Conducting GDPR Compliance Assessment

Effective Date: August 2026
Legal Basis: EU Regulation 2016/679 (GDPR), UK GDPR as amended by Data Protection Act 2018 and Data (Use and Access) Act 2025 (ukpga/2025/18)
Pending Changes: Digital Omnibus proposal (COM(2025) 837) would change Article 30(5) threshold from 250 to 750 employees and Article 33 breach notification from 72h to 96h. Still in proposal stage; current requirements remain in force.

When to Use

• When an organization processes personal data of EU residents (Article 3 territorial scope applies)
• When preparing for a supervisory authority audit (ICO, CNIL, BfDI) or responding to formal inquiry
• When implementing privacy-by-design requirements (Article 25) for new systems or data flows
• When scoping compliance gaps before M&A due diligence or contract negotiations with EU entities
• When responding to data subject access requests (DSARs) and discovering gaps in data inventory
• When assessing third-party processors for GDPR compliance before signing Data Processing Agreements (DPAs)
• After data breach incidents to verify notification procedures meet 72-hour requirement (Article 33)

Do not use for:

• Technical implementation of specific GDPR controls (encryption, pseudonymization, access controls) — use implementing-gdpr-data-protection-controls for Article 32 technical/organizational measures
• Automated DSAR processing workflows (identity verification, PII discovery, redaction, delivery) — use implementing-gdpr-data-subject-access-request for DSAR automation
• Non-EU privacy frameworks alone (CCPA, PIPEDA, LGPD); those require separate assessments with jurisdiction-specific criteria
• This skill is for comprehensive compliance assessment across all GDPR articles; use the specialized skills for focused implementation tasks

Prerequisites

• Understanding of GDPR Articles 5-32 and key definitions
• Access to Article 30 records of processing activities
• Data Processing Agreements with third-party processors
• Privacy policies, consent forms, cookie notices
• Knowledge of lawful bases (Article 6)
• Data breach response plan and incident register
• List of international data transfers with safeguards

Workflow

For detailed procedures, templates, and examples, see references/detailed-workflow.md

Phase 1: Determine Territorial Applicability (Article 3)

GDPR applies if:

1. Organization has establishment in EU
2. Offers goods/services to EU residents
3. Monitors behavior of EU residents

Check: EU office? EU website targeting? Behavioral tracking?

Phase 2: Inventory Data Processing Activities (Article 30)

Document for EACH activity:

• Controller/processor details
• Processing purposes (specific)
• Data categories and special categories (Art. 9)
• Recipients and international transfers
• Retention periods
• Security measures

Tools: Use scripts/article30_parser.py, article30_validator.py, generate_ropa_report.py

Common gaps: Missing retention periods (68%), vague purposes, undocumented transfers

Phase 3: Validate Lawful Basis (Article 6)

Action: Map each Article 30 activity to one lawful basis. Document legitimate interest assessments.

Phase 4: Assess Data Subject Rights (Articles 12-23)

Verify capability for:

• Access (15): Provide copy in machine-readable format within 1 month
• Rectification (16): Correct inaccurate data
• Erasure (17): "Right to be forgotten" (with exceptions)
• Portability (20): Transfer data in structured format
• Objection (21): Opt-out of legitimate interest processing
• Automated Decision-Making (22): Human review of algorithmic decisions

Test: Process sample DSAR through full workflow. Use scripts/ for automation.

Phase 5: Review DPIAs (Article 35)

DPIA mandatory for:

• Large-scale profiling with automated decisions
• Large-scale special categories processing
• Systematic monitoring of public areas (facial recognition)

…