GDPR quick check: where do you stand?

Records, informing individuals, processors, security, data breaches: review the most practical GDPR obligations for a small business, an SME or a non-profit, and come away with your priorities.

12 questions, about a minute. Your answers stay in your browser: nothing is sent.

Question 1 of 12

Do you keep an up-to-date record of processing activities?

Customers, prospects, employees, suppliers, members: every use of personal data is described in it (purpose, data, recipients, retention period).

Question 2 of 12

Are people told how their data is used?

A privacy notice with every form (website, paper, sign-up) and a privacy policy that is easy to find on your website.

Question 3 of 12

Do you obtain valid consent where it is required?

Direct marketing to individuals by email or text message, cookies and trackers that are not strictly necessary for the website to work: prior consent, with refusing as easy as accepting.

Question 4 of 12

Have you set retention periods, and do you apply them?

A period for each category of data, followed by deletion or archiving: unsuccessful applicants' CVs, inactive prospects, former customers, former employees.

Question 5 of 12

Are your processors bound by a contract that includes GDPR clauses?

Hosting provider, business software vendor, IT provider, cloud tools, payroll bureau or accountant.

Question 6 of 12

Do you know whether any data is transferred outside the European Union?

Hosting in, or access from, a country outside the European Economic Area, for example through a cloud tool or a software vendor's support team.

Question 7 of 12

Is access under control, with individual accounts and multi-factor authentication?

One account per person, access rights limited to what each person needs, accounts disabled as soon as someone leaves, and multi-factor authentication on email, cloud tools and remote access.

Question 8 of 12

Is your data backed up, and are your laptops encrypted?

Regular backups, including an off-site copy, with tested restores; disk encryption on laptops (BitLocker, FileVault…) in case of loss or theft.

Question 9 of 12

Do you have a procedure for personal data breaches?

Hacking, ransomware, a lost laptop, an email sent to the wrong person: who to alert, how to assess the risk, when to notify the CNIL.

Question 10 of 12

Do you know how to handle a request for access, rectification or erasure?

Someone responsible for receiving requests, a way of finding the data, and a reply within one month.

Question 11 of 12

Are your staff aware of data protection?

Confidentiality, file sharing, phishing, reporting an incident; possibly an IT acceptable use policy.

Question 12 of 12

Have you checked whether you are required to appoint a data protection officer (DPO)?

It is mandatory in particular for public bodies and for organisations whose core activities involve regular and systematic monitoring of individuals on a large scale, or large-scale processing of sensitive data. Otherwise, an internal lead is still useful.

0 answers out of 12

Glossary: GDPR · Encryption · MFA