Privacy Regulation
GDPR Compliance Checklist for Web Applications
A practical checklist for mapping personal data in web applications, establishing lawful bases, honoring data-subject rights, and preparing internal GDPR readiness reviews.
- Estimated time
- 2–4 Months
- Audience
- Product, Engineering, and Legal Teams Building Web Apps
- Last updated
Operational reference guide for internal GDPR readiness. It does not replace formal legal counsel or supervisory-authority guidance for your specific processing.
Progress is saved in this browser only. Nothing is sent to a server.
Phase 1: Inventory, Roles & Lawful Basis
Phase 2: Transparency, Consent & User Rights
Phase 3: Security, Processors & Transfers
Phase 4: DPIA, Governance & Product Design
Phase 5: Incidents & Ongoing Accountability
FAQ
Does GDPR apply if we are not established in the EU?+–
It can. Article 3 territorial scope may apply when you offer goods or services to people in the EEA or monitor their behavior, even if the company is based elsewhere.
Is a DPO always required?+–
A DPO is required in the cases set out in Article 37 (public authority, large-scale regular monitoring, or large-scale special-category processing). Many teams still appoint a privacy lead for accountability.
Are standard contractual clauses enough for US vendors?+–
SCCs are a transfer tool, not a complete assessment. Teams typically also complete a transfer impact assessment and review the vendor’s security and government-access posture.
What is the deadline for a data-subject request?+–
Controllers should respond without undue delay and at the latest within one month, extendable by two further months for complex or numerous requests, with notice to the requester.
Does this checklist certify GDPR compliance?+–
No. GDPR compliance is context-specific. This checklist is an internal operational aid; legal interpretation and supervisory-authority engagement require qualified counsel.
Related field notes
The checklists and field notes provided on this website are for educational and informational purposes only. They do not constitute legal, financial, or professional advice. Completing a checklist does not guarantee compliance, certification, or immunity from audits. Always consult with a certified auditor or legal counsel for your specific organizational needs. Full disclaimer