GDPR Compliance Data Check — Free Checklist Review Tool

This tool reviews a dataset or project against a short GDPR checklist: lawful basis documented, consent recorded where needed, data minimised to purpose, retention period defined, subject-rights process ready, breach response plan in place, and processors contracted. You answer each item yes, partial, or no, and the tool scores the checklist and lists the gaps. It is labelled guidance, not legal advice: it helps a team spot what is missing before involving a lawyer or data protection officer, and it never certifies compliance. A checklist score is a starting point for a conversation, not a verdict.

How to use it

Work through each checklist item honestly.
Answer yes, partial, or no.
Click Check compliance gaps.
Read the gaps list first — that is the work plan.
Assign each gap an owner and a date.

Worked example

A research team checks its survey dataset and scores 9 of 14: lawful basis and minimisation are solid, consent is partial (recorded for interviews but not for the online form), retention is undefined, and no breach plan exists. The gaps list becomes a concrete to-do list: write the retention rule (delete identifiers after two years), adopt the interview consent form for the online arm, and draft a one-page breach response. Two weeks later the re-check scores 13 of 14, with only the processor contract outstanding — progress a vague feeling of “we should be compliant” could never have produced.

Honest limits

This checklist covers common GDPR themes in simplified form; it does not cover every obligation, every member-state variation, or sector rules such as health-data provisions, and it cannot assess whether a lawful basis is actually valid for your processing — that needs legal judgment. Research exemptions, legitimate interests assessments, and data protection impact assessments each need their own process. If your project handles sensitive categories, large-scale data, or children’s data, involve your data protection officer early, not after the checklist. Nothing on this page creates a lawyer-client relationship or a compliance certification.

Who it is for

This tool is for researchers, small teams, and students handling personal data in a project, and for anyone who wants a structured first pass before a formal review. Use it at project start, when gaps are cheapest to close, and repeat it when the data or purpose changes.

Going further

Treat the checklist as a living document, not a one-time exercise. Purposes drift: a dataset collected for one study gets reused for another, a new processor joins, a retention period expires unnoticed. Re-run the check at each change and keep dated copies, because accountability under GDPR means being able to show what you decided and when, not merely having decided well once. The most valuable habit is the simplest: every time someone proposes a new use of personal data, ask for its lawful basis and its retention rule before the data moves, not after. That question, asked early and every time, prevents most compliance problems this checklist exists to catch. Pay special attention to purpose limitation when reusing data: the lawful basis that covered collection for study A does not automatically cover study B, and “further processing” needs its own assessment of compatibility, especially if the new purpose would surprise the people whose data it is. When in doubt, seek fresh consent or a documented compatibility analysis before reuse, and record the decision. Reuse without that step is one of the most common compliance failures in research, precisely because it feels like efficiency rather than a new processing activity. Special-category data — health, genetics, biometrics, political opinions, and similar — triggers stricter conditions than ordinary personal data, including an additional lawful condition beyond the usual six bases. A checklist that treats all personal data alike will miss this entirely, so flag sensitive categories at project intake and route those projects to specialist review before collection begins. The cost of early review is a meeting; the cost of discovering a special-category problem after collection is a dataset that cannot lawfully be used.

Embed this tool on your website — free

Copy the code below to add this working tool to your own page. A small credit link stays with it — that’s all we ask.