GDPR Compliance Checklist

GDPR is not a pass/fail exam. It's a spectrum of obligations that scale with what you do with data, and the requirements that matter for a solo consultant with a mailing list are not the requirements that matter for a SaaS platform processing customer data at scale. Generic checklists waste time on items that don't apply and miss the items that actually create liability. This skill produces a checklist sized to the business.

It starts with a data profile. Business size, location (and whether GDPR reaches you under Article 3 even from outside the UK/EU), role as controller or processor, what data you collect, who from, how, why, where it's stored, who you share with, how long you keep it. Special categories (health, biometric, political, children's data) trigger heightened obligations and get flagged separately. The output marks each requirement as Compliant, Gap, Partial, or Not Applicable — and "Not Applicable" is treated as a valid and important status, not a cop-out.

The checklist is ordered by enforcement risk, not by article number. Priority 1 is the foundational layer: lawful basis documented for every processing activity, a published and accurate privacy notice, and a processing register if you cross the Article 30 threshold (250+ employees, or non-occasional processing, or special categories). Priority 2 is data subject rights — Subject Access Requests are the most common complaint trigger, and the 1-month response clock starts whether or not you have a process. Priority 3 covers security measures and the 72-hour breach notification window. Priority 4 covers DPAs with every processor (Stripe, Mailchimp, hosting providers, analytics) and international transfers under SCCs or adequacy decisions. Priority 5 is governance — DPO if required, DPIAs for high-risk processing, staff training, cookie consent. Priority 6 is review cadence so the document doesn't quietly drift out of date.

The output includes a Compliance Summary, the full tailored Checklist, a Remediation Roadmap with effort estimates, a Quick Wins list (things that can be fixed today in under two hours), and a Red Flags section for issues that create immediate enforcement risk. Processors get a different version of the checklist — the obligations shift when you're processing data on behalf of clients rather than as the controller.

This produces a checklist and remediation roadmap, not legal advice. GDPR enforcement involves real fines (up to 4% of global turnover) and the boundary between "compliant" and "non-compliant" is sometimes interpretive — especially around lawful basis assessments, transfer impact assessments, and special-category processing. Have a qualified data protection lawyer or DPO review the assessment and your remediation plan. The skill is a starting point for professional review, not a substitute for one.