GDPR Compliance Checklist

Cookie consent obtained before tracking

Non-essential cookies are blocked until the user gives explicit consent

Granular consent choices available

Users can accept or reject individual cookie categories separately

Easy consent withdrawal mechanism

Users can change or withdraw their consent at any time with the same ease as giving it

Privacy policy is published

A privacy policy is publicly accessible on the website

Privacy policy is up-to-date

The policy has been reviewed and updated within the last 12 months

Covers data collection practices

Describes what data is collected, how it is collected, and the purpose

Covers user rights

Clearly explains data subject rights including access, rectification, and erasure

Legal basis documented for all processing

Each data processing activity has an identified lawful basis under GDPR Art. 6

Data minimization practiced

Only data that is strictly necessary for the stated purpose is collected

Data retention limits defined

Clear retention periods are set for each category of personal data

HTTPS enabled across entire site

All pages are served over HTTPS with a valid SSL/TLS certificate

Security headers configured

HTTP security headers like CSP, X-Frame-Options, and HSTS are in place

Breach notification plan exists

A documented procedure for notifying the supervisory authority within 72 hours of a breach

Data access requests handled

A process exists to respond to Subject Access Requests (SARs) within 30 days

Deletion requests supported

Users can request the erasure of their personal data (right to be forgotten)

Data portability enabled

Users can request their data in a commonly used, machine-readable format