GDPR: questions to assess your obligations

Status: Ongoing

---

Article 12(3): provide information on action taken without undue delay and within one month of receipt. A necessary extension of up to two further months is possible for complexity/number of requests; notify the person with reasons within the first month. Rights and exceptions must be assessed individually. A suggested internal acknowledgement target does not extend the legal deadline.

Part C: GDPR Compliance

This is a working selection of obligations and implementation options. Assess applicability, roles and exceptions for each row; templates, diagrams, portals and registers are methods unless the cited rule specifically requires them. Article 30 records differ for controllers and processors; assess the limited exemption in Article 30(5).

#	Activity	Reference	Phase	Description
C1	Scope & GAP Analysis	Art. 2, 3	Preparation	Determine processing scope and analyse gaps
C1.1	— Territorial scope	Art. 3	Preparation	Assess EU establishment, targeting goods/services and monitoring under Art. 3
C1.2	— Current state assessment	Art. 5, 24	Preparation	Audit current GDPR compliance state
C1.3	— GAP identification	Art. 24	Preparation	Identify gaps vs. GDPR requirements
C2	Data Mapping (ROPA)	Art. 30	Analysis	Records of Processing Activities
C2.1	— Personal Data Categories	Art. 30(1)(c)	Analysis	Examples where linked to an identifiable person: names, emails, online identifiers and health data
C2.2	— Legal Basis	Art. 6, 9	Analysis	Identify the applicable Article 6(1) basis: consent, contract, legal obligation, vital interests, public task/official authority or legitimate interests; satisfy its conditions and, for special categories, Article 9(2)
C2.3	— Data Subject Categories	Art. 30(1)(c)	Analysis	Customers, employees, partners, prospects
C2.4	— Retention Periods	Art. 5(1)(e), 30(1)(f)	Analysis	How long to retain? Auto-delete procedures
C2.5	— Data Flow Diagram	Art. 30	Analysis	Visualisation of personal data flows
C2.6	— Third-country transfers	Art. 44-49	Analysis	Assess transfers to third countries outside the EEA or international organisations and the applicable Chapter V mechanism
C3	Data Processing Agreements (DPA)	Art. 28	Governance	Processing governed by a binding contract or other legal act meeting Article 28(3)
C3.1	— Controllers vs. Processors	Art. 4(7,8), 26	Governance	Audit: Who is controller? Who is processor?
C3.2	— Processor list	Art. 28(1)	Governance	List of all processors
C3.3	— Sub-processor Management	Art. 28(2,4)	Governance	Prior specific or general written authorisation; notice and opportunity to object to changes under general authorisation; pass on the required obligations and retain responsibility under Art. 28(4)
C3.4	— DPA Templates	Art. 28(3)	Governance	Standardised agreements
C3.5	— SCCs for transfers	Art. 46(2)(c)	Governance	Commission SCCs are one possible Article 46 safeguard, not mandatory for every non-EEA transfer; assess the applicable transfer mechanism
C4	Privacy by Design & Default	Art. 25	Implementation	Privacy in system design
C4.1	— Privacy by Design principles	Art. 25(1)	Implementation	Embed privacy in system design
C4.2	— Privacy by Default	Art. 25(2)	Implementation	Default settings = minimum data
C4.3	— Data Minimisation	Art. 5(1)(c)	Implementation	Only necessary data. Delete unnecessary fields
C4.4	— Pseudonymisation	Art. 4(5), 25	Implementation	For analytics: pseudonymise where possible
C4.5	— Anonymisation	GDPR Recital 26	Implementation	Anonymisation is an option; verify that the person is no longer identifiable by means reasonably likely to be used. Pseudonymisation alone does not remove GDPR applicability
C5	Technical & Organisational Measures	Art. 32	Implementation	Security of processing
C5.1	— Encryption at rest	Art. 32(1)(a)	Implementation	Proportionate encryption; AES-256 is an implementation option, not an algorithm mandated by Art. 32
C5.2	— Encryption in transit	Art. 32(1)(a)	Implementation	Proportionate transport protection; TLS 1.3 is an implementation option, not a fixed Art. 32 version
C5.3	— Access control	Art. 32(1)(b)	Implementation	Access control for personal data
C5.4	— Confidentiality	Art. 32(1)(b)	Implementation	Ensure confidentiality
C5.5	— Integrity	Art. 32(1)(b)	Implementation	Ensure data integrity
C5.6	— Availability	Art. 32(1)(b)	Implementation	Ensure availability
C5.7	— Resilience	Art. 32(1)(b)	Implementation	System resilience
C5.8	— Restore capability	Art. 32(1)(c)	Implementation	Ability to restore data availability
C5.9	— Regular testing	Art. 32(1)(d)	Testing	Regular testing of measure effectiveness
C6	DPIA (Impact Assessment)	Art. 35	Analysis	Data Protection Impact Assessment
C6.1	— DPIA process defined	Art. 35(1)	Governance	When and how to conduct DPIA
C6.2	— DPIA template	Art. 35(7)	Governance	DPIA template
C6.3	— DPIA for high-risk processing	Art. 35(1), (3)–(5), (10)	Analysis	Before likely high-risk processing, perform the Article 35 assessment, considering the applicable authority lists and exceptions
C6.4	— DPIA for AI systems	Art. 35 GDPR	Analysis	Screen likely high risk under GDPR Article 35; using AI with personal data does not automatically require a DPIA. Assess separate AI Act obligations independently
C6.5	— Prior consultation	Art. 36(1)	Analysis	Consult the supervisory authority before processing where the Article 36(1) high-risk condition applies
C7	Subject Rights (DSAR)	Art. 15-22	Implementation	Data subject rights
C7.1	— DSAR workflow	Art. 12	Implementation	Process for handling subject requests
C7.2	— DSAR email/form	Art. 12(2)	Implementation	Channel for receiving requests
C7.3	— Identity verification	Art. 12(6)	Implementation	Proportionate identity verification; request additional information only as necessary to resolve reasonable doubts
C7.4	— Right to Access	Art. 15	Implementation	Workflow: respond within one month
C7.5	— Right to Erasure	Art. 17	Implementation	Erase without undue delay where Article 17(1) applies and no Article 17(3) exception applies; backup retention is not an automatic extension
C7.6	— Right to Rectification	Art. 16	Implementation	Correct errors, audit log
C7.7	— Right to Portability	Art. 20	Implementation	Where Article 20 applies, provide a structured, commonly used, machine-readable format; CSV/JSON/XML are examples
C7.8	— Right to Restriction	Art. 18	Implementation	Restriction of processing
C7.9	— Right to Object	Art. 21	Implementation	Objection to processing
C7.10	— DSAR register	Art. 12	Monitoring	Record of processed requests
C8	Consent Management	Art. 7	Implementation	Consent management
C8.1	— Cookie Management	ePrivacy Art. 5(3); GDPR Art. 7	Implementation	Assess consent before terminal storage/access and the limited transmission/strictly necessary requested-service exceptions; category labels do not determine the exemption
C8.2	— Cookie banner	ePrivacy Art. 5(3); national implementing law	Implementation	Implement clear information and valid consent where required by national ePrivacy law; a banner is a possible interface, not a universal format required by GDPR
C8.3	— Email Consent Tracking	Art. 7(1)	Implementation	Evidence of valid consent; double opt-in is a possible evidential method, not a universal Art. 7 mandate
C8.4	— Consent Withdrawal	Art. 7(3)	Implementation	Withdrawal at any time, as easy as giving consent; inform of this before consent; prior lawful processing is unaffected
C8.5	— Consent records	Art. 7(1)	Monitoring	Records of given consents
C9	Privacy Policy & Transparency	Art. 12-14	Documentation	Information obligation
C9.1	— Privacy Policy	Art. 13, 14	Documentation	Clear, complete, up-to-date
C9.2	— GDPR Transparency (Art. 13/14)	Art. 13, 14	Documentation	All applicable items in Arts. 13/14, with their timing and exceptions
C9.3	— AI Transparency	Art. 13(2)(f), 14(2)(g), 15(1)(h)	Documentation	Information on decision-making under Article 22(1)/(4), including meaningful information about the logic, significance and envisaged consequences; assess separate AI Act duties independently
C9.4	— Layered notices	Art. 12(1)	Documentation	Multi-layered information (summary + detail)
C10	Data Breach Management	Art. 33, 34	Incident	Breach reporting procedure
C10.1	— Breach detection	Art. 33	Incident	Breach detection processes
C10.2	— Breach assessment	Art. 33(1)	Incident	Risk assessment of breach impact
C10.3	— DPA notification (72h)	Art. 33(1)–(2), 55–56	Incident	Controller: notify the competent authority without undue delay and, where feasible, within 72h of awareness, unless risk to people’s rights and freedoms is unlikely; give reasons for delay. Processor: notify the controller without undue delay
C10.4	— Subject notification	Art. 34	Incident	Notify the person without undue delay where high risk is likely; assess Article 34(3) exceptions, including equally effective public communication where individual notice requires disproportionate effort
C10.5	— Breach register	Art. 33(5)	Monitoring	Record of all breaches
C10.6	— Notification templates	Art. 33, 34	Documentation	Templates for notifications (DPA, subjects)
C11	DPO (Data Protection Officer)	Art. 37-39	Governance	Data Protection Officer
C11.1	— DPO appointed	Art. 37	Governance	Appoint where Art. 37 or national law requires, or voluntarily; document scope and independence
C11.2	— DPO independence	Art. 38(3)	Governance	DPO independence ensured
C11.3	— DPO Contact Public	Art. 37(7)	Governance	dpo@company.com published on website
C11.4	— DPO contact notification	Art. 37(7)	Governance	Communicate the appointed DPO’s contact details to the supervisory authority; this is not approval of the appointment
C11.5	— DPO Responsibilities	Art. 39	Governance	Information/advice, compliance monitoring, DPIA advice on request and monitoring, cooperation and contact with the authority
C12	Training & Awareness	Art. 39(1)(b)	Training	Employee training
C12.1	— GDPR staff training	Art. 39(1)(b)	Training	Training proportionate to roles and risk for staff involved in processing; the appointed DPO monitors this under Article 39(1)(b)
C12.2	— Role-specific training	Art. 39(1)(b)	Training	Specialised training (HR, Marketing, IT)
C12.3	— Training records	Art. 24(1)	Monitoring	Records of completed training
C12.4	— Awareness programme	Art. 39(1)(b)	Training	Ongoing awareness raising

---

Implementation priorities

GDPR has applied since 25 May 2018. The phases below are an illustrative remediation plan, not a new grace period: first address unlawful/high-risk processing and urgent rights/incident duties; then confirm processing records, processor contracts, transparency and effective safeguards.

The controller/processor remains accountable. The DPO advises and monitors; appointing a DPO does not transfer the organisation’s GDPR responsibility to that individual.

Implementation Phases

---

Resources

• GDPR text (EUR-Lex)
• EDPB Guidelines

---

Disclaimer

This content is for informational purposes only and does not constitute legal advice. For your organisation’s specific situation, we recommend consulting a qualified lawyer.

---

Content reviewed: 6 September 2026. Primary sources: GDPR — Arts. 3, 5, 6, 9, 12–22, 28–39, 83.