligations scale — for example, maintaining a formal Record of Processing Activities is only mandatory above certain thresholds — but the core principles apply to everyone.
How often should I review my GDPR compliance?
At minimum, review your compliance annually or whenever you introduce a new processing activity, adopt a new vendor or sub-processor, expand into a new market, or experience a data breach. Regulatory guidance evolves, and your data practices change with your product — a checklist completed once and never revisited quickly becomes outdated.