---
name: gdpr-compliance-checklist
description: "Creates GDPR compliance checklists with data mapping, consent mechanisms, and breach response procedures. Use when ensuring your business complies with GDPR requirements."
allowed-tools: Read Write Glob
metadata:
  author: matthewhitcham
  version: "1.0"
---

# GDPR Compliance Checklist

## When to Use This Skill

Use this skill when you need to:
- Assess GDPR compliance for a business that serves EU customers
- Create a data mapping inventory of personal data processing activities
- Establish consent mechanisms, data subject rights procedures, and breach response plans
- Build a compliance checklist to track your GDPR readiness

**DO NOT** use this skill as a substitute for legal counsel or a Data Protection Officer. This is a compliance planning tool. Consult a GDPR specialist for complex data processing scenarios.

---

## Core Principle

GDPR COMPLIANCE IS NOT A ONE-TIME PROJECT — IT IS AN ONGOING COMMITMENT TO TRANSPARENCY, DATA MINIMIZATION, AND RESPECT FOR INDIVIDUAL PRIVACY RIGHTS.

---

## Phase 1: Business Assessment

### Required Inputs

| Input | What to Ask | Default |
|-------|------------|---------|
| **Business location** | "Where is your business based?" | No default — must be provided |
| **EU customers** | "Do you have customers or website visitors from the EU?" | Yes |
| **Personal data collected** | "What personal data do you collect? (names, emails, IPs, payment info)" | No default — must be provided |
| **Processing activities** | "How do you use this data? (marketing, analytics, service delivery)" | No default — must be provided |
| **Third-party tools** | "What third-party services process your data? (email, analytics, payments)" | No default — list all |
| **Team size** | "How many people access personal data?" | 1-5 |

**GATE: Do not proceed without personal data inventory and processing activities.**

---

## Phase 2: Data Mapping

```
## Data Processing Inventory

### Personal Data Map
| Data Category | Specific Data | Source | Purpose | Legal Basis | Storage Location | Retention |
|--------------|--------------|--------|---------|-------------|-----------------|-----------|
| Contact info | Name, email | Signup form | Service delivery | Contract | [Cloud provider] | Account lifetime + [X] months |
| Payment | Card details | Checkout | Payment processing | Contract | [Stripe/processor] | As required by law |
| Analytics | IP, device, pages | Website | Site improvement | Legitimate interest | [Analytics tool] | [26] months |
| Marketing | Email, name | Opt-in form | Email marketing | Consent | [Email platform] | Until unsubscribe |

### Third-Party Processors
| Processor | Data Shared | Purpose | DPA in Place? | Location |
|-----------|-----------|---------|--------------|----------|
| [Email platform] | Name, email | Email marketing | [Yes/No] | [Country] |
| [Analytics] | IP, behavior | Website analytics | [Yes/No] | [Country] |
| [Payment processor] | Payment data | Transactions | [Yes/No] | [Country] |
| [Cloud hosting] | All stored data | Infrastructure | [Yes/No] | [Country] |
```

---

## Phase 3: Compliance Checklist

```
## GDPR Compliance Checklist

### Lawful Basis for Processing
- [ ] Identified a lawful basis for each processing activity (consent, contract, legitimate interest, legal obligation, vital interest, public task)
- [ ] Documented the lawful basis in the data processing inventory
- [ ] Where consent is the basis, consent is freely given, specific, informed, and unambiguous
- [ ] Consent records are stored (who, when, what they consented to)
- [ ] Legitimate interest assessments documented where applicable

### Privacy Notice / Policy
- [ ] Privacy policy published and easily accessible on website
- [ ] Policy explains: what data is collected, why, how long it is kept, who it is shared with
- [ ] Policy written in clear, plain language (not legal jargon)
- [ ] Policy lists all third-party processors and their purposes
- [ ] Policy explains data subject rights and how to exercise them
- [ ] Policy includes contact information for data protection inquiries
- [ ] Policy updated when processing activities change

### Consent Management
- [ ] Cookie consent banner implemented (opt-in, not pre-checked)
- [ ] Marketing email consent is separate from terms acceptance
- [ ] Consent can be withdrawn as easily as it was given
- [ ] Records of consent are maintained
- [ ] Double opt-in used for email marketing (recommended, not required)

### Data Subject Rights
- [ ] Process exists to handle access requests (Article 15) within 30 days
- [ ] Process exists to handle rectification requests (Article 16)
- [ ] Process exists to handle erasure requests (Article 17) — "right to be forgotten"
- [ ] Process exists to handle data portability requests (Article 20)
- [ ] Process exists to handle objection to processing (Article 21)
- [ ] Process exists to handle restriction of processing (Article 18)
- [ ] Identity verification procedure before fulfilling requests
- [ ] Response templates created for each request type

### Data Security
- [ ] Data encrypted at rest and in transit
- [ ] Access controls implemented (least privilege principle)
- [ ] Strong passwords and multi-factor authentication enforced
- [ ] Regular security assessments conducted
- [ ] Employee/contractor access to personal data is logged
- [ ] Data processing agreements (DPAs) signed with all processors

### Data Breach Response
- [ ] Breach detection and reporting procedures documented
- [ ] Supervisory authority notification process (within 72 hours)
- [ ] Data subject notification process (without undue delay for high-risk breaches)
- [ ] Breach response team identified
- [ ] Breach log maintained

### Data Minimization and Retention
- [ ] Only necessary data is collected (no "just in case" data)
- [ ] Retention periods defined for each data category
- [ ] Automated deletion or anonymization after retention period
- [ ] Regular review of stored data for necessity

### International Transfers
- [ ] Data transfers outside EEA identified
- [ ] Appropriate safeguards in place (Standard Contractual Clauses, adequacy decisions)
- [ ] Transfer impact assessments conducted where required

### Organizational Measures
- [ ] Staff trained on GDPR obligations and data handling
- [ ] Data Protection Officer appointed (if required — 250+ employees or large-scale sensitive data processing)
- [ ] Regular compliance reviews scheduled (at least annually)
- [ ] Privacy by design considered in new products and features
```

---

## Phase 4: Breach Response Plan

```
## Data Breach Response Plan

### Step 1: Detection and Assessment (0-24 hours)
- Identify the breach (unauthorized access, data loss, disclosure)
- Assess scope: what data, how many people, what risk
- Contain the breach (revoke access, patch vulnerability)

### Step 2: Documentation (0-72 hours)
- Record: nature of breach, data affected, number of subjects, likely consequences, measures taken
- Maintain in breach log regardless of severity

### Step 3: Authority Notification (within 72 hours)
If the breach is likely to result in risk to individuals:
- Notify the relevant supervisory authority within 72 hours
- Include: description of breach, categories and number of subjects, likely consequences, measures taken

### Step 4: Data Subject Notification (without undue delay)
If the breach is likely to result in HIGH risk to individuals:
- Notify affected individuals directly
- Include: description in plain language, likely consequences, measures taken, recommendations for protection

### Step 5: Review and Improve
- Conduct post-incident review
- Update security measures to prevent recurrence
- Document lessons learned
```

---

## Example: SaaS Startup with EU Customers

**Data collected:** Name, email, IP, usage data, payment via Stripe. **Processors:** AWS (hosting, US), Stripe (payments, US), Mailchimp (email, US), Google Analytics (analytics, US). **Actions:** Signed DPAs with all processors, implemented cookie consent with opt-in, published privacy policy listing all processors, created data export feature for portability requests, set 26-month retention on analytics data, enabled data deletion on account closure.

---

## Anti-Patterns

- **Treating GDPR as a checkbox exercise** — compliance is ongoing. Revisit when you add new tools, features, or data collection.
- **Relying on consent for everything** — consent is one of six legal bases. Contract performance and legitimate interest are often more appropriate and simpler.
- **Privacy policy nobody can understand** — GDPR requires clear, plain language. If a user cannot understand your policy, it does not comply.
- **No DPAs with processors** — if your email platform processes EU personal data and you do not have a DPA, you are both non-compliant
- **Ignoring the 72-hour breach notification rule** — this is a strict deadline. Have your response plan ready before a breach occurs.

---

## Recovery

- **Not currently GDPR compliant:** Prioritize: 1) Privacy policy, 2) Cookie consent, 3) DPAs with processors, 4) Data subject rights processes. Address highest-risk gaps first.
- **Received a data subject access request:** Respond within 30 days. Verify identity, compile all personal data held, provide in a portable format.
- **Data breach occurred:** Follow the response plan. Document everything. Notify the authority within 72 hours if risk to individuals exists.
- **Using US-only tools without DPAs:** Most major SaaS tools (Stripe, AWS, Mailchimp) offer DPAs. Request and execute them immediately.
