GDPR Compliance Checklist

The workbook groups selected GDPR topics into principles, individual rights, controller and processor obligations, and international transfers. Start by identifying the processing activities and legal entities under review. An answer can differ between activities: a lawful basis or retention period that is appropriate for payroll may be wrong for product analytics.

The file has two sheets: Controls and Dashboard. On Controls, choose a status and record the evidence reference, gap, priority, owner and target date. Keep the reference specific enough for another reviewer to find the same document or system record. If you have not checked an item, leave it as Not Assessed rather than treating the absence of a known problem as evidence that it is working.

The dashboard counts statuses by category. Its percentage is the share of listed entries marked Compliant; it does not measure legal compliance, audit success or the severity of outstanding issues. A single unresolved access or recovery problem can matter more than several completed documentation tasks. Review the findings alongside the count.

Use the workbook locally or keep it in your existing document process. The online assessment is a separate workflow. Paid template imports create question structure; completed answers, formulas, owners and attachments are not transferred automatically. Keep the original workbook as your working record if you choose to continue in the app.