GDPR checklist

What to improve

• I know which personal data I collect (name, email, phone, tax number, IBAN, etc.).Make a simple list of the data you collect and why.
• I know where that data is stored (computer, email, cloud, paper).Map where the data lives: computers, email, software, cloud and paper.
• I have defined how long I keep each type of data.Set retention periods (e.g. invoices 10 years, sales contacts 2 years).
• I inform customers about how I use their data.Add a privacy notice to your forms, contracts and quotes.
• I have an up-to-date privacy policy (on my website, contract or document).Publish a clear privacy policy on your website. You can use our terms and privacy policy generator.
• I ask for explicit consent when required (e.g. newsletters).Use unticked consent boxes for newsletters and marketing.
• My website has a cookie banner that only enables analytics and marketing with permission.Install a cookie banner with a reject option that blocks Google Analytics and similar tools until consent is given.
• I know which suppliers process data on my behalf (accountant, software, hosting, cloud).List the suppliers with access to your company's personal data.
• I have data protection contracts or clauses with those suppliers.Ask suppliers for their data processing agreement (DPA) or add GDPR clauses to your contracts.
• Computers and phones have strong passwords and screen lock.Enable strong passwords and automatic lock on every device. You can use our password generator.
• I use two-factor authentication on email and important accounts.Turn on two-factor authentication, at least for email, banking and social media.
• I make regular backups and have tested restoring them.Automate backups and test restoring them at least once a year.
• I use antivirus and keep software up to date.Enable automatic updates and keep an antivirus active.
• My website and email use encrypted connections (HTTPS and TLS).Make sure your website has an SSL certificate and your email uses encrypted connections.
• I know how to respond to requests for access, correction and deletion of data.Decide who responds and within what timeframe (one month at most).
• I can provide a person's data in a simple format (e.g. PDF or Excel).Learn how to export a customer's data from the software you use.
• I log the requests I receive and my responses.Keep a simple log of requests and responses.
• I keep a record of processing activities (even a simple spreadsheet).Create a record of processing activities: what data, why, on what legal basis and for how long.
• I know what to do in case of a data breach (e.g. hacked email, stolen computer).Prepare an incident response plan. Serious breaches must be reported to the supervisory authority within 72 hours.
• I have identified the main risks (data loss, unauthorised access, etc.).Carry out a simple risk assessment and list measures to reduce each risk.
• I review these procedures regularly (at least once a year).Schedule an annual review of these procedures.

Excellent! You meet every point on this checklist.