This checklist covers the essential steps you need to take to demonstrate GDPR compliance

• Brief management on the GDPR-related risks and benefits.
• Gain management support for your GDPR compliance project.
• Give a director the responsibility of GDPR accountability.
• Incorporate data protection risk into the corporate risk management and internal control framework.

To do:

• Appoint and train a project manager, and appoint a DPO (data protection officer) if necessary.
• Identify which entities will be in scope – business units, territories, jurisdictions.
• Identify other standards or management systems that could provide a framework for compliance; for instance, implementing ISO 27001 demonstrates information security best practice.
• Assess the principle of data protection by design and default against current or new processes and systems.
• Consider the implications of Brexit in your planning.

To do:

• Assess the categories of data held, where it comes from and the lawful basis for your processing.
• Map data flows into, within and from your organisation.
• Use the data map to identify the risks in your data processing activities and assess whether a DPIA (data protection impact assessment) is needed.

To do

• Audit your current compliance position against the requirements of the GDPR.
• Identify compliance gaps requiring remediation.

To do:

• Create Article 30 documentation – the record of personal data processing activities drawn from the data flow audit and gap analysis.
• Bring data protection policies and privacy notices in line with the GDPR.
• Where relying on consent, ensure the conditions of that consent meet the new requirements.
• Review and update employees’, customers’ and supplier contracts.
• Plan how to recognise and handle data subject access requests (DSARs) and provide responses within a month.
• Have in place a process for determining whether a DPIA is required.
• Secure personal data through appropriate organisational and technical measures.
• Ensure policies and procedures are in place to detect, report and investigate a data breach.
• Review whether the mechanisms for data transfers outside the EU are compliant.

To do

• Have an information security policy
• Put in place basic technical controls such as those specified by established frameworks like Cyber Essentials
• Use encryption and/or pseudonymisation where it is appropriate
• Ensure policies and procedures are in place to detect, report and investigate a personal data breach

To do

• GDPR implementation affects your entire organisation – effective internal communication with stakeholders and staff is key.
• Employees need to understand the importance of data protection and be trained on the basic GDPR principles and procedures being implemented to achieve compliance.

To do

• Schedule regular audits of data processing activities and security measures.
• Keep personal data processing records up to date.
• Undertake DPIAs where required.