The GDPR Checklist

Achieving GDPR Compliance shouldn't feel like a struggle. This is a basic checklist you can use to harden your GDPR compliancy.

if your organisation is determining the purpose of the storage or processing of personal information, it is considered a controller. If your organisation stores or processes personal data on behalf of another organisation, it is considered a processor. It is possible for your organisation to have both roles. Use the filter below to view only the relevant checklist items for your organisation.

This list is far from a legal exhaustive document, it merely tries to help you overcome the struggle.

Feel free to contribute directly on GitHub!

Select your organisation's role:

  • Data Controller: I determine why data is processed
  • Data Processor: I store or process data for someone else

Your data

  • Your company has a list of all types of personal information it holds, the source of that information, who you share it with, what you do with it and how long you will keep it

  • Your company has a list of places where it keeps personal information and the ways data flows between them

  • Your company has a publicy accessible privacy policy that outlines all processes related to personal data.

  • Your privacy policy should include a lawful basis to explain why the company needs to process personal information


Accountability & management

New rights



  • You regularly review policies for changes, effectiveness, changes in handling of data and changes to the state of affairs of other countries your data flows to.


Special cases