GDPR COMPLIANCE
Checklist
Obtain board-level support and establish accountability
☐ 1. Advise the board about data protection risks and the benefits of GDPR compliance.
☐ 2. Obtain management support for your GDPR compliance project.
☐ 3. Assign accountability for GDPR compliance to a director.
• Get a clear understanding of the GDPR with this pocket guide >>
Scope and plan your GDPR compliance project
☐ 4. Appoint and train a project manager.
☐ 5. Appoint a data protection officer (DPO) if necessary.
☐ 6. Identify standards that could provide a framework to help you establish your
compliance priorities, such as ISO 27001, ISO 27701 or BS 10012.
☐ 7. Assess whether data protection by design and by default has been incorporated into
processes and systems.
☐ 8. Consider the implications of Brexit in your planning.
• Save time and money by outsourcing your DPO duties to our experts >>
Conduct a data inventory and data flow audit
☐ 9. Assess the categories of data you hold, where the data comes from and the lawful
basis for processing.
☐ 10. Create a map that shows how data flows to, through and from your organisation.
☐ 11. Use the data map to identify the risks in your data processing activities and
determine whether a data protection impact assessment (DPIA) is required.
1
GDPR COMPLIANCE
Checklist
☐ 12. Create records of personal data processing activities, as required by Article 30,
drawn from the data flow audit and gap analysis.
• Gain visibility over the personal data you hold with the Data Flow Mapping Tool >>
Undertake a comprehensive risk assessment
☐ 13. Establish the risk assessment plan.
☐ 14. Identify your risks.
☐ 15. Analyse and evaluate your risks.
☐ 16. Determine ways to control your risks.
• Streamline the risk assessment process with vsRisk Cloud >>
Conduct a detailed gap analysis
☐ 17. Audit your current compliance position against the GDPR’s requirements.
☐ 18. Determine which compliance gaps require remediation.
• Quickly identify your GDPR compliance gaps with our gap assessment tool >>
Develop operational policies, procedures and processes
☐ 19. Ensure your data protection policies and privacy notices are in line with the GDPR.
☐ 20. Where you rely on consent as your lawful basis for processing, ensure it meets the
GDPR’s requirements.
☐ 21. Review employee, customer and supplier contracts, and update them if necessary,
to cover personal data processing.
☐ 22. Plan how to recognise and handle data subject access requests (DSARs) and
provide responses within one calendar month.
☐ 23. Have a process in place for determining whether a DPIA is required.
© 2003-2019 IT Governance Ltd 2
GDPR COMPLIANCE
Checklist
☐ 24. Review whether your mechanisms for transferring data outside the EEA are
compliant, especially after Brexit.
• Ensure DSARs are fulfilled correctly with DSAR as a Service >>
Secure personal data through procedural and technical
measures
☐ 25. Have an information security policy in place.
☐ 26. Implement basic technical controls such as those specified by established
frameworks like Cyber Essentials.
☐ 27. Use encryption and/or pseudonymisation where appropriate.
☐ 28. Ensure policies and procedures are in place to detect, report and investigate
personal data breaches.
• Prevent 80% of cyber attacks with Cyber Essentials >>
Ensure teams are trained and competent
☐ 29. Ensure internal communications with stakeholders and staff are effective.
☐ 30. Train your employees to understand the importance of data protection, basic GDPR
principles and the procedures you have implemented to ensure compliance.
• Boost staff GDPR awareness in less than an hour >>
Monitor and audit compliance
☐ 31. Schedule regular audits of data processing activities and security controls.
☐ 32. Keep records of personal data processing up to date.
☐ 33. Undertake DPIAs where required.
☐ 34. Assess data protection practices and manage some of the more demanding
elements of GDPR compliance.
© 2003-2019 IT Governance Ltd 3
GDPR COMPLIANCE
Checklist
• Simplify your GDPR compliance with GDPR Manager >>
Achieve GDPR compliance with our all-in-one solutions
Whether you’re just getting started or are already on the way to compliance, our packages are
a cost-effective solution that will help streamline your implementation project.
Find out more >>
© 2003-2019 IT Governance Ltd 4
