Skip to content
IT-Checklist

Privacy & GDPR: checklist and advice

Last updated: · IT-Checklist editorial team · All changes

The General Data Protection Regulation (GDPR) applies to every business that processes personal data. Almost every business does: customer details, staff files, a newsletter list or camera footage. The law expects you to know what you are doing and to be able to show it.

The questions in this topic follow the obligations the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) asks about most often in practice.

Check where your business stands on privacy & gdpr

The free IT check asks you these questions. Then you see your score per topic and advice for every gap. You don't need an account.

Start the IT check →

Why this matters

A data breach that poses a risk to the people involved must be reported to the Dutch Data Protection Authority within 72 hours of discovery. If you still have to work out which data is stored where, you won't make that deadline.

Suppliers that process personal data for you are your responsibility. Think of your accounting software, mailing service or hosting provider. Without a data processing agreement, you are liable for how they handle it.

The 11 questions in this topic, with advice

Each question describes the situation you want to have. The label shows how much the measure weighs in your score. 'Do first' counts the most.

  1. We know which personal data we process and have documented it (processing register).

    Important

    Create a simple overview: which personal data do you process, why, where is it stored and how long do you keep it. This is required under the GDPR.

  2. Our website has a privacy statement and (where needed) a cookie banner.

    Recommended

    Publish a privacy statement that matches what you actually do, and ask consent for non-essential cookies.

  3. We have data processing agreements with parties that process personal data for us.

    Recommended

    Check your accountant, mailing tool, hosting provider and cloud vendors: each of them should have a data processing agreement.

  4. We know what to do in case of a data breach and when to report it.

    Important

    A data breach often must be reported to the data protection authority within 72 hours. Put the steps and the reporting desk on paper.

  5. Personal data is not kept longer than necessary and is deleted securely.

    Recommended

    Set retention periods (e.g. job applications 4 weeks, invoices 7 years) and clean up data periodically.

  6. We only send newsletters and marketing emails with consent and with a working unsubscribe option.

    Recommended

    Use a mailing tool with double opt-in and automatic unsubscribe. Unsolicited marketing email can lead to fines (GDPR and e-privacy rules) and harms your reputation.

  7. Access to personal data is limited to employees who need it for their job.

    Recommended

    Restrict folders with HR and customer data. Not everyone needs access to salary data or client files — this also limits the damage when an account is hacked.

  8. Data breaches and security incidents are logged internally, even when reporting to the authority is not required.

    Recommended

    Keep a simple data breach register (what, when, impact, measures). This is mandatory under the GDPR — even for breaches you do not have to report.

  9. For processing with a high privacy risk we know whether a privacy assessment (DPIA) is required.

    Recommended

    Large-scale or sensitive processing (e.g. camera surveillance of staff, health data, tracking) often requires a DPIA. Check your data protection authority's list when in doubt.

  10. We know whether personal data is processed outside the EU/EEA and have put appropriate safeguards in place (e.g. standard contractual clauses).

    Important

    Many US cloud vendors process data (partly) outside the EU. Check per vendor where the data resides and whether standard contractual clauses or another valid transfer mechanism has been agreed.

  11. We know how to respond to a data subject request (access, correction or deletion of data) and within which legal deadline.

    Recommended

    A request for access or deletion must usually be answered within a month. Document who handles such a request and where to look to answer it completely.

Where to start

  • Make a simple record of processing. Which personal data do you have, what for, where is it stored and how long do you keep it?
  • Go through your suppliers. Ask every party that processes personal data for the data processing agreement.
  • Write down what you do in case of a breach: who decides, how you report to the Data Protection Authority and when you tell the people affected.
  • Agree how you respond to a request for access, correction or deletion. The legal deadline is one month.

Common mistakes

  • Only recording the breaches you also report. Incidents you don't need to report must still be logged internally.
  • Keeping personal data forever 'just in case'.
  • Not knowing that a US cloud service processes personal data outside the EU, and having no safeguards for it.

Official sources

Read next

All topics in the checklist