🔒

Privacy by Design GDPR Checklist

Identify and document the personal data you hold

Analyze the compliance status of the data processing activities

Implement Data Protection Impact Assessment (DPIA)

Review and update data protection policies and procedures

Ensure data protection is central to all future projects

Establish a process for obtaining consent

Ensure that privacy settings are set at a high default

Identify measures to verify individual’s ages and to obtain parental or guardian consent for any data processing activity

Review and update contracts with third parties and data processors

Make sure all employees and contractors are trained on data protection

Establish an effective data breach detection, reporting and investigation process

Design and establish a method to respond to data subjects when they exercise their rights

Adopt encryption and/or pseudonymization wherever possible

Introduce a system to manage data subject access requests

Appointment of a Data Protection Officer (if required)

Approval: Data Protection Officer for Privacy by Design GDPR Checklist

Identify and document the personal data you hold

In this task, you will identify and document all the personal data your organization holds. This includes data related to employees, customers, and any other individuals whose data you collect. By completing this task, you will have a comprehensive understanding of the personal data you process, which is essential for ensuring compliance with GDPR. You will also be able to assess the potential risks and impacts of processing this data on individuals' privacy. What types of personal data does your organization collect? Are there any challenges in identifying and documenting all the data? What resources or tools do you need to complete this task?

Type of personal data

Data categories

1

Name
2

Address
3

Email
4

Phone number
5

Financial information

Personal data documentation

1

Identify data sources
2

Record data categories
3

Assess data processing purposes
4

Document data retention periods
5

Evaluate data security measures

Person responsible for data documentation

Analyze the compliance status of the data processing activities

In this task, you will analyze the compliance status of your organization's data processing activities. By doing so, you will be able to identify any gaps or areas of non-compliance with GDPR requirements. This analysis is crucial for taking corrective actions and ensuring that your data processing activities align with the principles of privacy by design. What is the current compliance status of your organization's data processing activities? Are there any challenges in conducting this analysis? What resources or tools do you need to complete this task?

Current compliance status

Areas of non-compliance

1

Data minimization
2

Lawful basis for processing
3

Consent management
4

Data retention
5

Data breach notification

Corrective actions

1

Update data processing policies
2

Train employees on GDPR requirements
3

Review data processing contracts
4

Implement privacy impact assessments
5

Improve data breach response procedures

Person responsible for compliance analysis

Implement Data Protection Impact Assessment (DPIA)

In this task, you will implement a Data Protection Impact Assessment (DPIA) to assess the risks and impacts of your organization's data processing activities on individuals' privacy. By conducting a DPIA, you will be able to identify and mitigate any potential risks or non-compliance with GDPR requirements. This will enable you to make informed decisions about data processing activities and ensure that privacy by design principles are embedded in your organization's practices. Have you conducted a DPIA before? What challenges do you anticipate in implementing a DPIA? What resources or tools do you need to complete this task?

Previous DPIA conducted

DPIA implementation steps

1

Define data processing activities
2

Identify risks and impacts
3

Assess data protection measures
4

Mitigate risks and impacts
5

Document DPIA findings

Person responsible for DPIA implementation

Review and update data protection policies and procedures

In this task, you will review and update your organization's data protection policies and procedures to ensure compliance with GDPR. This includes policies related to data protection, data retention, data breach response, and consent management. By keeping these policies up to date, you will be able to demonstrate your commitment to protecting personal data and complying with privacy regulations. What data protection policies and procedures does your organization currently have in place? What challenges do you anticipate in reviewing and updating these policies? What resources or tools do you need to complete this task?

Existing data protection policies

Policies to be updated

1

Data protection
2

Data retention
3

Data breach response
4

Consent management
5

Privacy by design

Policy review and update steps

1

Identify policy gaps
2

Update policy content
3

Communicate policy changes
4

Train employees on policy updates
5

Monitor policy compliance

Person responsible for policy review and update

Ensure data protection is central to all future projects

In this task, you will ensure that data protection is central to all future projects undertaken by your organization. This includes incorporating privacy by design principles from the project planning stage and conducting privacy impact assessments for new projects. By embedding data protection into your organization's project management processes, you will minimize the risks and impacts on individuals' privacy and ensure compliance with GDPR requirements. How does your organization currently incorporate data protection into project management? What challenges do you anticipate in implementing data protection in future projects? What resources or tools do you need to complete this task?

Current project management practices

Privacy by design practices

1

Privacy impact assessments
2

Consent management
3

Data minimization
4

Data retention
5

Data breach response

Project management steps

1

Incorporate privacy by design in project planning
2

Conduct privacy impact assessments for each project
3

Review data processing activities in projects
4

Train project teams on data protection practices
5

Monitor project compliance with GDPR

Person responsible for data protection in projects

Ensure that privacy settings are set at a high default

In this task, you will ensure that privacy settings are set at a high default level for any products or services your organization offers. This means that the most privacy-friendly settings should be the default options, minimizing the amount of personal data collected and processed. By setting privacy-friendly defaults, you will promote the protection of individuals' privacy and comply with GDPR requirements. Do your current products or services have privacy settings? What challenges do you anticipate in setting high default privacy settings? What resources or tools do you need to complete this task?

Current privacy settings

Default privacy settings

1

High
2

Medium
3

Low
4

User-defined
5

No default settings

Person responsible for privacy settings

Review and update contracts with third parties and data processors

In this task, you will review and update contracts with third parties and data processors to ensure compliance with GDPR requirements. This includes ensuring that appropriate data protection clauses are included in contracts and that third parties and data processors are reliable and trustworthy. By reviewing and updating contracts, you will minimize the risks associated with sharing personal data with external parties. What contracts with third parties and data processors does your organization currently have in place? What challenges do you anticipate in reviewing and updating these contracts? What resources or tools do you need to complete this task?

Existing contracts with third parties

Contract clauses to be updated

1

Data protection
2

Data security
3

Data breach notification
4

Subprocessing restrictions
5

Data transfer safeguards

Contract review and update steps

1

Identify contracts requiring review
2

Assess compliance with GDPR requirements
3

Negotiate amendments with third parties
4

Update contract clauses
5

Monitor third parties' compliance

Person responsible for contract review and update

Make sure all employees and contractors are trained on data protection

In this task, you will ensure that all employees and contractors in your organization receive training on data protection and GDPR requirements. This includes educating them about their responsibilities in handling personal data and understanding the potential risks and impacts of non-compliance. By providing comprehensive training, you will promote a culture of data protection and minimize the likelihood of data breaches or privacy violations. How does your organization currently train employees and contractors on data protection? What challenges do you anticipate in providing training to all individuals? What resources or tools do you need to complete this task?

Current training methods

Training topics

1

GDPR principles
2

Data handling best practices
3

Data breach response
4

Consent management
5

Privacy by design

Training implementation steps

1

Develop training materials
2

Deliver training sessions
3

Assess training effectiveness
4

Provide refresher training
5

Maintain training records

Person responsible for data protection training

Establish an effective data breach detection, reporting and investigation process

In this task, you will establish an effective data breach detection, reporting, and investigation process to ensure quick and appropriate responses in the event of a data breach. By having a well-defined process in place, you will be able to minimize the impact of data breaches on individuals' privacy and comply with GDPR requirements regarding data breach notification. How does your organization currently handle data breaches? What challenges do you anticipate in establishing an effective data breach process? What resources or tools do you need to complete this task?

Current data breach process

Data breach response steps

1

Detection and assessment
2

Containment and recovery
3

Notification and communication
4

Investigation and analysis
5

Remediation and prevention

Person responsible for data breach process

Design and establish a method to respond to data subjects when they exercise their rights

In this task, you will design and establish a method to respond to data subjects when they exercise their rights under GDPR. This includes providing individuals with access to their personal data, rectifying inaccurate data, deleting their data, and fulfilling other rights granted to them. By having an efficient and transparent process in place, you will demonstrate respect for individuals' rights and comply with GDPR requirements. How does your organization currently handle data subjects' rights requests? What challenges do you anticipate in designing a responsive method? What resources or tools do you need to complete this task?

Current data subjects' rights process

Rights response steps

1

Receive and validate requests
2

Retrieve and provide personal data
3

Rectify inaccurate data
4

Delete data
5

Maintain records of rights requests

Person responsible for rights response

Adopt encryption and/or pseudonymization wherever possible

In this task, you will adopt encryption and/or pseudonymization techniques wherever possible to enhance the security and privacy of personal data. By encrypting or pseudonymizing data, you will reduce the risk of unauthorized access or disclosure and ensure compliance with GDPR requirements. How does your organization currently use encryption or pseudonymization? What challenges do you anticipate in adopting these techniques? What resources or tools do you need to complete this task?

Current encryption or pseudonymization usage

Techniques to adopt

1

Data encryption
2

Tokenization
3

Data masking
4

Anonymization
5

Homomorphic encryption

Person responsible for encryption/pseudonymization

Introduce a system to manage data subject access requests

In this task, you will introduce a system to manage data subject access requests received from individuals who wish to exercise their rights under GDPR. This system should ensure that requests are handled promptly, efficiently, and securely. By managing access requests effectively, you will enable individuals to exercise their rights and comply with GDPR requirements. How does your organization currently handle access requests? What challenges do you anticipate in introducing a management system? What resources or tools do you need to complete this task?

Current access request management

Management system steps

1

Receive and validate requests
2

Authenticate data subjects
3

Retrieve and provide personal data
4

Monitor response timeframes
5

Maintain records of access requests

Person responsible for access request management

Appointment of a Data Protection Officer (if required)

In this task, you will consider the appointment of a Data Protection Officer (DPO) for your organization if required by GDPR. A DPO is responsible for overseeing data protection activities and ensuring compliance with GDPR. By appointing a DPO, you will demonstrate your commitment to data protection and compliance with privacy regulations. Does your organization require a DPO? What challenges do you anticipate in appointing a DPO? What resources or tools do you need to complete this task?

DPO requirement

DPO responsibilities