GDPR

General Data Protection Regulation (EU) 2016/679

GDPR governs personal-data processing within its scope. Start with your processing activities and controller or processor role, then review lawful basis, rights, security and transfers. These guides cover selected obligations; a completed checklist does not establish compliance for every activity.

Start my free GDPR assessmentNo account · No credit card · Save when useful

Reference guides

Review by processing activity and risk

Planning the review

Depends on processing scope and required changes

Budget considerations

Revisit when purposes, systems, suppliers or risks change

Keeping it current

Cross-Framework Control Mapping

Key GDPR controls mapped to equivalent requirements in other frameworks. Work done for one framework reduces effort on the others.

GDPR Control	ISO 27001	SOC 2	NIS2
Security of Processing (Art. 32)	A.5.1, A.8.24	CC6.1, CC6.7	Art. 21(2)(a)
Breach Notification (Art. 33, 34)	A.5.24, A.5.26	CC7.3	Art. 21(2)(b), Art. 23
Data Protection by Design (Art. 25)	A.8.25, A.8.26	CC8.1	Art. 21(2)(e)
Processor Obligations (Art. 28)	A.5.19, A.5.20	CC9.2	Art. 21(2)(d)
DPIA (Art. 35)	Clause 6.1.2	CC3.1	Art. 21(2)(a)

Where auditors look first

The highest-risk GDPR controls - the ones auditors probe earliest and where gaps cost the most. Start your assessment here.

Art.5.1aLawfulness, Fairness and Transparency Art.5.1bPurpose Limitation Art.5.1fIntegrity and Confidentiality Art.5.2Accountability Art.22Automated Individual Decision-Making, Including Profiling Art.24Responsibility of the Controller Art.28Processor Art.32Security of Processing

Key GDPR terms

Plain-language definitions for the concepts you will meet while working through GDPR.

Audit Evidence Audit Trail Compliance Automation Compliance Gap Analysis Consent Management Cross-Border Data Transfer Cryptographic Controls Data Breach Notification Data Controller Data Minimization Data Portability Data Processor Data Protection Impact Assessment Data Protection Officer Privacy by Design Purpose Limitation Right to Erasure Supply Chain Risk Vendor Risk Management

Frequently Asked Questions

Does GDPR apply outside the EU?

It can apply to processing linked to offering goods or services to people in the EU or monitoring their behaviour there. EU establishment is another basis for scope. Citizenship or the location of a server alone does not decide applicability.

Does an assessment prove compliance?

No. Review the actual processing activities, legal roles and evidence. The library covers selected obligations and cannot establish compliance for every purpose or system.

Do we need a DPO?

Assess Article 37, including public-authority processing, core activities involving large-scale regular and systematic monitoring, or large-scale special-category or criminal-offence data. Check additional national requirements.

Are we a controller or processor?

Determine the role for each activity. A SaaS provider can process customer data on instructions while acting as controller for its own billing or employment data.

Control Categories

This library groups 50 review topics into 4 categories.

Data Protection Principles

7 reference guides

Data Subject Rights

12 reference guides

Controller & Processor Obligations

19 reference guides

International Data Transfers

12 reference guides

Who Needs GDPR?

Any company processing EU residents' dataE-commerce platformsMarketing technology companiesHealthcare providersEdTech platformsMobile app developers

Applicable Regions

European UnionEuropean Economic AreaUnited Kingdom (UK GDPR)Global (extraterritorial reach)

Related Frameworks

Organizations pursuing GDPR often also work toward these standards.

ISO 27001 NIS2

Start your GDPR self-assessment

Work through the GDPR assessment, record supporting evidence and review the gaps in your answers.

Start Free Assessment

Start without an account · Sign up only to save