GDPR compliance, in plain English

Recognise that GDPR applies to processing of personal data by automated means, and to structured manual filing systems, with limited exceptions such as purely personal or household use.

Work out whether you are caught by territorial scope: you have an EU establishment, you offer goods or services to people in the EU, or you monitor their behaviour in the EU.

Use the Article 4 definitions consistently, especially personal data, processing, controller, processor, consent, pseudonymisation and personal data breach.

Process personal data lawfully, fairly and transparently.

Collect data for specified, explicit and legitimate purposes and do not reuse it in incompatible ways.

Keep data adequate, relevant and limited to what is necessary (data minimisation).

Keep data accurate and up to date, and correct or erase inaccurate data without delay.

Keep identifiable data no longer than necessary for the purpose (storage limitation).

Protect data with appropriate security, including against unauthorised access, loss or damage (integrity and confidentiality).

Be able to demonstrate compliance with all the principles (accountability).

Rely on at least one lawful basis for each purpose: consent, contract, legal obligation, vital interests, public task or legitimate interests.

If relying on legitimate interests, document a balancing test showing your interest is not overridden by the individual's rights.

Before using data for a new purpose, check compatibility with the original purpose unless you have fresh consent or a legal requirement.

Where you rely on consent, make it freely given, specific, informed and unambiguous, be able to prove it, and make withdrawal as easy as giving it.

For online services offered directly to children, obtain parental authorisation below the age set by the Member State (16 by default, no lower than 13).

Do not process special category data (such as health, biometrics, ethnicity, religion, union membership or sexual orientation) unless an Article 9(2) condition applies in addition to an Article 6 basis.

Process criminal conviction and offence data only under official authority or where law provides appropriate safeguards.

If you do not need to identify individuals, you are not required to collect extra data just to comply, but you must still honour rights where people supply identifying information.

Give information in concise, transparent, intelligible and easily accessible form, using clear plain language, especially for children.

Respond to rights requests without undue delay and within one month, extendable by two further months for complex or numerous requests with notice to the individual.

Provide the information and handle requests free of charge, unless requests are manifestly unfounded or excessive, in which case you may charge a fee or refuse and explain why.

When collecting data directly, provide identity, contact details, purposes, lawful basis, recipients, transfers, retention, rights and complaint route at the time of collection.

When obtaining data from another source, give the same information within a reasonable period and at the latest within one month, plus the source of the data.

Let people confirm whether you process their data, obtain a copy and receive details such as purposes, recipients, retention and source (right of access).

Correct inaccurate personal data and complete incomplete data on request (rectification).

Erase personal data without undue delay where a ground applies, such as data no longer needed, consent withdrawn or unlawful processing, subject to exceptions (right to erasure).

Restrict processing on request while accuracy or an objection is being resolved, or in other listed cases (right to restriction).

Tell each recipient of the data about any rectification, erasure or restriction, unless impossible or disproportionate, and tell the individual about those recipients if asked.

Provide data the person supplied, processed by consent or contract and by automated means, in a structured, commonly used, machine-readable format, and transmit it to another controller where feasible (portability).

Stop processing on objection where based on legitimate interests or public task unless you show compelling grounds, and always stop direct marketing on objection.

Do not subject people to solely automated decisions with legal or similarly significant effects unless an exception applies, and then give safeguards including human review.

Apply any restriction on rights only where Union or Member State law provides for it, and keep a record of reliance.

Implement technical and organisational measures proportionate to risk, and review and update them, to show processing complies.

Build data protection into the design of systems and processes, taking into account state of the art, cost and risk.

By default, process only the personal data necessary for each specific purpose, and do not make data accessible to an indefinite number of people.

Where you decide purposes jointly with another party, set out in a transparent arrangement who does what, particularly for rights and notices, and make the essence available to individuals.

If you are outside the EU but caught by Article 3(2), appoint a representative in the EU unless an exemption applies.

Use only processors who provide sufficient guarantees to meet GDPR and protect rights.

Bind processors by a written contract covering subject matter, duration, nature, data types, instructions, confidentiality, security, sub-processors, assistance, deletion or return, and audits.

Allow sub-processors only with your authorisation and with the same obligations flowed down.

Ensure anyone acting under your authority, including processors, handles personal data only on your instructions unless law requires otherwise.

As a controller, keep a written record of processing with purposes, data categories, recipients, transfers, retention and security measures.

As a processor, keep a record of processing carried out for each controller.

Note that the record exemption for organisations under 250 staff does not apply if processing is not occasional, is risky or includes special category or criminal data.

Cooperate with the supervisory authority on request.

Consider pseudonymisation and encryption of personal data.

Maintain confidentiality, integrity, availability and resilience of systems and services.

Be able to restore availability of and access to data promptly after an incident.

Regularly test, assess and evaluate the effectiveness of security measures.

Ensure staff acting under your authority process data only on your instructions.

Notify the supervisory authority of a breach without undue delay and within 72 hours of becoming aware, unless it is unlikely to result in risk to individuals.

As a processor, tell the controller without undue delay after becoming aware of a breach.

Document every breach, its effects and the action taken, whether or not it is notified.

Tell affected individuals without undue delay where the breach is likely to result in high risk to them, in clear language with advice on what to do.

Carry out a data protection impact assessment before processing that is likely to result in high risk, especially with new technologies.

Always do a DPIA for large-scale profiling with significant effects, large-scale special category or criminal data, and large-scale systematic monitoring of public areas.

Make the DPIA describe the processing, its necessity and proportionality, the risks and the measures to address them.

Consult the supervisory authority before processing if a DPIA shows high residual risk you cannot mitigate.

Designate a DPO if you are a public authority, or your core activities involve large-scale regular and systematic monitoring or large-scale special category or criminal data.

Choose a DPO on professional qualities and expert knowledge, publish their contact details and notify them to the supervisory authority.

Involve the DPO properly and promptly in data protection issues, give them resources and independence, let them report to top management and avoid conflicts of interest.

Ensure the DPO informs and advises, monitors compliance, advises on DPIAs, and cooperates with the regulator as contact point.

Consider adhering to an approved code of conduct or certification scheme as a way to show compliance, noting these do not remove your responsibility.

Make sure any transfer of personal data to a third country or international organisation meets Chapter V conditions so protection is not undermined.

Transfer freely only to countries or sectors covered by a European Commission adequacy decision.

Where no adequacy applies, use appropriate safeguards such as standard contractual clauses or binding corporate rules, with enforceable rights and remedies.

Assess whether the destination country's law lets the safeguards work in practice, and add technical or contractual protections if not.

If using binding corporate rules within a group, obtain approval from the competent authority and meet the required content.

Do not rely on a third-country court or authority order to transfer data unless it rests on an international agreement.

Use derogations such as explicit informed consent, contract necessity or legal claims only for exceptional, limited transfers.

Identify your competent or lead supervisory authority, normally where your main establishment is, if you process across several Member States (one-stop-shop).

Expect the authority to monitor, advise, handle complaints, investigate and promote awareness.

Be ready for investigative powers (audits, access to data and premises), corrective powers (warnings, orders, bans, fines) and advisory powers.

Note that authorities publish annual activity reports, which signal enforcement priorities.

Be aware that authorities cooperate and share decisions in cross-border cases and a consistency mechanism may apply.

Follow guidelines, recommendations and binding decisions of the European Data Protection Board.

Expect individuals to be able to complain to a supervisory authority.

Expect individuals and organisations to be able to seek judicial remedy against authorities and against controllers or processors.

Expect not-for-profit bodies to be able to represent individuals and, in some Member States, bring complaints themselves.

Note that anyone suffering material or non-material damage has a right to compensation and that controllers and processors can be liable, with exemption if not responsible.

Understand the lower tier of fines: up to EUR 10 million or 2 percent of worldwide annual turnover, whichever is higher, for breaches such as security, records, DPIA, DPO and processor obligations.

Understand the higher tier: up to EUR 20 million or 4 percent of worldwide annual turnover, whichever is higher, for breaches of the principles, lawful bases, consent, rights and transfers.

Know that fines take account of seriousness, intent, mitigation, previous breaches, cooperation and the measures you had in place.

Note that Member States may set additional penalties for infringements not subject to fines.

Check national laws balancing data protection with freedom of expression, including journalism.

Check national rules on national identification numbers and on employment data, which may add conditions.

When processing for archiving, research or statistics, apply safeguards such as minimisation and pseudonymisation, noting that national law may limit some rights.

Note that GDPR sits alongside the ePrivacy rules for electronic communications, which add rules on cookies and direct marketing.

Note that the Regulation entered into force on 24 May 2016 and has applied since 25 May 2018.