GDPR COMPLIANCE

Checklist

Obtain board-level support and establish accountability

☐ 1. Advise the board about data protection risks and the benefits of GDPR compliance.
☐ 2. Obtain management support for your GDPR compliance project.
☐ 3. Assign accountability for GDPR compliance to a director.

• Get a clear understanding of the GDPR with this pocket guide >>

Scope and plan your GDPR compliance project

☐ 4. Appoint and train a project manager.
☐ 5. Appoint a data protection officer (DPO) if necessary.
☐ 6. Identify standards that could provide a framework to help you establish your
compliance priorities, such as ISO 27001, ISO 27701 or BS 10012.
☐ 7. Assess whether data protection by design and by default has been incorporated into
processes and systems.
☐ 8. Consider the implications of Brexit in your planning.

• Save time and money by outsourcing your DPO duties to our experts >>

Conduct a data inventory and data flow audit

☐ 9. Assess the categories of data you hold, where the data comes from and the lawful
basis for processing.
☐ 10. Create a map that shows how data flows to, through and from your organisation.
☐ 11. Use the data map to identify the risks in your data processing activities and
determine whether a data protection impact assessment (DPIA) is required.

1
GDPR COMPLIANCE
Checklist

☐ 12. Create records of personal data processing activities, as required by Article 30,
drawn from the data flow audit and gap analysis.

• Gain visibility over the personal data you hold with the Data Flow Mapping Tool >>

Undertake a comprehensive risk assessment

☐ 13. Establish the risk assessment plan.
☐ 14. Identify your risks.
☐ 15. Analyse and evaluate your risks.
☐ 16. Determine ways to control your risks.

• Streamline the risk assessment process with vsRisk Cloud >>

Conduct a detailed gap analysis

☐ 17. Audit your current compliance position against the GDPR’s requirements.
☐ 18. Determine which compliance gaps require remediation.

• Quickly identify your GDPR compliance gaps with our gap assessment tool >>

Develop operational policies, procedures and processes

☐ 19. Ensure your data protection policies and privacy notices are in line with the GDPR.
☐ 20. Where you rely on consent as your lawful basis for processing, ensure it meets the
GDPR’s requirements.
☐ 21. Review employee, customer and supplier contracts, and update them if necessary,
to cover personal data processing.
☐ 22. Plan how to recognise and handle data subject access requests (DSARs) and
provide responses within one calendar month.
☐ 23. Have a process in place for determining whether a DPIA is required.

© 2003-2019 IT Governance Ltd 2

GDPR COMPLIANCE
Checklist

☐ 24. Review whether your mechanisms for transferring data outside the EEA are
compliant, especially after Brexit.

• Ensure DSARs are fulfilled correctly with DSAR as a Service >>

Secure personal data through procedural and technical

measures
☐ 25. Have an information security policy in place.
☐ 26. Implement basic technical controls such as those specified by established
frameworks like Cyber Essentials.
☐ 27. Use encryption and/or pseudonymisation where appropriate.
☐ 28. Ensure policies and procedures are in place to detect, report and investigate
personal data breaches.

• Prevent 80% of cyber attacks with Cyber Essentials >>

Ensure teams are trained and competent

☐ 29. Ensure internal communications with stakeholders and staff are effective.
☐ 30. Train your employees to understand the importance of data protection, basic GDPR
principles and the procedures you have implemented to ensure compliance.

• Boost staff GDPR awareness in less than an hour >>

Monitor and audit compliance

☐ 31. Schedule regular audits of data processing activities and security controls.
☐ 32. Keep records of personal data processing up to date.
☐ 33. Undertake DPIAs where required.
☐ 34. Assess data protection practices and manage some of the more demanding
elements of GDPR compliance.

© 2003-2019 IT Governance Ltd 3

GDPR COMPLIANCE
Checklist

• Simplify your GDPR compliance with GDPR Manager >>

Achieve GDPR compliance with our all-in-one solutions

Whether you’re just getting started or are already on the way to compliance, our packages are
a cost-effective solution that will help streamline your implementation project.
Find out more >>

© 2003-2019 IT Governance Ltd 4