GDPR is a data-protection regulation, not a security product or a general certificate that removes legal responsibility. For a business, the practical task is to understand which processing it governs, why that processing is lawful and how the organisation will respect the people affected.
This guide focuses on EU GDPR operating decisions. It does not treat the EU, the wider European region and the UK as one legal regime. Establish the relevant jurisdictions and obtain advice on uncertain applicability before turning a general checklist into a statement about your organisation.
Establish the activities within scope
The European Commission explains that GDPR can apply to processing in the context of an EU establishment and to certain activities of organisations outside the EU, including offering goods or services to people in the EU or monitoring their behaviour there. Nationality alone is not a reliable test, and global website accessibility does not settle the question.
Map the activities that matter: sales, recruitment, account management, support, analytics and supplier delivery. Identify the individuals, information and organisations involved. Include identifiable business contacts and employee information rather than limiting the review to consumer databases.
Record the basis for the scope decision and its limits. A new market, targeting strategy or product feature can change the analysis. Assign an owner to review those changes rather than relying indefinitely on a conclusion reached for an earlier business model.
Give each processing activity a clear purpose and basis
Describe why information is needed and which legal ground supports the activity. Consent is one possible ground, not the automatic answer to every processing decision. The ground must fit the actual purpose and circumstances. Additional conditions may be relevant for sensitive information or other regulated uses.
Test the proposed data fields against the purpose. A support team may need an account identifier and problem description without needing a full identity document. If a field is collected for possible future use, identify that use and assess it before collecting the information by default.
Hypothetical example: a business introduces an event-registration form. Marketing asks to add several profile questions and automatically enrol attendees in unrelated campaigns. The project owner separates event administration from the additional marketing purpose, reviews the relevant rules and revises the form and information provided. The privacy notice follows the actual decisions instead of obscuring them.
Connect the decision to the product and workflow
Turn approved purposes into practical settings: access, collection fields, retention, disclosure and deletion. Data protection by design should influence these choices early enough to change the service. A review after launch may identify problems, but it can be more difficult to unwind unnecessary collection already taking place.
Provide clear information to the people whose data is processed. Check that the explanation matches actual systems and recipients. If a retention statement says records are deleted, confirm the workflow, responsibilities and relevant exceptions rather than assuming an administrator will remember.
Use security measures proportionate to the risks and processing context. GDPR does not prescribe a single commercial tool stack that guarantees compliance. Document why the selected measures are suitable and how their operation will be evaluated.
Clarify supplier roles and international data flows
Determine whether a supplier processes data on your behalf, decides its own purposes or performs a combination of roles across different activities. Review the actual service rather than choosing a role solely from the supplier’s contract heading. Connect instructions and responsibilities to the people operating the service.
Trace relevant international transfers, including support and other access arrangements, and determine which transfer rules and safeguards apply. A data-processing agreement and an international-transfer mechanism answer related but different questions. Do not assume that buying a cloud service completes both reviews.
Keep a record of approved providers, service changes and unresolved conditions. When an integration adds a new recipient or use, review the decision before switching it on. That is more useful than an annual supplier list that does not show what each provider actually does.
Make rights and incident responses operational
Give staff a route for recognising and forwarding an individual’s request. Responses to rights requests are generally required without undue delay and within one month of receipt, with extensions available in defined circumstances. Do not convert that into a universal 30-day deletion rule; the right, conditions, exceptions and response process matter.
For incidents, distinguish the controller’s supervisory-authority assessment from a processor’s communication to its controller. The controller generally notifies without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. Prepare for decisions with incomplete information rather than waiting for a perfect final investigation.
Hypothetical example: a support agent receives an access request in a complaint email. A rehearsed route gets it to the responsible team, which verifies the request appropriately, identifies the relevant systems and tracks the response. A procedure that exists only in a policy folder would not produce that result on its own.
Review higher-risk changes before they become routine
Screen proposed processing for the need for a data protection impact assessment. High-risk processing needs a more considered examination than a generic launch checklist. Resolve the applicable assessment and consultation requirements before launch rather than declaring every small organisation exempt.
Maintain ownership of the core decisions: scope, purpose, legal ground, recipients, retention, safeguards and response routes. Use those records to brief product, HR, sales and suppliers. Where the organisation already uses an ISMS, its operating controls can support security work without replacing the wider privacy analysis.
Our GDPR assessment and implementation service can help organise a scoped review of these workflows. For the security-management boundary, the ISO 27001 guide explains the ISMS role without presenting certification as GDPR compliance.
Reference basis
- European Commission, Application of the GDPR.
- European Commission, Legal grounds for processing data.
- European Commission, Obligations and dealing with requests from individuals.
- European Commission, Rules on international data transfers.
- European Data Protection Board, Data breaches guide for small business.
Questions and answers
Does every company outside the EU fall under GDPR?
No. Assess the relevant establishment and processing activities, including whether the organisation offers goods or services to people in the EU or monitors behaviour there. A location label or website being accessible worldwide does not settle the analysis.
Is consent required for every use of personal data?
No. GDPR provides several legal grounds. Select and document the appropriate ground for the actual purpose, and assess any additional conditions. Do not use a consent box to avoid understanding the processing.
Must every deletion request be completed in 30 days?
No. The general response period is one month, subject to the applicable rules on extensions. Erasure is a conditional right, so assess the request and any lawful retention grounds rather than applying automatic deletion to every record.
Does an ISO 27001 certificate prove GDPR compliance?
No. It can provide relevant evidence about a scoped security management system. GDPR also concerns purposes, legal grounds, transparency, rights and other responsibilities that need their own assessment.
What is a practical first action for a growing business?
Choose one important personal-data workflow and document its purpose, people affected, legal ground, recipients, retention and owner. Check whether actual systems and staff instructions match those decisions, then prioritise the unresolved issues.
Review one real processing decision
Bring the activity, data flow and unresolved question. Discuss a focused GDPR readiness review that connects privacy decisions with the way your business operates.