Conducting GDPR Compliance Assessment

Effective Date: August 2026 Legal Basis: EU Regulation 2016/679 (GDPR), UK GDPR as amended by Data Protection Act 2018 and Data (Use and Access) Act 2025 (ukpga/2025/18) Pending Changes: Digital Omnibus proposal (COM(2025) 837) would change Article 30(5) threshold from 250 to 750 employees and Article 33 breach notification from 72h to 96h. Still in proposal stage; current requirements remain in force.

When to Use

• When an organization processes personal data of EU residents (Article 3 territorial scope applies)
• When preparing for a supervisory authority audit (ICO, CNIL, BfDI) or responding to formal inquiry
• When implementing privacy-by-design requirements (Article 25) for new systems or data flows
• When scoping compliance gaps before M&A due diligence or contract negotiations with EU entities
• When responding to data subject access requests (DSARs) and discovering gaps in data inventory
• When assessing third-party processors for GDPR compliance before signing Data Processing Agreements (DPAs)
• After data breach incidents to verify notification procedures meet 72-hour requirement (Article 33)

Do not use for:

• Technical implementation of specific GDPR controls (encryption, pseudonymization, access controls) — use implementing-gdpr-data-protection-controls for Article 32 technical/organizational measures
• Automated DSAR processing workflows (identity verification, PII discovery, redaction, delivery) — use implementing-gdpr-data-subject-access-request for DSAR automation
• Non-EU privacy frameworks alone (CCPA, PIPEDA, LGPD); those require separate assessments with jurisdiction-specific criteria
• This skill is for comprehensive compliance assessment across all GDPR articles; use the specialized skills for focused implementation tasks

Prerequisites

• Understanding of GDPR Articles 5-32 and key definitions
• Access to Article 30 records of processing activities
• Data Processing Agreements with third-party processors
• Privacy policies, consent forms, cookie notices
• Knowledge of lawful bases (Article 6)
• Data breach response plan and incident register
• List of international data transfers with safeguards

Workflow

For detailed procedures, templates, and examples, see references/detailed-workflow.md

Phase 1: Determine Territorial Applicability (Article 3)

GDPR applies if:

1. Organization has establishment in EU
2. Offers goods/services to EU residents
3. Monitors behavior of EU residents

Check: EU office? EU website targeting? Behavioral tracking?

Phase 2: Inventory Data Processing Activities (Article 30)

Document for EACH activity:

• Controller/processor details
• Processing purposes (specific)
• Data categories and special categories (Art. 9)
• Recipients and international transfers
• Retention periods
• Security measures

Tools: Use scripts/article30_parser.py, article30_validator.py, generate_ropa_report.py

Common gaps: Missing retention periods (68%), vague purposes, undocumented transfers

Phase 3: Validate Lawful Basis (Article 6)

Basis	Use Case	Key Requirement
Consent (6(1)(a))	Marketing, profiling	Freely given, specific, withdrawable
Contract (6(1)(b))	Order fulfillment	Strictly necessary only
Legal Obligation (6(1)(c))	Tax records	Cite specific law
Legitimate Interest (6(1)(f))	Fraud prevention, analytics	Three-part test + balancing

Action: Map each Article 30 activity to one lawful basis. Document legitimate interest assessments.

Phase 4: Assess Data Subject Rights (Articles 12-23)

Verify capability for:

• Access (15): Provide copy in machine-readable format within 1 month
• Rectification (16): Correct inaccurate data
• Erasure (17): "Right to be forgotten" (with exceptions)
• Portability (20): Transfer data in structured format
• Objection (21): Opt-out of legitimate interest processing
• Automated Decision-Making (22): Human review of algorithmic decisions

Test: Process sample DSAR through full workflow. Use scripts/ for automation.

Phase 5: Review DPIAs (Article 35)

DPIA mandatory for:

• Large-scale profiling with automated decisions
• Large-scale special categories processing
• Systematic monitoring of public areas (facial recognition)

Template: See references/detailed-workflow.md for complete DPIA structure

Content: Description, necessity, risks, mitigation, consultation (DPO, supervisory authority if novel high-risk)

Phase 6: Audit Breach Notification (Articles 33-34)

72-hour rule: Notify supervisory authority within 72 hours of becoming aware of breach likely to risk rights.

Decision tree:

• Unencrypted SSNs stolen? → NOTIFY + notify data subjects
• Encrypted backup stolen (key secure)? → Document only
• Temporary exposure (2 hours, no financial data)? → NOTIFY authority, assess data subject notification

Content: Nature, categories/numbers, DPO contact, consequences, mitigation

Phase 7: Verify International Transfers (Chapter V)

Mechanisms:

• Adequacy decisions (UK, Japan, etc.)
• Standard Contractual Clauses (SCCs) 2021 + Transfer Impact Assessment
• Binding Corporate Rules (BCRs)
• Derogations (Article 49 - limited)

Post-Schrems II: Assess destination country surveillance laws, implement supplementary measures (encryption with EU-held keys)

Phase 8: Assess Security Measures (Article 32)

"Security appropriate to the risk":

• Low risk: TLS 1.2+, password hashing, access logs, patching
• Medium risk: AES-256 encryption, MFA, RBAC, penetration testing, SOC 2
• High risk: HSMs, key rotation, SIEM, bug bounty, ISO 27001

Pseudonymization vs. Anonymization: Pseudo = reversible (still personal data); Anon = irreversible (no longer GDPR)

Phase 9: Compile Findings and Remediation Roadmap

Generate compliance report:

• Executive summary (overall status, high-priority gaps)
• Article-by-article findings
• Risk-prioritized remediation plan (Critical/High/Medium/Low)
• Cost estimates and timelines
• Responsible parties (DPO, IT, Legal, Business)

Format: See Output Format section below

Key Concepts

Term	Definition
Controller	Determines purposes and means of processing (Article 4(7))
Processor	Processes on behalf of controller (Article 4(8); requires DPA per Article 28)
Personal Data	Any information relating to identified/identifiable natural person (Article 4(1))
Special Categories	Health, biometric, genetic, racial, political, religious, trade union, sex life data (Article 9; heightened protection)
Consent	Freely given, specific, informed, unambiguous indication of wishes (Article 4(11))
Legitimate Interest	Lawful basis requiring three-part test: purpose, necessity, balancing (Recital 47)
DPIA	Data Protection Impact Assessment for high-risk processing (Article 35)
DPO	Data Protection Officer (Article 37; mandatory for public authorities, large-scale monitoring/special categories)
SCCs	Standard Contractual Clauses for international transfers (Commission Implementing Decision 2021/914)
Supervisory Authority	National data protection regulator (ICO for UK, CNIL for France, BfDI for Germany)

Tools & Systems

• ICO Self-Assessment: https://ico.org.uk/for-organisations/sme-web-hub/checklists/gdpr-check-list/
• EDPB Guidelines: https://edpb.europa.eu/our-work-tools/general-guidance_en
• OneTrust / TrustArc: Commercial GRC platforms with DPIA, Article 30, cookie consent modules
• Article 30 Scripts: article30_parser.py, article30_validator.py (included)
• SCCs (2021): https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
• DPO Certification: IAPP CIPP/E (Certified Information Privacy Professional/Europe)

Common Scenarios

Scenario: M&A Due Diligence

Context: Acquiring SaaS company with 50K EU customers. Need compliance assessment within 2 weeks.

Approach:

1. Request Article 30 records + DPAs with processors (AWS, Stripe, Mailchimp)
2. Validate lawful basis: Consent for marketing, Contract for service delivery
3. Check breach notification procedures (Article 33): No procedures found → HIGH RISK
4. Review international transfers: AWS US-East-1 without SCCs → BLOCKER
5. Deliverable: Gap analysis with remediation costs ($120K for SCCs + DPO hire + breach procedures)

Scenario: Supervisory Authority Audit

Context: ICO formal inquiry after consumer complaint about unsubscribe not working.

Response:

1. Produce Article 30 records within 7 days
2. Demonstrate consent records (timestamp, version, scope)
3. Show withdrawal mechanism (unsubscribe link functional, processed within 48h)
4. Provide audit logs of DSAR/erasure requests
5. Outcome: Warning + 3-month corrective order (no fine due to cooperation)

Output Format

GDPR COMPLIANCE ASSESSMENT REPORT
===================================
Organization: XYZ Corp | Assessment Date: 2026-08-24
Assessor: Jane Smith, CIPP/E | DPO: dpo@xyzcorp.com

EXECUTIVE SUMMARY
━━━━━━━━━━━━━━━━━
Overall Status: PARTIAL COMPLIANCE (67/100)
Critical Gaps: 3 | High: 5 | Medium: 8 | Low: 12

CRITICAL FINDINGS
━━━━━━━━━━━━━━━━━
1. Article 33: No breach notification procedures (72-hour deadline unmet)
2. Chapter V: International transfers to US without SCCs (Schrems II violation)
3. Article 30: Records incomplete (retention periods missing for 40% of activities)

ARTICLE-BY-ARTICLE STATUS
━━━━━━━━━━━━━━━━━━━━━━━━
✅ Article 3: Applicability confirmed (EU establishment)
⚠️  Article 6: Lawful basis documented but 3 activities use invalid bundled consent
✅ Article 15-23: DSAR procedures operational (18-day avg response time)
❌ Article 28: 40% of processors lack signed DPAs
⚠️  Article 32: Encryption at rest implemented but no MFA on admin accounts
❌ Article 33/34: No breach notification procedures
⚠️  Article 35: DPIA completed for profiling but not reviewed in 18 months
❌ Chapter V: US transfers without SCCs

REMEDIATION ROADMAP
━━━━━━━━━━━━━━━━━━━
Priority 1 (0-30 days, $50K):
  - Implement breach notification procedures + incident register
  - Execute SCCs with AWS, Stripe (Module 2)
  - Complete Article 30 records (retention periods, security measures)

Priority 2 (1-3 months, $80K):
  - Execute DPAs with remaining 8 processors
  - Deploy MFA on all admin accounts
  - Conduct legitimate interest assessments for analytics

Priority 3 (3-6 months, $40K):
  - Review and update DPIA
  - Automated DSAR response workflow
  - Annual GDPR training for staff

COMPLIANCE SCORE: 67/100 → Target 90/100 (6 months post-remediation)

Verification Checklist

• Article 3 applicability determination documented
• Article 30 records complete for all activities (controller + processor roles)
• Lawful basis identified and documented for each activity
• Legitimate interest assessments documented with balancing test
• Consent mechanism is granular, withdrawable, and logged
• Data subject rights procedures operational (1-month response time)
• DPIA completed for high-risk processing (profiling, special categories, monitoring)
• Breach notification procedures documented (72-hour timeline)
• DPAs executed with all processors (Article 28 requirements)
• International transfers use SCCs 2021 + Transfer Impact Assessment
• Security measures appropriate to risk (encryption, MFA, logging, testing)
• Retention periods defined and automated deletion implemented
• Privacy policy published and updated within 12 months
• DPO designated if required (Article 37 criteria met)
• Staff trained on GDPR principles and data subject rights