Toolkit
GDPR readiness cheat sheet
A one-page summary to work from, not a substitute for the full guide or the official text.
Saves a one-page PDF straight to your device. It is put together by your browser, on this page — nothing is uploaded.
Who it's for. Any organisation processing personal data of people in the EU/EEA, or based outside it but offering goods or services to them, or monitoring their behaviour there.
Scope
- Established in the EU and processing personal data in that context, wherever the processing itself happens
- Outside the EU but offering goods or services to, or monitoring the behaviour of, people in the EU
- Covers processing by automated means and structured manual filing systems
- Excludes purely personal or household activity, and most law-enforcement processing
Key requirements
- Pick a lawful basis under Article 6 for every processing purpose before it starts; add an Article 9 condition for special-category data
- Give clear notice at the point of collection and respond to rights requests within one month
- Keep a record of processing activities (Article 30)
- Apply security appropriate to the risk, such as encryption or pseudonymisation where relevant (Article 32)
- Notify the supervisory authority within 72 hours of becoming aware of a breach, where feasible; tell affected people too if the risk is high
- Run a DPIA before starting any processing likely to be high-risk
- Appoint a DPO where Articles 37–39 require one
- Use an approved transfer mechanism (adequacy decision, SCCs or BCRs) before personal data leaves the EEA
Evidence to gather
- Record of processing activities
- Lawful-basis and legitimate-interests assessments
- Privacy notices and consent records
- DPIAs for high-risk processing
- Article 28 processor contracts
- Breach register and the notifications sent
- Rights-request log with response times
Common gaps
- Defaulting to consent for everything instead of the basis that actually fits each purpose
- Privacy notices that don't match what's actually done with the data
- No internal process built to hit the 72-hour breach clock
- Processor contracts missing the Article 28 terms
This is general educational information, condensed by MajorCyber™ in its own words, not legal, audit or certification advice, and not a compliance assessment, certification or attestation of any kind. It is a starting checklist, not a complete statement of the framework's requirements — confirm anything material against the full GDPR guide, the official text, or a qualified adviser.