Obtain board-level support and establish accountability

1. Advise the board about data protection risks and the benefits of GDPR compliance. 2. Obtain management support for your GDPR compliance project. 3. Assign accountability for GDPR compliance to a director.

Scope and plan your GDPR compliance project

4. Appoint and train a project manager. 5. Appoint a DPO (data protection officer) if necessary. 6. Identify standards that could provide a framework to help you establish your compliance priorities, such as ISO 27001, ISO 27701 or BS 10012. 7. Assess whether data protection by design and by default has been incorporated into processes and systems.

Conduct a data inventory and data flow audit

8. Assess the categories of data you hold, where the data comes from and the lawful basis for processing it. 9. Create a data flow map that shows how data flows to, through and from your organisation. 10. Use the data flow map to identify the risks in your data processing activities and determine whether a DPIA (data protection impact assessment) is required. 11. Create ROPAs (records of processing activities), as required by Article 30, drawn from the data flow audit and gap analysis.

Undertake a risk assessment

12. Establish the risk assessment plan. 13. Identify your risks. 14. Analyse and evaluate your risks. 15. Determine ways to control your risks.

Conduct a gap analysis

16. Audit your current compliance position against the GDPR’s requirements. 17. Determine which compliance gaps require remediation.

Develop operational policies, procedures and processes

18. Ensure your data protection policies and privacy notices are in line with the GDPR. 19. Where you rely on consent as your lawful basis for processing, ensure it meets the GDPR’s requirements. 20. Review employee, customer and supplier contracts, and update them if necessary, to cover personal data processing. 21. Plan how to recognise and handle DSARs (data subject access requests) and provide responses within one calendar month. 22. Have a process in place for determining whether a DPIA (data protection impact assessment) is required. 23. Review whether your mechanisms for transferring data outside the UK and/or EEA are compliant with the UK GDPR and EU GDPR.

Secure personal data through technical and organisational measures

24. Put an information security policy in place. 25. Implement basic technical controls, such as those specified by established frameworks like the Cyber Essentials scheme. 26. Use encryption and/or pseudonymisation where appropriate. 27. Ensure policies and procedures are in place to detect, report and investigate personal data breaches.

Ensure teams are trained and competent

28. Ensure internal communications with stakeholders and staff are effective. 29. Train your employees to understand the importance of data protection, basic GDPR principles and the procedures you have implemented to ensure compliance.

Monitor and audit compliance

30. Schedule regular audits of data processing activities and security controls. 31. Keep records of personal data processing up to date. 32. Undertake DPIAs (data protection impact assessments) where required. 33. Assess data protection practices and manage some of the more demanding elements of GDPR compliance.

UK and EU GDPR Compliance Checklist