GDPR

Introduction: The General Data Protection Regulation (GDPR)

The General Data Protection Regulation (Regulation (EU) 2016/679) is the European Union's flagship data protection law. Adopted on 27 April 2016 and enforceable from 25 May 2018, it repealed the earlier Data Protection Directive 95/46/EC and established a single, directly-applicable regime across all EU and EEA member states. Unlike a directive, a regulation does not require national transposition: its articles apply of their own force, giving organisations one harmonised rulebook rather than 27 divergent national laws. For any organisation that touches the personal data of individuals in the EU or EEA, GDPR is the benchmark against which privacy maturity, lawful processing and accountability are judged.

This guide is an auditor-grade deep-dive written for privacy officers, Data Protection Officers (DPOs), CISOs, legal counsel and compliance teams who must scope, implement, assess and evidence GDPR conformity. It walks through the full text architecture (11 chapters, 99 articles, 173 recitals), the seven data-protection principles, the data-subject rights, the accountability obligations of controllers and processors, cross-border transfer mechanisms, breach-notification duties, and the supervisory-authority enforcement model. Throughout, the emphasis is on what an assessor actually verifies and the evidence they expect to see.

What is GDPR?

GDPR is a comprehensive, principles-based and risk-based data protection law. It regulates the processing of personal data — any information relating to an identified or identifiable natural person (the 'data subject') — by 'controllers' (who determine the purposes and means of processing) and 'processors' (who process on a controller's behalf). Processing is defined extremely broadly and includes collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, restriction, erasure and destruction — whether automated or manual within a filing system.

The regulation rests on the principle of accountability: it is not enough to comply, an organisation must be able to demonstrate compliance. It grants individuals a robust set of enforceable rights, imposes strict conditions on consent, mandates data protection by design and by default, requires records of processing activities, obliges Data Protection Impact Assessments for high-risk processing, and enforces a 72-hour breach-notification clock. Enforcement is backed by administrative fines of up to EUR 20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher.

Key concepts and definitions (Article 4)

Who must comply with GDPR?

GDPR has a deliberately wide territorial scope defined by Article 3. It applies far beyond the EU's borders, capturing organisations anywhere in the world that target or monitor individuals in the Union. Understanding the three triggering tests below is the first scoping decision every organisation must make.

Roles that attract specific obligations

• Controllers — bear primary accountability for lawful processing, transparency, rights fulfilment and security.
• Processors — have direct statutory obligations (records, security, breach notification to the controller, sub-processor controls) under Article 28 and Article 32.
• Joint controllers — must define respective responsibilities via a transparent arrangement (Article 26).
• Non-EU organisations caught by Article 3(2) — must designate an EU representative (Article 27) unless an exemption applies.
• Organisations whose core activities involve large-scale monitoring or large-scale special-category processing — must appoint a Data Protection Officer (Article 37).

Structure of GDPR: chapters, principles and control domains

The regulation comprises 99 articles grouped into 11 chapters, supported by 173 recitals that aid interpretation. For assessment purposes it is helpful to view GDPR as a set of control domains that map onto the chapters and the seven principles. The table below summarises the architecture an assessor navigates.

The seven data-protection principles (Article 5)

Master assessment checklist

This is the core of the guide. It enumerates every GDPR control domain that an auditor must examine, grouped by theme. For each group, the table sets out precisely what to verify and the typical evidence an assessor expects. Do not treat any group as optional — a defensible GDPR assessment must cover all of them.

1. Lawful basis and the principles (Articles 5–6)

2. Consent (Article 7) and children's consent (Article 8)

3. Special-category and criminal-conviction data (Articles 9–10)

4. Transparency and privacy information (Articles 12–14)

5. Data-subject rights (Articles 15–22)

6. Accountability and governance (Articles 24–25, 30)

7. Joint controllers and representatives (Articles 26–27)

8. Processor management (Article 28)

9. Security of processing (Article 32)

10. Personal data breaches (Articles 33–34)

11. Data Protection Impact Assessment and prior consultation (Articles 35–36)

12. Data Protection Officer (Articles 37–39)

13. International transfers (Articles 44–50)

14. Codes of conduct, certification and cooperation (Articles 40–43, 60–76)

15. Enforcement readiness (Articles 77–84)

Scoping a GDPR assessment

Scoping determines the boundary of the assessment and prevents both under-coverage (regulatory exposure) and over-coverage (wasted effort). A rigorous GDPR scope answers: which entities, which processing activities, which data categories, which systems and which geographies fall within the regulation, and in what role the organisation acts.

1. Confirm territorial applicability against Article 3 (establishment, offering, monitoring) for each business line.
2. Determine the organisation's role per processing activity — controller, joint controller or processor — as this drives obligations.
3. Inventory all processing activities and build or refresh the Record of Processing Activities as the scoping backbone.
4. Classify data categories, flagging special-category and criminal-conviction data for heightened treatment.
5. Map data flows end-to-end, including sub-processors and international transfers, to reveal hidden scope.
6. Identify the lead supervisory authority and main establishment for cross-border processing.
7. Define the systems, applications and physical locations in scope, plus third parties and cloud services.
8. Document exclusions and their justification (e.g. household exemption, purely non-EU activity) for auditability.

Implementation approach: a phased programme

GDPR conformity is best delivered as a structured programme rather than a one-off remediation. The following five-phase approach sequences activities from discovery to sustained operation, with clear deliverables at each gate.

Phase 1 — Discovery and data mapping

• Activities: stakeholder interviews, data-flow mapping, system inventory, role determination, initial applicability analysis.
• Deliverables: Record of Processing Activities, data-flow diagrams, data-inventory catalogue, applicability memo.

Phase 2 — Gap assessment

• Activities: assess each control domain against the master checklist, review policies, contracts, notices and security measures, rate maturity.
• Deliverables: gap-analysis report, risk register, prioritised remediation roadmap, maturity baseline.

Phase 3 — Remediation and design

• Activities: draft/refresh policies and privacy notices, implement consent and rights workflows, remediate DPAs and transfer mechanisms, embed DPbDD, deploy security controls.
• Deliverables: policy suite, DSAR procedure, DPA templates, SCC/TIA package, DPbDD gate, updated notices.

Phase 4 — Operationalisation

• Activities: appoint/confirm DPO, roll out training and awareness, stand up breach-response and DPIA processes, implement retention automation.
• Deliverables: DPO appointment, training records, breach-response playbook, DPIA methodology, retention schedule live.

Phase 5 — Monitoring, audit and continuous improvement

• Activities: internal audits, KPI reporting, vendor re-assessments, management review, horizon-scanning for EDPB guidance and case law.
• Deliverables: audit reports, KPI dashboard, management-review minutes, updated risk register, improvement backlog.

Maturity and capability model

GDPR does not prescribe a maturity model, but a capability model is invaluable for benchmarking progress and communicating with the board. The five-level model below is aligned to common privacy-maturity frameworks and lets an assessor score each control domain consistently.

Assessment and audit approach

A defensible GDPR audit follows a repeatable methodology so that findings are evidence-based, consistent and reproducible. The following steps describe how CyberSigma conducts a GDPR assessment engagement.

1. Define objectives, scope and success criteria with the sponsor; confirm role, entities and geographies in scope.
2. Assemble and review documentation: RoPA, policies, notices, DPAs, DPIAs, breach log, training records, transfer mechanisms.
3. Conduct stakeholder interviews across legal, security, HR, marketing, IT and product to validate documented practice.
4. Walk through data flows and test controls end-to-end, including a sample DSAR and a tabletop breach exercise.
5. Assess each master-checklist domain, scoring maturity and identifying gaps against the regulation and EDPB guidance.
6. Perform targeted technical validation: access controls, encryption, retention enforcement, cookie/consent behaviour, transfer safeguards.
7. Rate risks by likelihood and impact, considering data volume, sensitivity and number of data subjects affected.
8. Produce a findings report with prioritised, actionable remediation and a maturity baseline.
9. Present to management, agree remediation ownership and timelines, and schedule re-assessment.

Evidence request list

The following categorised evidence list is what an assessor typically requests at the outset of a GDPR engagement. Providing it upfront accelerates the assessment and demonstrates accountability.

• Governance: data protection policy suite, DPO appointment and job description, governance/steering committee minutes, accountability framework.
• Processing records: Record of Processing Activities (controller and processor), data-flow diagrams, data inventory/classification.
• Lawful basis and consent: lawful-basis register, Legitimate Interests Assessments, consent-capture screenshots and CMP logs, withdrawal flows.
• Transparency: layered privacy notices, cookie policy, just-in-time notices, employee/HR privacy notice.
• Data-subject rights: DSAR procedure, request log with SLA tracking, sample fulfilled requests, identity-verification approach.
• Third parties: Data Processing Agreements, sub-processor list, vendor security assessments, audit rights evidence.
• International transfers: transfer register, Standard Contractual Clauses, BCRs, Transfer Impact Assessments, supplementary measures.
• Security: risk assessments, ISMS/ISO 27001 documentation, encryption standards, access-control policy, penetration-test reports, backup/restore tests.
• Breach management: breach register, breach-response playbook, SA and data-subject notification templates and records.
• Impact assessments: DPIA register, completed DPIAs, DPIA methodology, prior-consultation correspondence.
• Training and awareness: training materials, completion records, phishing/awareness campaign results.
• Retention: retention schedule, deletion/anonymisation logs, storage-limitation enforcement evidence.

Roles and responsibilities

KPIs to track

• Percentage of processing activities recorded in the RoPA with a valid lawful basis.
• Data-subject requests received, and percentage fulfilled within the statutory one-month deadline.
• Number of personal data breaches, and percentage notified to the SA within 72 hours where required.
• Number of DPIAs completed for high-risk processing versus triggers identified.
• Percentage of processors under a compliant DPA, and vendor re-assessment coverage.
• Percentage of international data flows covered by a valid transfer mechanism and current TIA.
• Staff training completion rate and time-to-completion for new joiners.
• Consent withdrawal and marketing-objection processing time and success rate.
• Percentage of systems meeting retention-schedule enforcement.
• Open privacy findings by risk rating and mean time to remediation.
• Number of complaints to the organisation and to supervisory authorities.
• Privacy-programme maturity score per control domain over time.

Readiness checklist

• Territorial applicability and organisational role confirmed for every processing activity.
• Record of Processing Activities complete, current and covers controller and processor roles.
• Every processing activity has a documented lawful basis (with LIAs where relevant).
• Privacy notices contain all Article 13/14 content and are provided at the right time.
• Consent is captured with clear affirmative action and withdrawal is honoured.
• Special-category and criminal-conviction data meet Article 9/10 conditions.
• A documented DSAR procedure fulfils all rights within one month.
• Data protection by design and by default is embedded in projects.
• All processors are engaged under compliant Article 28 DPAs with sub-processor controls.
• Article 32 security measures are implemented, tested and appropriate to risk.
• A breach-response plan meets the 72-hour SA notification clock and covers subject communication.
• DPIAs are performed for high-risk processing with DPO involvement.
• A DPO is appointed where required, independent, resourced and published.
• International transfers rely on adequacy, SCCs/BCRs and a Transfer Impact Assessment.
• An EU representative is designated where Article 27 applies.
• Retention schedules are enforced and data is deleted/anonymised when no longer needed.
• Staff training and awareness are current and evidenced.
• Internal audit, KPI reporting and management review are operating.

Common gaps

• Incomplete or stale RoPA that misses HR, marketing, CCTV and shadow-IT processing.
• Reliance on consent where another lawful basis is more appropriate, or invalid pre-ticked/bundled consent.
• Missing or generic Legitimate Interests Assessments that lack a genuine balancing test.
• Privacy notices omitting retention periods, transfer details or the lawful basis.
• DSAR processes that exceed the one-month deadline or fail to propagate erasure to third parties.
• Vendor contracts lacking full Article 28(3) clauses or unmanaged sub-processors.
• International transfers without SCCs, BCRs or a post-Schrems II Transfer Impact Assessment.
• Breach processes that cannot demonstrably meet the 72-hour notification window.
• High-risk processing (profiling, biometrics, monitoring) launched without a DPIA.
• No enforced retention schedule, leading to indefinite storage in breach of storage limitation.
• Cookies and web trackers deployed before consent, contrary to ePrivacy and GDPR consent standards.
• Automated decision-making lacking Article 22 safeguards (human intervention, explanation, contest).

GDPR mapped to other frameworks

GDPR obligations overlap substantially with other privacy and security frameworks. Mapping controls lets organisations reuse evidence and avoid duplicated effort across audits. The table below indicates representative alignments — not one-to-one equivalences.

Frequently asked questions

Need help with GDPR?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.