Work through the General Data Protection Regulation with a guided checklist of 36 controls, each quoting the Article it comes from. Decide what applies to you, and keep the record of that decision.
The General Data Protection Regulation (GDPR) is the EU's comprehensive data protection law that came into effect on May 25, 2018. It applies to any organization that processes personal data of EU residents, regardless of where the organization is located.
GDPR establishes strict rules for data collection, processing, storage, and transfer. It gives individuals unprecedented control over their personal data through rights like access, rectification, erasure ("right to be forgotten"), and data portability.
Comparing regulations: Unlike CCPA's opt-out model, GDPR requires explicit consent upfront. While India's DPDP Act takes a simpler consent-based approach, GDPR's 99 articles provide the most comprehensive framework. Learn how Saudi Arabia's PDPL mirrors many GDPR principles.
Understanding the most critical articles of the regulation. Whether each applies to your organisation is your determination to make.
Lawfulness of Processing
Establish legal basis for data processing
Information to Data Subjects
Provide transparent privacy notices
Data Subject Rights
Enable access, rectification, erasure, and portability
Data Protection by Design
Implement privacy-first architecture
Records of Processing (ROPA)
Document all data processing activities
Security of Processing
Implement technical and organizational measures
Breach Notification
72-hour notification to authorities
Data Protection Impact Assessment
Assess high-risk processing activities
Essential components of a compliant GDPR program
Comprehensive privacy notice covering all Article 13/14 requirements
Appoint DPO or use Virtual DPO for guidance
Obtain, record, and manage user consent properly
Automated DSAR handling for access, deletion, and portability
72-hour notification procedures and incident management
DPAs with all third-party processors
Non-compliance can result in substantial financial penalties
Up to €10 million or 2% of annual turnover
Violations: Articles 8, 11, 25-39, 42, 43
Up to €20 million or 4% of annual turnover
Violations: Articles 5, 6, 7, 9 (most serious violations)
Notable Fines: Amazon (€746M), WhatsApp (€225M), Google (€90M), Meta (€405M)
Everything you need in one platform
Get instant guidance on any GDPR article. Our AI-powered Virtual DPO provides Article-specific advice, implementation steps, and best practices—available 24/7.
Build your Record of Processing Activities (ROPA) with guided templates. Document data categories, lawful basis, retention periods, and third-party processors.
Handle data subject access requests (DSARs) automatically. Public portal, email verification, 1-month deadline tracking, and secure data package delivery.
Track data breaches with 72-hour deadline monitoring. Generate notification templates for supervisory authorities and affected data subjects.
Quick reference guide to understand key differences across regulations
Understand how different data protection laws compare and overlap
California Consumer Privacy Act - Focus on data sales & consumer opt-out rights
Key Focus: Master do not sell requirements & 45-day response deadlines
India Digital Personal Data Protection Act - Consent-based framework
Key Focus: Understand data fiduciary obligations & Data Protection Board
Saudi Arabia Personal Data Protection Law - SDAIA requirements
Key Focus: Navigate SDAIA registration & cross-border transfers
Start with our free plan.
ReadyGDPR is software, not an appointed Data Protection Officer. If Article 37 requires you to appoint one, ReadyGDPR helps them do the job — it doesn’t replace them.
ReadyGDPR is a guided compliance tool, not a certifying authority, and is not a law firm. The regulatory text quoted here is provided for reference; whether it applies to your organisation is your determination. Nothing here is legal advice.