/conducting-gdpr-compliance-assessment

name: conducting-gdpr-compliance-assessment
description: >-
  Conduct comprehensive GDPR compliance assessments by evaluating data processing
  activities against EU Regulation 2016/679, including Article 30 records of processing,
  lawful basis validation, data subject rights implementation, Data Protection Impact
  Assessments (DPIAs) under Article 35, breach notification procedures, international
  transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures
  under Article 32. Use when processing personal data of EU residents, preparing for
  supervisory authority audits, implementing privacy-by-design for new systems, scoping
  compliance gaps for M&A due diligence, assessing third-party processors, or responding
  to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB,
  and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing
  specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR
  automation — use implementing-gdpr-data-subject-access-request.
domain: cybersecurity
subdomain: compliance-governance
tags:
- gdpr
- data-protection
- privacy
- compliance
- dpia
- data-subject-rights
- article-30
- controller
- processor
- eu-regulation
- ico
- supervisory-authority
version: "1.0"
author: dakshverma23
license: Apache-2.0
nist_csf:
- GV.OC-02
- GV.PO-01
- GV.RM-04
- PR.DS-01
- PR.DS-02
- ID.AM-05
mitre_attack:
- T1530
- T1567

Conducting GDPR Compliance Assessment

> **Effective Date**: August 2026 > **Legal Basis**: EU Regulation 2016/679 (GDPR), UK GDPR as amended by Data Protection Act 2018 and Data (Use and Access) Act 2025 (ukpga/2025/18) > **Pending Changes**: Digital Omnibus proposal (COM(2025) 837) would change Article 30(5) threshold from 250 to 750 employees and Article 33 breach notification from 72h to 96h. Still in proposal stage; current requirements remain in force.

When to Use

• When an organization **processes personal data of EU residents** (Article 3 territorial scope applies)
• When preparing for a **supervisory authority audit** (ICO, CNIL, BfDI) or responding to formal inquiry
• When implementing **privacy-by-design** requirements (Article 25) for new systems or data flows
• When **scoping compliance gaps** before M&A due diligence or contract negotiations with EU entities
• When responding to **data subject access requests (DSARs)** and discovering gaps in data inventory
• When assessing **third-party processors** for GDPR compliance before signing Data Processing Agreements (DPAs)
• After **data breach incidents** to verify notification procedures meet 72-hour requirement (Article 33)

**Do not use** for:

• **Technical implementation** of specific GDPR controls (encryption, pseudonymization, access controls) — use **implementing-gdpr-data-protection-controls** for Article 32 technical/organizational measures
• **Automated DSAR processing workflows** (identity verification, PII discovery, redaction, delivery) — use **implementing-gdpr-data-subject-access-request** for DSAR automation
• Non-EU privacy frameworks alone (CCPA, PIPEDA, LGPD); those require separate assessments with jurisdiction-specific criteria
• This skill is for **comprehensive compliance assessment** across all GDPR articles; use the specialized skills for focused implementation tasks

Prerequisites

• Understanding of GDPR Articles 5-32 and key definitions
• Access to Article 30 records of processing activities
• Data Processing Agreements with third-party processors
• Privacy policies, consent forms, cookie notices
• Knowledge of lawful bases (Article 6)
• Data breach response plan and incident register
• List of international data transfers with safeguards

Workflow

**For detailed procedures, templates, and examples, see `references/detailed-workflow.md`**

Phase 1: Determine Territorial Applicability (Article 3)

GDPR applies if: 1. Organization has establishment in EU 2. Offers goods/services to EU residents 3. Monitors behavior of EU residents

**Check**: EU office? EU website targeting? Behavioral tracking?

Phase 2: Inventory Data Processing Activities (Article 30)

Document for EACH activity:

• Controller/processor details
• Processing purposes (specific)
• Data categories and special categories (Art. 9)
• Recipients and international transfers
• Retention periods
• Security measures

**Tools**: Use `scripts/article30_parser.py`, `article30_validator.py`, `generate_ropa_report.py`

**Common gaps**: Missing retention periods (68%), vague purposes, undocumented transfers

Phase 3: Validate Lawful Basis (Article 6)

| Basis | Use Case | Key Requirement | |-------|----------|-----------------| | **Consent** (6(1)(a)) | Marketing, profiling | Freely given, specific, withdrawable | | **Contract** (6(1)(b)) | Order fulfillment | Strictly necessary only | | **Legal Obligation** (6(1)(c)) | Tax records | Cite specific law | | **Legitimate Interest** (6(1)(f)) | Fraud prevention, analytics | Three-part test + balancing |

**Action**: Map each Article 30 activity to one lawful basis. Document legitimate interest assessments.

Phase 4: Assess Data Subject Rights (Articles 12-23)

Verify capability for:

• **Access** (15): Provide copy in machine-readable format within 1 month
• **Rectification** (16): Correct inaccurate data
• **Erasure** (17): "Right to be forgotten" (with exceptions)
• **Portability** (20): Transfer data in structured format
• **Objection** (21): Opt-out of legitimate interest processing
• **Automated Decision-Making** (22): Human review of algorithmic decisions

**Test**: Process sample DSAR through full workflow. Use `scripts/` for automation.

Phase 5: Review DPIAs (Article 35)

DPIA **mandatory** for:

• Large-scale profiling with automated decisions
• Large-scale special categories processing
• Systematic monitoring of public areas (facial recognition)

**Template**: See `references/detailed-workflow.md` for