Your company has a list of all types of personal information it holds, the source of that information, who you share it with, what you do with it and how long you will keep it

Your company has a list of places where it keeps personal information and the ways data flows between them

Your company has a publicy accessible privacy policy that outlines all processes related to personal data.

Your privacy policy should include a lawful basis to explain why the company needs to process personal information

Your company has appointed a Data Protection Officer (DPO)

Create awareness among decision makers about GPDR guidelines

Make sure your technical security is up to date. 

Train staff to be aware of data protection

You have a list of sub-processors and your privacy policy mentions your use of this sub-processor

If your business operates outside the EU, you have appointed a representative within the EU.

You report data breaches involving personal data to the local authority and to the people (data subjects) involved

There is a contract in place with any data processors that you share data with 

Your customers can easily request access to their personal information

Your customers can easily update their own personal information to keep it accurate

You automatically delete data that your business no longer has any use for

Your customers can easily request deletion of their personal data

Your customers can easily request that you stop processing their data

Your customers can easily request that their data be delivered to themselves or a 3rd party

Your customers can easily object to profiling or automated decision making that could impact them

Ask consent when you start processing a person's information

Your privacy policy should be written in clear and understandable terms 

It should be as easy for your customers to withdraw consent as it was to give it in the first place

If you process children's personal data, verify their age and ask consent from their legal guardian

When you update your privacy policy, you inform existing customers

You regularly review policies for changes, effectiveness, changes in handling of data and changes to the state of affairs of other countries your data flows to.

Your business understands when you must conduct a DPIA for high-risk processing of sensitive data.

You should only transfer data outside of the EU to countries that offer an appropriate level of protection