GDPR Compliance Self-Assessment
GDPR is the EU's data-protection law, and it applies to anyone handling the personal data of people in the EU — not just European companies. In practice it means having a lawful reason to collect data, telling people what you do with it, keeping it secure, and honoring requests to access or delete it. This checklist turns those obligations into concrete yes/no controls so you can see where you stand and what to fix. It's a readiness guide, not a certification or legal advice.
How to use
- Open the tool — it defaults to GDPR mode with 20 compliance controls.
- To assess under India's DPDP Act instead, click the DPDP Act 2023 toggle at the top. The question set switches immediately.
- Work through the checklist. Tick each item your organisation has in place. The score badge in the header updates after every tick.
- When you have worked through all items, click Assess to generate the full output panel showing your score, a summary of ticked and unticked items, and next steps.
- To save your results, click Print / PDF and use the browser print dialog to export to PDF.
How it works
The checklist is a curated set of yes/no controls drawn from the official text of the GDPR (Regulation (EU) 2016/679) and, in DPDP mode, from the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025. Each control represents a concrete implementation requirement.
The score is calculated as:
Score = (ticked items ÷ total items) × 100
Clicking Assess calls a rendering function that groups results by theme (Lawful Basis, Rights, Security, etc.) and highlights unticked items as action points.
Worked example — GDPR
An e-commerce company based in Mumbai sells products to EU customers. Starting from zero ticked:
| Control | Status |
|---|---|
| We have identified a lawful basis for each processing activity | ✓ |
| Our privacy notice is written in plain language and is easy to find | ✓ |
| We have a process for responding to Subject Access Requests within 30 days | ✗ |
| We have a Data Protection Officer (or documented exemption) | ✗ |
| We have documented our cross-border transfer mechanisms | ✗ |
After ticking 14 of 20 items, the score badge shows 70%. The Assess output flags the 6 unticked items as gaps to address, giving a prioritised action list.
Worked example — DPDP
The same company switches to DPDP mode to check readiness under Indian law. The question set now covers:
- Consent notice requirements under s.5 of the DPDP Act
- Rights of Data Principals (access, correction, erasure, grievance redressal)
- Data Fiduciary obligations including security safeguards
- Cross-border data transfer provisions
- DPDP Rules 2025 (notified 14 November 2025) — phased compliance — see Rules
GDPR controls covered
| Theme | Number of controls |
|---|---|
| Lawful basis and consent | 3 |
| Privacy notices and transparency | 2 |
| Data subject rights | 4 |
| Data security | 3 |
| Data breach response | 2 |
| DPO and governance | 2 |
| Cross-border transfers | 2 |
| Records of processing (ROPA) | 2 |
Tips for using the checklist effectively
- Start with the rights controls. Data Subject Access Requests and Right to Erasure are the most likely source of formal complaints — getting these processes in place first reduces regulatory risk.
- Treat each unticked item as a project task, not just a gap. Assign an owner and a deadline when you export the report.
- Re-run the DPDP version quarterly. The DPDP Rules 2025 introduced phased compliance obligations — some requirements have deferred effective dates. Check the official Rules for current applicability.
- Do not rely on this tool alone for high-stakes processing (health data, children's data, financial data). Engage a qualified Data Protection professional.
GDPR vs DPDP — key differences
Both laws protect individuals' personal data rights, but they differ in scope, penalties, and implementation approach.
| Dimension | GDPR (EU) | DPDP Act 2023 (India) |
|---|---|---|
| Territorial scope | Applies to any org processing EU residents' data | Applies to digital personal data processed in India, and data processed outside India if related to goods/services offered in India |
| Legal basis for processing | 6 lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests) | Primarily consent-based; additional grounds for legitimate uses listed in Schedule |
| Data subject rights | Access, rectification, erasure, portability, restriction, objection | Access (summary of processing), correction, erasure, grievance redressal |
| Breach notification | 72 hours to supervisory authority | Timeline defined by DPDP Rules; notification to Data Protection Board and affected Data Principals |
| DPO requirement | Required for large-scale processing | Consent Manager role defined; DPO requirement under Rules for Significant Data Fiduciaries |
| Maximum penalty | €20 million or 4% global turnover | Up to ₹250 crore per instance |
| Children's data | Parental consent required below 16 (Member State variation) | Parental/guardian consent required; age defined by Rules |
Common self-assessment gaps
Organisations completing the checklist for the first time typically find gaps in these areas:
Records of Processing Activities (ROPA). Article 30 of GDPR requires a written inventory of every processing activity — what data is collected, why, where it is stored, who has access, and how long it is kept. Most SMEs have never created this document.
Subject Access Request process. The 30-day clock to respond to a SAR starts from receipt — not from when you decide to action it. Without a documented process (who handles it, where data is stored, who approves the response), organisations routinely miss the deadline.
Cross-border transfer mechanisms. If your SaaS tools (CRM, email platform, analytics) are hosted outside the EU/EEA, you need to document the transfer mechanism — Standard Contractual Clauses, adequacy decision, or binding corporate rules. Many organisations use US-based tools without realising this is a cross-border transfer requiring documentation.
Sources
- EU GDPR — Regulation (EU) 2016/679, full text via EUR-Lex
- Digital Personal Data Protection Act 2023 — Government of India
- DPDP Rules 2025 — Gazette of India Extraordinary Part II §3(i), notified 14 November 2025
- UK ICO — GDPR Checklist for small organisations
Last updated: October 2026
Frequently Asked Questions
- Does this tool confirm GDPR compliance?
- No. It is a structured self-assessment to help you identify gaps — not a formal audit, certification, or legal opinion. Use it as a starting framework, then consult a data protection professional for binding advice.
- Who does GDPR apply to?
- GDPR applies to any organisation that processes personal data of EU/EEA residents, regardless of where the organisation itself is based. A company headquartered in India that has EU website visitors or customers is subject to GDPR.
- What is the India DPDP mode?
- The Digital Personal Data Protection Act 2023 (DPDP Act) is India's national data-protection law. Switching to DPDP mode replaces the questionnaire with India-specific controls covering consent, data fiduciaries, data principals' rights, and the DPDP Rules 2025 notified on 14 November 2025.
- What does the score percentage mean?
- The score shows the proportion of controls you have marked as complete. 100% means you have ticked all items in the current question set — it is a self-reported readiness indicator, not a legal certification.
- Can I print or download my assessment report?
- Yes. Click the Print / PDF button to open a formatted print view of your responses and score. Use your browser's Print function to save it as a PDF. The report includes a disclaimer reminding readers it is not legal advice.
- How many questions are in the GDPR checklist?
- The GDPR mode has 20 questions covering lawful basis, consent management, privacy notices, data subject rights (access, erasure, portability), data breach procedures, DPA appointment, cross-border transfers, and records of processing.
- How many questions are in the DPDP checklist?
- The DPDP mode covers the key obligations under the Digital Personal Data Protection Act 2023 and DPDP Rules 2025, including consent, notice, data fiduciary obligations, Data Protection Officer appointment, and grievance redressal.
- Does the tool save my responses?
- No. All responses are held in memory in your browser tab. Closing or refreshing the page resets the checklist. Print the report before navigating away if you want a record.