Compliance test

1. Do you keep a written record of processing activities, or have you checked that you are exempt?

   The exemption covers only organisations with fewer than 250 employees whose processing is occasional, poses no risk to people and includes no special categories of data or data on criminal convictions and offences.

   art. 30

   YesNoNot sure
2. Have you identified the legal basis for each purpose for which you process personal data?

   art. 6

   YesNoNot sure
3. When you obtain people's data, from them or from other sources, do you tell them who you are, why and on what basis you process it, and what rights they have?

   art. 13art. 14

   YesNoNot sure
4. Where processing is based on consent, can you demonstrate that the person gave it (or do you not rely on consent at all)?

   art. 7

   YesNoNot sure
5. Do you know whether you process special categories of data (such as health data or biometric data used for identification), and on what basis?

   art. 9

   YesNoNot sure
6. Can you answer people's requests for access, rectification or erasure within one month of receipt or, within the same month, tell them why you need longer?

   art. 12art. 15art. 16art. 17

   YesNoNot sure
7. Have you checked whether any supplier processes data on your behalf (such as outsourced accounting, IT services or web hosting) and, if so, do you have a contract with each that meets art. 28?

   art. 28

   YesNoNot sure
8. Have you taken technical and organisational security measures suited to the risk?

   art. 32

   YesNoNot sure
9. Are you ready to document any personal data breach, notify the National Centre for Personal Data Protection unless the breach is unlikely to result in a risk to people, and inform the people themselves when the risk is high?

   art. 33art. 34

   YesNoNot sure
10. Have you checked whether any processing is likely to result in a high risk to people and, if so, carried out a data protection impact assessment before starting it?

    art. 35

    YesNoNot sure
11. Have you checked whether you must designate a data protection officer and, if so, have you designated one?

    art. 37

    YesNoNot sure
12. Do you know whether you transfer data to states outside the European Economic Area (for example through cloud services), and on what basis each transfer is made?

    art. 44art. 45art. 46art. 47art. 49

    YesNoNot sure

The test shows likely gaps; it does not replace a compliance assessment. Your answers are not sent anywhere: the result is calculated in your browser.