Conducting GDPR Compliance Assessment

Effective Date: August 2026
Legal Basis: EU Regulation 2016/679 (GDPR), UK GDPR as amended by Data Protection Act 2018 and Data (Use and Access) Act 2025 (ukpga/2025/18)
Pending Changes: Digital Omnibus proposal (COM(2025) 837) would change Article 30(5) threshold from 250 to 750 employees and Article 33 breach notification from 72h to 96h. Still in proposal stage; current requirements remain in force.

When to Use

• When an organization processes personal data of EU residents (Article 3 territorial scope applies)
• When preparing for a supervisory authority audit (ICO, CNIL, BfDI) or responding to formal inquiry
• When implementing privacy-by-design requirements (Article 25) for new systems or data flows
• When scoping compliance gaps before M&A due diligence or contract negotiations with EU entities
• When responding to data subject access requests (DSARs) and discovering gaps in data inventory
• When assessing third-party processors for GDPR compliance before signing Data Processing Agreements (DPAs)
• After data breach incidents to verify notification procedures meet 72-hour requirement (Article 33)