AGIDAT – Datenschutz | Informationssicherheit
DE

Checklists

Practical GDPR checklists for common business scenarios — free to use.

These checklists cover the most common data protection scenarios. They are practical starting points, not exhaustive legal compliance frameworks. Use them as a guide — and consult a data protection professional for your specific situation.

GDPR Basic Check for SMEs

The 15 most important points to get started with data protection.

  • Controller and Data Protection Officer appointed
  • Records of Processing Activities (RoPA) in place
  • Data Processing Agreements (DPAs) signed with all relevant service providers
  • Privacy policy on the website up to date
  • Cookie consent tool implemented
  • Employees bound to confidentiality regarding data protection
  • Technical and organizational measures (TOMs) documented
  • Deletion/retention concept in place
  • Process for handling data subject requests established
  • Process for reporting data breaches (72 hours) in place
  • Privacy notices provided at the point of data collection (Art. 13/14 GDPR)
  • Consents documented and revocable
  • Third-country transfers reviewed
  • Documentation reviewed and updated annually
  • Training provided for employees with access to personal data

Website Data Protection Check

What your website needs from a data protection perspective.

  • Privacy policy accessible from every page
  • Imprint present and complete
  • Cookie banner implemented before tracking scripts load
  • Google Analytics: DPA signed, IP anonymization enabled, consent obtained
  • Google Fonts hosted locally (no API call to Google)
  • Contact form: privacy notice included
  • Newsletter: double opt-in, proof of consent
  • Embedded videos (YouTube): click-to-activate or privacy-enhanced mode
  • SSL/TLS certificate active
  • Hosting: DPA signed with provider
  • Privacy policy: retention periods specified
  • Privacy policy: data subject rights described

Data Breach: First Steps

What to do when a data breach occurs.

  • Document the incident internally immediately (time, nature, scope)
  • Determine the volume and categories of data affected
  • Assess the risk: is notification required? (rule of thumb: yes)
  • Notify the supervisory authority within 72 hours
  • Inform the DPO (if one has been appointed)
  • Check whether affected individuals must be informed
  • Initiate measures to limit the damage
  • Track and document the incident internally
  • Analyze the root cause and prevent recurrence

Handling a Data Subject Request

Step by step, when someone requests information about their data.

  • Document the request (date received, type)
  • Verify the requester's identity
  • Clarify the type of request (access, erasure, rectification, …)
  • Check whether data about this person is held
  • Check whether any exceptions to the obligation to respond apply
  • Prepare the response and send it within the deadline (max. 1 month, extendable)
  • Document the response
  • If refused: provide reasoning and inform of the right to complain

Need more specific checklists or a customized compliance review? Contact us →