GDPR Compliance Checklist

Document legal basis for each type of personal data processing (consent, legitimate interest, contract, legal obligation) Publish a clear, plain-language Privacy Policy Include DPO contact information (if required) Implement a compliant cookie consent banner (granular opt-in) No pre-ticked consent boxes Consent is freely given, specific, informed, and unambiguous Record consent with timestamp and version Right of access — users can request their data (respond within 30 days) Right to erasure ("right to be forgotten") Right to data portability (machine-readable format) Right to rectification Right to object to processing Encrypt personal data at rest and in transit Implement access controls and audit logs Data breach notification plan (72h to authorities) Data minimization — only collect what you need Define and enforce data retention periods Sign Data Processing Agreements (DPA) with all processors Assess transfers outside EU/EEA (SCCs or adequacy decision) Audit third-party integrations (analytics, payment, CDN)