GDPR Tabletop Audit
Critical Business Imperative for EU Market Access
For any company selling products or services into the European Union, GDPR represents one of the most significant compliance obligations of the digital age. A tabletop audit can mean the difference between confident compliance and catastrophic penalties.
Instant Results
No waiting
15 Minutes
Quick assessment
Comprehensive
Full GDPR coverage
Risk Assessment
Know your exposure
The High Stakes of GDPR Non-Compliance
Fines can reach up to €20 million or 4% of global annual turnover (whichever is higher):
- •Market Exclusion: Non-compliant companies can be prohibited from processing EU personal data
- •Reputational Damage: GDPR violations are public record, devastating brand trust
- •Operational Disruption: Enforcement can require fundamental business restructuring
- •Competitive Disadvantage: Compliant competitors capture market share while you remediate
- •Legal Cascades: Violations often trigger civil litigation and other investigations
Major companies have faced fines exceeding €100 million, with Amazon's €746 million penalty serving as a stark reminder.
The EU Market Imperative
440M+
EU Consumers
€15T+
Combined GDP
73%
Aware of GDPR Rights
Consumer Awareness is High:
- 60% have exercised at least one GDPR right
- 89% prefer to buy from companies they trust with their data
- Data protection practices increasingly influence purchasing decisions
Comprehensive GDPR Compliance Assessment
Lawful Basis & Transparency (Articles 5-7, 12-14)
Lawful Basis for Processing
- Have we identified and documented the lawful basis for each processing activity?
- Are we relying on the correct lawful basis (consent, contract, legal obligation, vital interests, public task, legitimate interests)?
- For legitimate interests, have we completed and documented Legitimate Interests Assessments (LIAs)?
- Can we demonstrate that processing is necessary for the stated purpose?
- Have we reviewed whether we're processing special category data?
Privacy Notices
- Are privacy notices provided at the point of data collection?
- Do privacy notices contain all required information under Articles 13-14?
- Are they written in clear, plain language?
- Are privacy notices easily accessible and prominently displayed?
- Do we have age-appropriate notices for children?
- Are privacy notices available in appropriate languages?
- When were privacy notices last reviewed and updated?
Consent Management
- If relying on consent, is it freely given, specific, informed, and unambiguous?
- Can we demonstrate when and how consent was obtained?
- Is there a clear mechanism to withdraw consent?
- Is withdrawal as easy as giving consent?
- Do we refresh consent at appropriate intervals?
- Are consent records maintained and auditable?
Data Subject Rights (Articles 15-22)
Rights Procedures
- Do we have documented procedures for each data subject right?
- Can we respond to requests within one month?
- How do we verify the identity of data subjects?
- Is there a system to track and manage requests?
- Are staff trained on handling rights requests?
Right of Access (Article 15)
- Can we provide individuals with their personal data promptly?
- Do we provide all required supplementary information?
- Can we deliver data in a commonly used electronic format?
- Do we have exemptions documented and justified?
Right to Rectification (Article 16)
- Can we correct inaccurate data across all systems?
- Do we notify third parties of rectifications?
- Is there an audit trail of changes?
Right to Erasure (Article 17)
- Do we have a process for 'right to be forgotten' requests?
- Can we delete data from all systems, including backups?
- Have we identified situations where erasure doesn't apply?
- Do we inform recipients about erasure requests?
Right to Restriction (Article 18)
- Can we restrict processing while disputes are resolved?
- How do we mark restricted data?
- Can we ensure restricted data isn't processed?
Right to Portability (Article 20)
- Can we provide data in a structured, machine-readable format?
- Can we transmit data directly to another controller?
- Do we understand when portability applies?
Right to Object (Article 21)
- Do we have processes for handling objections?
- For direct marketing, can we stop processing immediately?
- Have we identified compelling legitimate grounds that might override objections?
Automated Decision-Making (Article 22)
- Do we use automated decision-making or profiling?
- Have we implemented suitable safeguards?
- Can individuals request human intervention?
- Is the logic involved explained clearly?
Data Protection by Design & Default (Article 25)
Privacy by Design
- Is data protection considered at the design stage of new projects?
- Do we conduct Data Protection Impact Assessments (DPIAs) when required?
- Are privacy-enhancing technologies implemented?
- Is data minimization built into our processes?
Privacy by Default
- Do systems collect only necessary data by default?
- Is access restricted by default to those who need it?
- Are retention periods enforced automatically?
- Are the strongest privacy settings the default?
Records of Processing Activities (Article 30)
Documentation Requirements
- Do we maintain comprehensive records of processing activities?
- Are both controller and processor records maintained where applicable?
- Do records include all required information?
- Are records updated when processing changes?
- Can records be provided to supervisory authorities promptly?
Processing Inventory
- Have all processing activities been identified?
- Are purposes of processing clearly defined?
- Are categories of data subjects and personal data documented?
- Are recipients and transfers documented?
- Are retention periods specified?
- Are security measures described?
Security of Processing (Article 32)
Technical Measures
- Is encryption implemented for data at rest and in transit?
- Is pseudonymization used where appropriate?
- Are systems resilient and available?
- Do we have regular security testing and assessment?
- Is there network segmentation and access control?
Organizational Measures
- Are security policies documented and current?
- Is there regular security awareness training?
- Are incident response procedures in place?
- Do we have business continuity and disaster recovery plans?
- Are security measures regularly reviewed and updated?
Access Controls
- Is access based on need-to-know principles?
- Are strong authentication methods used?
- Is privileged access monitored and controlled?
- Are access rights regularly reviewed and updated?
- Is there logging and monitoring of access?
Data Breach Management (Articles 33-34)
Breach Detection
- Can we detect breaches promptly?
- Are monitoring and alerting systems in place?
- Do staff know how to recognize and report breaches?
- Is there 24/7 breach detection capability?
Breach Response
- Can we notify the supervisory authority within 72 hours?
- Do we have template notification forms ready?
- Can we assess risk to individuals' rights and freedoms?
- Is there a process for notifying affected individuals?
- Do we maintain a breach register?
- Are lessons learned incorporated into improvements?
Breach Documentation
- Do we document all breaches, even if not notifiable?
- Are breach investigations thorough and documented?
- Can we demonstrate compliance with notification timelines?
- Are remediation actions tracked to completion?
International Transfers (Articles 44-49)
Transfer Mechanisms
- Have all international transfers been identified?
- What transfer mechanisms are we using (adequacy decisions, SCCs, BCRs)?
- Are Standard Contractual Clauses (SCCs) up to date?
- Have we conducted Transfer Impact Assessments (TIAs)?
- Are supplementary measures implemented where needed?
Documentation
- Are all international transfers documented?
- Do we maintain executed agreements for transfers?
- Have we informed data subjects about transfers?
- Can we demonstrate appropriate safeguards?
Data Protection Officer (Articles 37-39)
DPO Appointment
- Have we determined if a DPO is required?
- If required, has a DPO been appointed?
- Does the DPO have appropriate expertise and resources?
- Is the DPO independent and free from conflicts?
- Are DPO contact details published and provided to the supervisory authority?
DPO Function
- Does the DPO have access to senior management?
- Is the DPO involved in all data protection matters?
- Can the DPO perform duties without instruction?
- Does the DPO have sufficient time and resources?
- Is there evidence of DPO activities and advice?
Accountability & Governance (Article 5(2))
Compliance Framework
- Is there a comprehensive GDPR compliance program?
- Are roles and responsibilities clearly defined?
- Is there regular reporting to senior management?
- Do we conduct regular compliance assessments?
- Is there a privacy governance committee?
Training & Awareness
- Is GDPR training mandatory for all staff?
- Is training role-specific and regular?
- Are training records maintained?
- Is there awareness of data protection responsibilities?
- Do contractors and temporary staff receive training?
Vendor Management
- Do we have data processing agreements with all processors?
- Are processors assessed for GDPR compliance?
- Do agreements include all required clauses?
- Is there ongoing monitoring of processor compliance?
- Are sub-processors properly authorized and documented?
Special Categories & Situations
Special Category Data (Article 9)
- Have we identified all special category data processing?
- Do we have explicit consent or another Article 9 condition?
- Are additional safeguards implemented?
- Is processing minimized and necessary?
Children's Data (Article 8)
- Do we process children's data?
- Are age verification mechanisms in place?
- Do we obtain parental consent where required?
- Are communications age-appropriate?
- Can parents exercise rights on behalf of children?
Employment Data
- Is there a lawful basis for employee data processing?
- Are employee privacy notices comprehensive?
- Do we respect employee rights?
- Is employee monitoring proportionate and transparent?
- Are works council requirements met (where applicable)?
Marketing & Cookies
- Do we comply with ePrivacy requirements?
- Is there valid consent for cookies?
- Can individuals easily opt-out of marketing?
- Are suppression lists maintained and respected?
- Do we respect 'do not track' signals?
Gap Analysis Framework
For Each Identified Gap
- 1.Article Reference: Specific GDPR article affected
- 2.Risk Level: High/Medium/Low based on potential fine and harm
- 3.Current State: What exists today
- 4.Required State: What GDPR requires
- 5.Gap Description: Specific deficiency
- 6.Remediation Plan: Steps to achieve compliance
- 7.Owner: Responsible party
- 8.Timeline: Target completion date
- 9.Evidence Required: How to demonstrate compliance
- 10.Estimated Cost: Resources required
Priority Quick Checks
- Can we demonstrate lawful basis for all processing?
- Can we respond to a data subject request today?
- Would we detect and report a breach within 72 hours?
- Are international transfers properly safeguarded?
- Is special category data properly protected?
Key Performance Indicators
- Average response time for data subject requests
- Percentage of requests completed within deadline
- Number of breaches and time to detection/notification
- Training completion rates
- Number of complaints to supervisory authority
- Results of compliance assessments
Common Audit Findings
- Incomplete or outdated privacy notices
- Inability to fulfill data subject requests completely
- Lack of vendor/processor agreements
- No breach detection or response procedures
- Missing or incomplete Records of Processing Activities
- Inadequate consent mechanisms
- No DPIA process for high-risk processing
Beyond Compliance: Competitive Advantage
Trust Differentiation
Demonstrated data protection capability becomes a competitive differentiator in EU markets
Operational Excellence
GDPR-compliant processes often improve overall operational efficiency
Innovation Enablement
Strong data governance frameworks facilitate responsible innovation with data
Partnership Opportunities
GDPR compliance opens doors to partnerships with EU entities
Ready to Ensure GDPR Compliance?
Our 35+ years successfully running IT and security for businesses includes helping organizations achieve and maintain GDPR compliance for EU market access. Don't wait for enforcement to discover gaps.
Get Expert GDPR AssessmentGet Your GDPR Readiness Assessment
Contact us for a comprehensive evaluation of your GDPR compliance and EU market readiness.
Talk to Craig About GDPR Readiness
Contact us for an evaluation of your GDPR compliance and EU market readiness.
Call (•••) •••-••••
(•••) •••-••••
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.