This practical GDPR checklist helps small businesses build a maintainable data protection workflow. It covers what to document, how often to check it, and which business changes should trigger an immediate review of your privacy processes.
Overview
GDPR compliance for a small business is not a one-time task completed by publishing a privacy policy. It is an ongoing process for understanding the personal data your business handles, deciding why and how it is used, limiting unnecessary collection, and showing that sensible controls are in place.
This GDPR checklist is designed as a working tracker rather than a document to file away. Keep it with your operational records and assign responsibility for each action. The business may need to consider GDPR where it is established in the European Economic Area or handles personal data connected with people in that region. Other privacy laws may also apply, so treat this guide as general information rather than a substitute for advice on your specific activities.
Start with a simple register containing the activity, owner, last review date, next review date, evidence, and outstanding action. A spreadsheet can be sufficient for a small operation if it is kept accurate and access is controlled.
What to track
1. Personal-data sources and uses
Map where personal data enters the business and where it goes afterward. Include website forms, online purchases, customer support, email marketing, recruitment, accounting, analytics, mobile applications, paper records, and information received from business partners.
For each activity, record the categories of people involved, the types of data collected, the purpose, the systems used, who can access it, and whether it is shared externally. Avoid broad descriptions such as “customer information” where a more precise description is possible. For example, separate contact details, order history, billing information, account credentials, and support correspondence.
2. Lawful bases and sensitive information
For each processing activity, document the lawful basis the business is relying on and why it fits that activity. Common possibilities may include performance of a contract, compliance with a legal obligation, legitimate interests, or consent. The appropriate basis depends on the facts and should not be selected merely because it is convenient.
Track whether an activity involves information requiring additional care, such as health information, biometric information, or other sensitive categories. If so, document the additional condition and safeguards being considered. Marketing consent, service communications, and account administration should not automatically be treated as the same activity.
3. Privacy notices and website controls
Review the privacy notice against the actual data map. It should explain, in clear language, what information is collected, why it is used, relevant sharing, retention approach, individual rights, and how people can raise questions or requests. A privacy policy GDPR review should check for operational accuracy, not just wording.
Track cookies, pixels, analytics tools, advertising tags, and similar technologies separately. Record what each tool does, what information it may collect, the provider, the purpose, and how user choices are captured. Do not describe a consent mechanism as effective unless it matches the business’s actual configuration and records choices appropriately.
4. Suppliers and data processing agreements
Maintain a supplier list for cloud platforms, payroll providers, email services, customer relationship systems, payment tools, marketing platforms, developers, and other vendors that may handle personal data. Identify whether each supplier acts as a processor, an independent controller, or another role under the relevant arrangement.
Where a processor relationship applies, check that the contract includes suitable data processing terms. Track the data processing agreement, security commitments, permitted uses, subcontracting arrangements, assistance with individual requests, breach notification process, deletion or return of data, and audit or information rights. Store the signed agreement and record when supplier terms change.
5. Individual rights and requests
Create a repeatable process for recognizing and responding to data-subject requests. Track the request date, identity-verification steps, systems searched, information provided, decisions made, and completion date. Staff who receive customer emails or support tickets should know where to route a request instead of making informal promises.
Document how the business handles access, correction, deletion, restriction, objection, portability, and withdrawal of consent where those rights apply. Set internal deadlines that allow time for checking identity, locating records, reviewing exemptions, and approving the response.
6. Breach response and security controls
Keep a GDPR data breach response plan that identifies who receives an alert, how the incident is contained, what facts must be recorded, and who decides whether notifications or other communications are required. Include accidental disclosures, lost devices, compromised accounts, misdirected emails, and supplier incidents—not only hacking.
Track practical safeguards such as access permissions, multi-factor authentication where available, software updates, backups, device security, secure disposal, staff training, and administrator reviews. Record incidents and near misses, even when no external notification is made, because they can reveal a process that needs improvement.
7. Retention and international transfers
For each category of data, define a retention period or a clear review rule. Link the rule to the purpose, contractual needs, legal requirements, accounting records, or dispute risk that supports keeping the information. Schedule deletion, anonymization, or review rather than relying on indefinite storage.
Record whether personal data is accessed from or transferred to countries outside the relevant protection area. Track the supplier, destination, transfer mechanism, contractual safeguards, and risk assessment where applicable. Recheck this information when a provider changes its hosting, subcontractors, or terms.
Cadence and checkpoints
A practical schedule combines routine checks with event-driven reviews:
- Monthly: review open rights requests, security incidents, new suppliers, failed deletion tasks, and changes to cookie or analytics settings.
- Quarterly: compare the data map with live systems, review user access, check marketing subscriptions and consent records, and confirm that processor agreements are stored.
- Every six months: test the breach response process, sample deletion records, refresh staff guidance, and check whether the privacy notice still matches operations.
- Annually: complete a broader GDPR compliance review covering lawful bases, retention, supplier risks, international transfers, training, and documented evidence.
- Immediately after a change: review the relevant controls before launching a new product, collecting a new data category, adding a tracking tool, changing a vendor, entering a new market, or introducing a new marketing channel.
Assign an owner to every checkpoint. “The business” is not a workable owner; name a role or person, set a due date, and record the result. If an item is not applicable, explain why rather than leaving it blank.
How to interpret changes
Not every change requires a complete compliance project. Classify changes by their effect. A new office printer may require an access and disposal check. A new advertising platform may require a fresh review of lawful basis, cookies, consent, supplier terms, international transfers, and the privacy notice.
Use three questions to prioritize work:
- What changed? Identify the new data, purpose, system, supplier, location, or group of people affected.
- What risk changed? Consider volume, sensitivity, access, visibility, retention, potential harm, and whether the processing is unexpected.
- What evidence is missing? Look for an absent contract, outdated notice, incomplete data map, untested response plan, or unclear deletion rule.
Escalate issues involving sensitive information, extensive monitoring, large-scale processing, vulnerable individuals, repeated incidents, or uncertainty about a high-risk activity. A privacy policy checker or template can help identify gaps, but it cannot replace an assessment of how the business actually operates.
When to revisit
Revisit this GDPR checklist on the monthly, quarterly, and annual schedule above, but do not wait for the next calendar review when the business changes. Put a compliance checkpoint into project planning for every new tool, website feature, customer journey, employee system, or marketing campaign that uses personal data.
At the end of each review, record three things: what was checked, what changed, and what action is due next. Archive superseded privacy notices, agreements, and risk assessments so the business can explain which version applied at a particular time.
For immediate use, create a tracker with these columns: processing activity, data categories, purpose, lawful basis, system or supplier, retention rule, transfer location, privacy-notice status, security owner, last review, next review, and open action. Review the highest-risk rows first. This turns GDPR compliance for a small business from a one-off document exercise into a manageable workflow that can be updated whenever the business, its technology, or its data practices change.
