Compliancemanzill.com
EU GDPR

Compliance assessment

EU GDPR

107 controls in 5 families. Read each control, mark it Met, Partially Met or Not Met, and keep evidence alongside. Your score is saved as you go, so you can pick up where you left off.

Start at 5.1.a

Principles18

5.1.aLawfulness, Fairness, and TransparencyNot assessed5.1.bPurpose LimitationNot assessed5.1.cPersonal Data MinimizationNot assessed5.1.dAccuracy of Personal DataNot assessed5.1.eDeidentification of Personal DataNot assessed5.1.fIntegrity and Confidentiality of Personal DataNot assessed5.2AccountabilityNot assessed6.1Lawfulness of Personal Data ProcessingNot assessed6.4Personal Data Used for Other PurposesNot assessed7.1Proof of ConsentNot assessed7.2Valid ConsentNot assessed7.3Mechanism to Withdraw ConsentNot assessed7.4Assessment of ConsentNot assessed8.1Conditions for Child Data ProcessingNot assessed8.2Verification of Consent by GuardianNot assessed9.1Protection of Sensitive Personal DataNot assessed10.1Processing of Personal Data Relating to Criminal ConvictionsNot assessed11Processing that does not require identificationNot assessed

Rights of the Data Subject34

12.1TransparencyNot assessed12.2Right to Refuse Data Subject RequestsNot assessed12.3Handling Data Subject RequestsNot assessed12.4Notification for Request RefusalNot assessed12.6Personal Identity VerificationNot assessed12.7Implement readable format for data subjectsNot assessed13.1Information Obligation - Collection PurposeNot assessed13.2Information Obligation - Fair and Transparent ProcessingNot assessed13.3Information Obligation - Processing for Other PurposeNot assessed14.1Information Obligation - Personal Data Obtained from Third PartiesNot assessed14.2Information Obligation - Fair and Transparent ProcessingNot assessed14.3Time of InformationNot assessed14.4Information Obligation - Processing for Other PurposeNot assessed15.1Information Obligation - Data Subject RightsNot assessed15.2Information Obligation - International TransferNot assessed15.3Obligation to Provide Copy of Personal DataNot assessed16Right to RectificationNot assessed17.1Right to ErasureNot assessed17.2Obligation to Erase Personal DataNot assessed18.1Right to Restrict ProcessingNot assessed18.2Restriction of ProcessingNot assessed18.3Notification for Restriction LiftNot assessed19Notification for Rectification, Erasure, and RestrictionNot assessed20.1Right to Data PortabilityNot assessed21.1Right to ObjectNot assessed21.2Right to Object to Direct MarketingNot assessed21.3Termination of ProcessingNot assessed21.4Rights of Data Subject Displayed in Plain LanguageNot assessed21.6Right to Object Processing for Scientific, Historical Research or Statistical PurposesNot assessed22.1Right to not be Subject to Automated Decision-MakingNot assessed22.2Exceptions to Automated Decision-MakingNot assessed22.3Protection of Data Subject Rights and InterestsNot assessed22.4Special CategoriesNot assessed12.5FeesNot assessed

Controller and Processor45

24.1Responsibility and Liability of the ControllerNot assessed24.2Implementation of Data Protection PoliciesNot assessed24.3Compliance Obligations for ControllersNot assessed25.1Data Protection by Design and Default by DesignNot assessed25.2Data Protection by Design and Default by Design - Technical and Organizational MeasuresNot assessed26.1Joint ControllersNot assessed26.2Allocation of Responsibilities for Joint ControllersNot assessed26.3Data Subject Rights Under Joint ControllersNot assessed27.1Designation of a RepresentativeNot assessed28.1Use of ProcessorsNot assessed28.2Authorization for the Engagement of Other ProcessorsNot assessed28.3Requirements for ProcessorsNot assessed28.4Requirements for the Engagement of Other ProcessorsNot assessed28.5Compliance with Organizational RequirementsNot assessed28.9AgreementsNot assessed29Restrictions for the Processing of Personal DataNot assessed30.1Records of Processing ActivitiesNot assessed30.2Records ManagementNot assessed30.3Written or Electronic RecordsNot assessed32.1Security of Processing - Technical and Organizational MeasuresNot assessed32.2Privacy Risk EvaluationNot assessed32.4Authorization from the Controller to Process Personal DataNot assessed33.1Breach Notification - ControllersNot assessed33.2Breach Notification - ProcessorsNot assessed33.3Supervisory Authority Breach Notification RequirementsNot assessed33.5Breach RecordsNot assessed34.1Breach Notification to Data SubjectNot assessed34.2Data Subject Breach Notification RequirementsNot assessed35.1Data Protection Impact AssessmentNot assessed35.2Consultation of the Data Protection OfficerNot assessed35.3Necessity of a Data Protection Impact AssessmentNot assessed35.7Requirements for Data Protection Impact AssessmentsNot assessed35.9Consultatation of Data SubjectsNot assessed35.11Reassessment for Changes in RiskNot assessed36.1Consultation of the Supervisory AuthorityNot assessed36.3Information to be Provided to Supervisory AuthorityNot assessed37.1Data Protection OfficerNot assessed37.5Qualifications of the Data Protection OfficerNot assessed37.7Availability of Contact DetailsNot assessed38.1Involvement of the Data Protection OfficerNot assessed38.2Support for the Data Protection OfficerNot assessed38.4Contact Details for Data SubjectsNot assessed38.5Secrecy ObligationNot assessed39.1Tasks of the Data Protection OfficerNot assessed39.2Considerations for the Data Protection OfficerNot assessed

Transfers of Personal Data to Third Countries or International Organizations9

44.1General Principles for International Data TransfersNot assessed45.1Appropriate Level of Data Protection Based on AdequacyNot assessed46.1Safeguarding Personal Data TransfersNot assessed46.2Appropriate SafeguardsNot assessed46.3Standard Data Protection ClausesNot assessed47Binding Corporate RulesNot assessed47.2Additional Requirements for Binding Corporate RulesNot assessed48.1Agreements for Third CountriesNot assessed49.1Exceptions for Certain Cases of International TransfersNot assessed

Provisions Relating to Specific Processing Situations1

89.1Data Processing for Archiving Purposes in the Public Interest, Scientific, Historical Research or Statistical PurposesNot assessed