GDPR compliance checklist: what the EU and UK pages say

Who the rules cover, and what counts as customer data

This page reads the EU and EEA rules, the GDPR, and in its last section the UK rules. It compares what the pages listed at the end say, all read on 5 November 2026, and it is not legal advice. The Commission’s page on how the GDPR applies says it covers a company that processes personal data as part of the activities of a branch established in the EU, wherever the data is processed, and a company established outside the EU that offers goods or services, paid or free, or monitors the behaviour of individuals in the EU.

The same page says that a small or medium-sized company that processes personal data in those ways has to comply, and that the rules depend on the nature of the activities rather than the size of the company. It adds that when processing personal data is not a core part of the business and the activity does not create risks for individuals, some obligations do not apply, and it gives the appointment of a Data Protection Officer as its example. For a company outside the EU, gdpr.eu adds that it should appoint a representative in an EU member state, and says the GDPR and its official supporting documents give no guidance for processing that affects people across several member states.

Personal data, in the Commission’s wording, is any information that relates to an identified or identifiable living individual. Its examples are a name and surname, a home address, an email address that contains a person’s name, an identification card number, location data, an IP address, a cookie ID and the advertising identifier of a phone. It lists as not personal data a company registration number, a generic address such as info at the company’s domain, and anonymised data, and it says anonymisation has to be irreversible. A separate entry says the rules cover business email addresses that carry a person’s name and employees’ business telephone numbers.

Business.gov.uk gives a UK list of the same kind: names and addresses, identifying numbers such as a driving licence number, bank and card details, health information, CVs and references, online identifiers such as IP addresses and purchasing history, emails and messages, and photographs and recordings. The Commission puts a note on location data and cookie IDs: in some cases the ePrivacy Directive regulates their use. It also says that sending direct marketing emails has to follow the marketing rules of that directive.

Processing, the Commission says, covers collection, recording, storage, retrieval, consultation, use, disclosure, restriction, erasure and destruction. Its examples include payroll, a contacts database, promotional emails, shredding documents, a photo of a person on a website, storing IP addresses and CCTV. The GDPR covers manual as well as automated processing, provided the data is organised by pre-defined criteria such as alphabetical order, and it does not matter whether the data sits in an IT system, in video surveillance or on paper. The Commission’s example of a case outside the rules is a person who uses a private address book to invite friends to a party.

The seven principles in plain words

The Commission’s page on the principles lists seven that a company must respect when it processes personal data. Its own explanations are short, and they read as a checklist of their own:

1. Lawfulness, fairness and transparency. Process data lawfully and openly, and fairly towards the people concerned.
2. Purpose limitation. Collect data for a specific purpose and tell people what it is when the data is obtained. The page says it is not enough to indicate that data will be collected and processed.
3. Data minimisation. Collect only what is necessary for that purpose. Its example is a car-sharing service that may require name, address and credit card number, but not racial origin.
4. Storage limitation. Keep data for the shortest time possible and set time limits to erase or review it. A recruitment office that plans to keep CVs for 10 years is the page’s example of a period that does not seem proportionate.
5. Accuracy. Keep data accurate and up to date, and rectify or delete inaccurate data without delay.
6. Integrity and confidentiality. Use technical and organisational measures against unauthorised or unlawful processing and against accidental loss, destruction or damage.
7. Accountability. The company is responsible for complying with all of the above and for demonstrating that it does.

On accountability, the Commission says codes of conduct and certification are optional tools. A company that adheres to one still has to comply with the GDPR, but the adherence is taken into consideration if the authority has to investigate. The EDPB adds that a certification is valid for a maximum of 3 years and can be renewed or revoked.

Two ideas sit under the principles. Data protection by design means building safeguards in at the earliest stage of a processing operation, with pseudonymisation and encryption as the Commission’s examples. Data protection by default means only the necessary data is processed, it is kept for the shortest possible time, and only a limited number of people can reach it. The EDPB’s small-business guide gives a bookshop as an example: the owner makes one web form for ordering books, with an address field, and another for ordering eBooks, without one, so that only the data needed is collected. The same guide says it is useful to keep records of these assessments and measures.

On deletion, the EDPB says personal data has to be deleted or anonymised once it is no longer necessary, and that in practice an organisation should have an internal policy on retention periods for each purpose and a procedure for deleting data. It also says national law may oblige an organisation to keep certain data, for tax reasons for instance.

What to tell customers, and when

The Commission lists what a company has to give the people whose data it processes: its name, with the contact details of its data protection officer if there is one; the purposes; the categories of data; the legal basis; and how long the data will be stored. Its page on the principles adds the other recipients of the data, whether data will be transferred outside the EU, the person’s rights (access, transfer, removal), the right to complain to a data protection authority, the right to withdraw consent at any time, and the use of automated decision-making and its logic. All of it has to be presented in a concise, transparent, intelligible way, in clear and plain language.

The page keeps saying "legal basis" without saying what one is, so here is what the pages say. The EDPB says processing is lawful if it rests on the person’s consent, is necessary for the performance of a contract, or rests on one of the other legal bases in Article 6 of the GDPR. Where consent is the basis it must be freely given, informed, specific and unambiguous, actively given before the processing starts, and the person must be able to withdraw it freely; the EDPB adds that if the processing will be necessary anyway, for instance under a contract, consent is not the appropriate basis. gdpr.eu, the Proton AG site, says there are six conditions in Article 6, that you should choose one for each use and document why, that choosing consent brings extra obligations, and that for legitimate interests you must be able to show you have done an assessment.

As for timing, the Commission says that when data is collected from the person, the information is due at the time the data is obtained, unless the person already has it. When the data comes from another source, the information is due at the latest within one month, or at the first communication with the person, or when the data is first disclosed to another recipient, and the company also has to say where the data came from. The exceptions it lists are that the person already has the information, that informing is impossible or would take disproportionate effort, and that obtaining or disclosing the data is based on law. The EDPB adds that the one-month maximum cannot be extended.

gdpr.eu, a site run by Proton AG that says on its page it is not an official EU resource, puts the same duty in its checklist as a privacy policy: tell people you are collecting their data and why, and give it at the time of collection. Business.gov.uk gives the UK version of the privacy notice: who you are and how to contact you, what data you collect and how, why you have it and your lawful basis, how long you keep it, who you share it with, and what people’s rights are. It says the notice should be freely available, with links on your website and in forms.

Customers can then ask for things. The EDPB says a request has to be answered within one month. If it is too complex, the time limit can be extended by two further months, provided the person is told within the first month. If the organisation has reasonable doubts about who is asking, it may ask for more information first. If it will not comply, it must give the reasons within the month and say that the person can lodge a complaint with the national authority and seek a judicial remedy. The EDPB also says an organisation cannot claim payment for the exercise of a right, except a reasonable fee, or a refusal, when a request is manifestly unfounded or excessive, and that the first copy of the data is free of charge.

gdpr.eu words it differently in places. It says requests to see, correct or restrict data should be answered within a month, and that deletion has to be honoured within about a month, with five grounds on which a request can be denied, such as freedom of speech or a legal obligation. It says the first copy is free and later copies can carry a reasonable fee, that data portability means sending the data in a commonly readable format such as a spreadsheet, and that an objection to direct marketing means stopping that use immediately. Business.gov.uk says a subject access request must be answered within one month and cannot usually be charged for.

Security, breaches and the suppliers who hold your data

The Commission says security measures have to be appropriate and adjusted to the likelihood and severity of the risk. Its examples are pseudonymisation, encryption, the ability to restore availability and access to data in a timely manner after a physical or technical incident, and a process to test and evaluate the measures regularly. gdpr.eu suggests an internal security policy that covers email security, passwords, two-factor authentication, device encryption and VPNs, with extra training for employees who have access to personal data. Business.gov.uk lists storing hard copies and electronic data securely, deleting or destroying data that is no longer needed, and data protection training for everyone in the business.

On breaches, the Commission defines a data breach as a security incident that affects the confidentiality, availability or integrity of data. If the breach is likely to pose a risk to people’s rights and freedoms, the company must notify the supervisory authority without undue delay and at the latest within 72 hours after becoming aware of it, and a processor must notify the controller. If the risk is high, the people concerned have to be informed too, unless effective protection was already in place, such as encryption, or later measures mean the risk is no longer likely. gdpr.eu gives the same 72 hours for the authority and says people are to be told quickly unless the breach is unlikely to put them at risk.

The Commission’s examples show how this runs through a supplier. A cloud service that loses several hard drives holding its clients’ data must notify those clients as soon as it is aware, and the clients must then notify the authority and the individuals depending on the data involved. In its hospital example, the page says a hospital that had encrypted the data could be exempt from notifying the patients.

Those suppliers are what the Commission calls processors. A controller is the company that decides why and how personal data is processed; a processor handles it only on the controller’s behalf and is usually a third party, with IT and cloud storage as a typical case. The duties of the processor are set in a contract or other legal act that binds it, and the Commission’s example is that the contract has to say what happens to the data when the contract ends. It lists documented instructions, a commitment to confidentiality, appropriate security measures and help with compliance among the elements, and says a processor needs the controller’s written authorisation before it appoints another one. Its own example is a retail company that stores a back-up of its client database on a cloud server: the cloud provider is the processor. In another, a sub-contractor that uses a client’s contact details to send its own marketing is also a controller.

gdpr.eu applies this to everyday tools. It says to sign a data processing agreement with any third party that handles customers’ data, including analytics software, email services and cloud servers, and that the vast majority of services have a standard agreement on their websites. It adds that only reliable third parties that can give sufficient data protection guarantees should be used.

Records, impact assessments and a data protection officer

These three are where a small business is most likely to ask what it may skip, and the pages we read answer in different words. For the record of processing activities, the EDPB says an organisation has a duty to keep one, in writing, electronic form included, describing each processing operation: its purpose, the categories of data, who has access, any transfers outside the EEA, the storage period and the security measures where possible. It adds that organisations employing fewer than 250 persons do not have to mention purely occasional activities, such as data processed for a one-off event like the opening of a shop. The Commission’s page on small and medium-sized companies says those with fewer than 250 employees do not need to keep records unless processing is a regular activity, poses a threat to individuals’ rights and freedoms, or concerns sensitive data or criminal records.

gdpr.eu puts the line in another place. It says organisations with at least 250 employees or higher-risk processing are required to keep an up-to-date list, and that those with fewer than 250 should also do an assessment because it makes the other requirements easier. Business.gov.uk lists keeping records of all data processing activities and policies among the duties, and the part of the page we read gives no threshold. We do not choose between these four wordings; the table sets them side by side.

A data protection impact assessment, or DPIA, is required, the Commission says, when processing is likely to result in a high risk to people’s rights and freedoms. It names three cases: a systematic and extensive evaluation of personal aspects based on automated processing, including profiling; processing of sensitive data on a large scale; and systematic monitoring of public areas on a large scale. It should be done before the processing starts and treated as a living tool. A bank screening customers against a credit reference database and a bus operator adding on-board cameras are its examples of a DPIA being required; a community doctor with a small number of patients is its example of one not being required. The EDPB describes a DPIA as a written assessment with four parts: the processing and its purpose, necessity and proportionality, the risks, and the measures to address them. It advises asking the national authority whether it publishes a list of operations that do or do not need one.

On the data protection officer, the Commission says one has to be appointed when the core activities involve sensitive data on a large scale or large-scale, regular and systematic monitoring of individuals, which includes tracking and profiling on the internet for behavioural advertising. Its examples of a mandatory DPO include a hospital, a security company monitoring shopping centres and a small head-hunting company that profiles individuals. A small law firm processing its clients’ data is its example of one that is not mandatory. gdpr.eu says there are three circumstances in which a DPO is required and that having one is not a bad idea even when the rule does not apply. It also lists, apart from the DPO, a person responsible for compliance across the organisation.

The UK version, and the checklist as questions

Business.gov.uk says UK data protection law is made up of the UK GDPR, which sets the broad principles and responsibilities, and the Data Protection Act 2018, which has the detailed rules and explains who enforces them. The Information Commissioner’s Office, the ICO, enforces them. The page lists what a business must do: know what personal data it holds and what it does with it, limit collection to what is necessary, use data only for specified and explicit purposes, keep it only as long as necessary, tell people how it is used and what their rights are, allow access, correction and deletion, store it securely, keep records of all processing and policies, and notify the ICO of relevant breaches.

On the fee, the page says businesses must register with the ICO and pay an annual fee unless they are exempt. It says a business is probably exempt if it uses personal data only for core purposes such as business and staff administration, or only to promote and market the business, and probably has to register if it uses CCTV for crime prevention, personal data in a health or childcare setting, or personal data to provide legal or financial services. GOV.UK says the fee depends on size and turnover, and, as published on GOV.UK on 5 November 2026, it is £52 or £78 for most organisations, including charities and small and medium-sized businesses, and, in its words, “up to £3,763 for businesses who employ many people and have a high annual turnover”. It adds that an organisation that does not pay the required fee may be fined by the ICO. The amounts can change, so check GOV.UK.

Two differences between the EU and UK pages are worth keeping apart. Business.gov.uk tells businesses to notify the ICO of relevant data breaches and gives no number of hours, while the 72 hours comes from the Commission and gdpr.eu; we did not read a UK page with a figure, so we attach none to the UK. And the pages differ on the record of processing, as shown above. We did not read the ICO’s own pages, which sit behind an anti-robot check, and the pages we read do not give an amount for a GDPR fine.

Put together, the pages turn into questions a business can answer in writing, each with the page it comes from:

1. What personal data do we hold, collect or plan to collect, and what do we use it for? (Business.gov.uk)
2. What is the legal basis for each use, written down? (Commission, gdpr.eu)
3. Does the privacy notice say who we are, what we hold, why, for how long, who gets it and what people’s rights are? (Commission, Business.gov.uk)
4. Do we collect only what the purpose needs, and when do we delete or review it? (Commission, EDPB)
5. Who processes data for us, and is there a contract that says what happens to the data at the end? (Commission, gdpr.eu)
6. Which security measures fit the risk, and who is trained? (Commission, gdpr.eu, Business.gov.uk)
7. If there is a breach, who reports it, to whom, and within what time? (Commission, Business.gov.uk)
8. Can we answer a customer’s request within one month? (EDPB, Business.gov.uk)
9. Do we need a record of processing, a DPIA or a DPO, and which page’s wording are we following? (Commission, EDPB, gdpr.eu)
10. In the UK, are we exempt from the ICO fee? (Business.gov.uk, GOV.UK)

gdpr.eu closes its own checklist by saying it is not legal advice, that dozens of provisions apply only in rare instances, and that you should check with a lawyer to make sure your organisation fully complies. That is also the position of this page.