// Free GDPR checklist
Free GDPR compliance checklist for small businesses
Seventeen questions on the EU's data protection law, for businesses in the EU or serving people there. About five minutes, with a scored report and suggested fixes sent by email.
The General Data Protection Regulation (GDPR) is the European Union’s data protection law. It covers any business established in the EU, and businesses anywhere else that offer goods or services to people in the EU. If you have customers in Portugal, Ireland, Germany, or anywhere else in the EU, it’s worth knowing where you stand.
What the checklist covers
- Governance and accountability. Knowing whether GDPR applies and whether you act as controller or processor, an EU representative where one is required, and an assessment of whether you need a Data Protection Officer.
- Records and lawful basis. A record of processing activities, a documented lawful basis for each one, and special category data handled only under an Article 9 condition.
- Transparency and individual rights. A clear privacy notice, a known channel and procedure for requests, and the ability to answer them within one month.
- Security of processing. MFA on email and every system holding personal data, role-based access removed promptly when people leave, and backups with an offline or immutable copy and a tested restore.
- Processors and international transfers. A data processing agreement with every processor, and a valid mechanism for each transfer outside the EEA.
- Breach response. A written breach response plan, the ability to notify the authority within 72 hours, and a process for telling affected people when the risk is high.
Where to look first
The record of processing. It’s the map everything else depends on: you can’t pick a lawful basis, answer a request, or assess a breach for data you haven’t listed.
After the checklist
Your report shows your score and a suggested fix for every gap. We handle the technical and operational side, the security controls, logging, backups, and evidence, through our compliance programs. Also serving people in Brazil? Take the LGPD checklist too. The two laws overlap a lot.
This is a self-assessment based only on your answers. Logos Tech Systems doesn’t conduct or verify it, and doesn’t endorse the report unless we’ve reviewed it with you in a consultation. It isn’t legal advice.
// Questions
Common questions
Does GDPR apply to businesses outside the EU?
It can. It applies to businesses established in the EU, and to businesses elsewhere that offer goods or services to people in the EU or monitor their behavior. Businesses outside the EU that it reaches usually need to appoint an EU representative.
How quickly do we have to report a breach?
To the supervisory authority within 72 hours of becoming aware of it, where the breach is likely to put people at risk. People affected must be told without undue delay when the risk to them is high.
Is this legal advice?
No. The checklist is a self-assessment, and we're an IT and security provider, not a law firm. For legal questions about GDPR, talk to a data protection lawyer. We handle the technical and operational side.
// Next step
Serving customers in Europe?
We handle the technical side of GDPR: access control, encryption, backups, logging, and the records that show it, in English or Portuguese.