A GDPR compliance checklist for SMEs

If you run a small or medium-sized business, GDPR compliance can feel deceptively simple at first. It might seem like all you need to do is to publish a privacy policy, add a cookie banner, update a few contracts, and you’re done.

However, GDPR compliance is much broader than this. It’s an ongoing practice that requires accountability; one where you need to make lawful decisions about personal data, document those decisions, apply appropriate technical and organizational measures, and be able to show your reasoning if a regulator, customer, or partner asks questions. 

A comprehensive checklist helps businesses identify the major moving parts: lawful basis, transparency, retention, security, processor contracts, breach response, and staff training, among others. 

Of course, the real work is in applying those requirements to your own systems, vendors, customer journeys, and internal access practices. The right approach is to treat this as a structured review of risk and governance, not a box-ticking exercise. But, this compliance checklist for UK GDPR can help UK businesses get started.

Remember, GDPR compliance is a commercial obligation as much as a legal one. Buyers expect suppliers to demonstrate maturity around privacy, data handling, and access control, particularly when customer data, employee information, or sensitive business data is involved.

As you work through this checklist, keep in mind that this is not a complete guide and does not constitute legal advice. If you need tailored guidance on implementing GDPR within your organization, seek advice from a qualified legal professional.

How to use this GDPR compliance checklist

Turning your GDPR compliance checklist into real-world implementation

Access control sits at the center of GDPR compliance

Which actions to prioritize for GDPR compliance

How to use this GDPR compliance checklist 

It’s simple: just work through each phase in order. For each item, mark your status and ensure you can produce the listed evidence. This will give you a better understanding of how compliant your business currently is and where your next areas of focus should be. 

GDPR compliance step	Action checklist	Priority	Required evidence	Status
Map all personal data processing activities	Data inventory – Identify all systems storing personal data (CRM, HR, email, cloud tools) – List all data types collected (customer, employee, leads) Processing mapping – Define purpose of each activity- Identify data subjects and categories – Record where data is stored and transferred	High	Record of Processing Activities (ROPA) document	☐
Define lawful basis for each activity	– Assign lawful basis (contract, legal obligation, consent, etc.) to each activity – Ensure basis is defined before processing – Confirm basis aligns with purpose (not convenience) – Apply “necessity” test	High	Documented lawful basis register	☐
Conduct Legitimate Interests Assessment (if applicable)	– Identify where “legitimate interests” is used – Perform balancing test (business vs individual rights) – Document reasoning and safeguards	Medium	Legitimate Interests Assessment (LIA) records	☐
Identify and classify sensitive data	– Identify special category data (health, biometrics, etc.) – Apply additional Article 9 condition – Define stricter controls (access, encryption)	High	Sensitive data classification and safeguards record	☐
Map data flows	– Track how data moves (collection → storage → sharing → deletion)- Identify internal and external transfers- Flag high-risk flows	High	Data flow diagrams / mapping documentation	☐

GDPR compliance step	Action checklist	Priority	Required evidence	Status
Create or update privacy notice	Content– List data collected- Explain purpose and lawful basis – Identify third parties – Define retention periods – Include user rights and contact details Clarity– Use plain language – Avoid legal jargon	High	Published privacy policy aligned with operations	☐
Align privacy notice with real operations	– Audit actual data use across systems – Ensure all tools/vendors are disclosed – Update notice when processes change	High	Privacy notice review log	☐
Implement valid consent mechanisms	– Use clear, specific consent requests – Avoid pre-ticked boxes – Separate consent by purpose – Use opt-in (not opt-out) mechanisms	High	Consent capture records/screenshots	☐
Record and manage consent	– Log when and how consent was given- Store consent records securely- Link consent to specific purposes	High	Consent database / logs	☐
Enable easy consent withdrawal	– Provide simple withdrawal methods (unsubscribe, settings) – Ensure withdrawal applies across all systems – Stop processing immediately where required	High	Consent withdrawal workflows	☐

GDPR compliance step	Action checklist	Priority	Evidence / output	Status
Define data retention policy	– Categorize data (customers, employees, leads) – Assign retention periods – Justify retention (legal, contractual, operational) – Document policy	High	Data retention policy document	☐
Enforce retention rules	– Implement automated deletion where possible – Schedule manual reviews – Archive or delete expired data	High	Deletion logs / automation rules	☐
Apply data minimization	– Collect only necessary data – Remove redundant or duplicate data – Avoid over-collection in forms/processes	High	Data minimization review records	☐
Manage legacy data	– Audit old systems and backups – Identify unnecessary historical data – Securely delete outdated data	Medium	Legacy data cleanup logs	☐
Implement access control (least privilege)	– Assign access based on role – Limit access to necessary data only – Review permissions regularly	High	Access control matrix / permission logs	☐
Manage user accounts	– Create unique accounts for all users – Remove shared accounts – Disable dormant accounts	High	User account audit records	☐
Strengthen authentication	– Enforce strong password policies – Implement two-factor authentication (2FA) where possible – Separate admin vs standard accounts	High	Security policy / 2FA implementation records	☐
Secure credential management	– Store passwords securely (not in plain text) – Avoid reuse across systems – Use secure sharing methods	High	Credential management system evidence	☐
Implement technical security measures	– Encrypt sensitive data (at rest and in transit) – Apply secure configurations – Protect endpoints and networks	High	Security configuration documentation	☐
Monitor and log access	– Enable system logging – Track who accessed what data and when – Retain logs for audit purposes	Medium	Access logs and monitoring reports	☐

GDPR compliance step	Action checklist	Priority	Evidence / output	Status
Identify all data processors	– List all vendors handling personal data – Define what data they access – Understand their role/effect in the data pipeline	High	Vendor register	☐
Put Data Processing Agreements in place	– Ensure DPA exists for each vendor – Confirm scope, purpose, and security obligations – Review vendor terms	High	Signed DPAs	☐
Control data sharing with vendors	– Share only necessary data – Define purpose of sharing – Limit access permissions	High	Data sharing documentation	☐
Assess international data transfers	– Identify transfers outside UK – Apply safeguards (SCCs, adequacy decisions) – Document risk assessment	High	Transfer risk assessments / SCCs	☐
Manage vendor lifecycle	– Review vendors periodically – Remove unused tools – Ensure data deletion during offboarding	Medium	Vendor review logs	☐

GDPR compliance step	Action checklist	Priority	Evidence / output	Status
Set up data subject request process	– Create intake channel (email/form) – Assign responsibility – Define workflow and deadlines	High	Data request handling procedure	☐
Enable data access and retrieval	– Ensure data can be located across systems – Compile data without exposing others’ information	High	Data retrieval process documentation	☐
Handle erasure and restriction requests	– Define deletion workflows – Notify third parties where required – Understand legal exemptions	High	Erasure request logs	☐
Support data portability	– Provide structured data exports (CSV, JSON) – Ensure usability of exported data	Medium	Portability export examples	☐
Implement breach response process	– Define data breach protection and response plan – Assign roles and escalation paths – Train staff on incident recognition	High	Incident response plan	☐
Meet 72-hour reporting requirement	– Define criteria for reporting to ICO – Ensure ability to notify within timeframe	High	Breach reporting procedure	☐
Maintain breach log	– Record all incidents (including minor ones) – Document decisions and actions taken	High	Breach register	☐

GDPR compliance step	Action checklist	Priority	Evidence / output	Status
Conduct DPIAs for high-risk processing	– Identify high-risk activities – Assess risks to individuals – Define mitigation measures – Document outcomes	High	DPIA reports	☐
Assign data protection responsibility	– Appoint DPO (if required) OR – Assign internal data protection lead – Define authority and responsibilities	High	Role description / appointment record	☐
Establish governance structure	– Define reporting lines – Schedule compliance reviews – Monitor ongoing compliance activities	Medium	Governance documentation	☐
Maintain policies and procedures	– Create policies (data protection, retention, access, breach response) – Align policies with actual operations – Update regularly	High	Policy documents (version-controlled)	☐
Train staff on data protection	– Provide role-specific training – Cover handling, risks, and procedures – Conduct regular refreshers	High	Training records and materials	☐
Reinforce secure behaviour	– Promote password hygiene – Raise phishing awareness – Encourage reporting of issues	Medium	Awareness programme records	☐
Ensure audit readiness	– Maintain documentation for all controls – Keep evidence of decisions and processes – Prepare for regulatory or partner review	High	Compliance documentation repository	☐
Perform regular compliance reviews	– Conduct periodic internal audits – Identify gaps and improvements – Update processes as business evolves	Medium	Audit reports and improvement plans	☐

Turning your GDPR compliance checklist into real-world implementation

A detailed GDPR compliance checklist is only useful if it translates into consistent, real-world execution. Many organizations reach a point where they’ve documented policies, defined processes, and even assigned responsibilities, yet they still fall short when those controls are tested in practice. The difference lies in how well those controls are embedded into everyday operations.

In a practical sense, each item in your checklist should map directly to something tangible within your business. That could be a system where data is stored, a workflow that governs how it is handled, or a clearly defined owner responsible for oversight. Without that mapping, compliance remains theoretical.

For example, a retention policy should not exist purely as a document; it should be reflected in automated deletion rules, scheduled reviews, or clearly enforced archiving processes. Similarly, a privacy notice should not be a static page created once and forgotten; it should evolve alongside your tools, vendors, and data practices.

This is ultimately what regulators expect. They aren’t only assessing whether a business has policies in place, but whether those policies accurately reflect how personal data is handled and whether the organization can demonstrate that alignment when asked.

A useful way to think about this is that your GDPR checklist for businesses is not a checklist in isolation, but a framework for operational control. Each row in your table should correspond to something you can point to, explain, and, if necessary, evidence. Instead of a documentation exercise, this makes your checklist into something much more actionable and defensible.

Access control sits at the center of GDPR compliance

Although this GDPR compliance checklist covers a broad range of legal, operational, and technical requirements, access control is one of the most essential areas for your business to assess and update. Access refers to who can access personal data, under what conditions, and with what level of oversight, which directly affects your ability to protect information, respond to subject access requests, and demonstrate accountability.

Access control influences far more than just security. In many cases, it’s also where compliance breaks down. Not because of sophisticated attacks on your business network, but because of  the risk created by everyday operational gaps: shared accounts, excessive permissions, weak authentication practices, or a lack of visibility over who has access to what.

These issues tend to accumulate gradually, whenever a new tool is introduced, or access is granted quickly and never revoked. Over time, those permissions are rarely revisited. The result is a level of access sprawl that increases risk without being immediately visible. This is why access control should be treated as a core pillar of your business’s GDPR compliance program.

Credential management plays a central role in access control. If password practices are inconsistent or left to individual discretion, they can undermine even well-designed policies. Establishing clear, enforceable standards around password strength, reuse, and secure sharing creates a baseline that supports many other security controls.

For many organizations, this can mean adopting a dedicated business password manager that helps enforce those standards consistently across teams. A business password manager like Proton Pass for Business can simplify credential management while improving visibility, secure sharing, and access control throughout an organization.

When access is properly controlled in this way, organizations are better positioned to meet many of the GDPR’s security and accountability requirements. Data is easier to locate, permissions are clearer, and sensitive information is less likely to be accessed by unauthorized users. 

While access control doesn’t replace obligations such as establishing lawful bases for processing, maintaining privacy notices, or enforcing retention policies, it provides an important foundation for protecting personal data and demonstrating that appropriate safeguards are in place.

Which actions to prioritize for GDPR compliance

One of the most common challenges with any GDPR compliance checklist is knowing where to focus your efforts and attention. When everything is important, it can be difficult to know where to begin. But realistically, some areas carry significantly more weight than others, particularly in the early stages of implementation.

• Data visibility is your natural starting point. If you don’t have a clear understanding of what personal data you hold, where it’s stored, and how it moves through your organization, it becomes difficult to apply any other control effectively. Mapping your data flows and maintaining an accurate inventory creates the foundation for everything that follows.
• Next, assessing access control is the most immediate way to reduce risk. Limiting access to those who genuinely need it and maintaining visibility over permissions addresses a large proportion of real-world vulnerabilities. 
• This is closely followed by retention discipline. Reducing the volume of data you hold not only lowers risk but also simplifies compliance across areas such as data subject rights and breach response.
• Breach readiness is another area that benefits from early attention. The 72-hour reporting requirement under UK GDPR places a premium on speed and clarity. Having a defined process, clear ownership, and the ability to assess risk quickly can make a significant difference in how an incident is managed and perceived.

By focusing on these areas first, businesses can make meaningful progress without becoming overwhelmed. The rest of the checklist can then help you build on a more stable and controlled foundation.