GDPR Compliance Checklist & Self-Assessment

GDPR compliance self-assessment: find your gaps before a regulator or client does

Answer plain-language questions about how you actually handle personal data and get a GDPR readiness score, a gap analysis by requirement area and prioritised recommendations, free and in 10–15 minutes.

10–15 minutes

No account needed

Data stored in the EU

Readiness score + gap report

What is the GDPR?

The General Data Protection Regulation (Regulation (EU) 2016/679) sets the rules for processing personal data of people in the EU. It has applied since 25 May 2018 and is supplemented by national laws in each member state.

Serious infringements can be fined up to €20 million or 4% of worldwide annual turnover, whichever is higher. In practice, most companies first meet GDPR requirements through customer contracts, data processing agreements and security questionnaires.

Who must comply with the GDPR?

Any organisation established in the EU that processes personal data
Companies outside the EU that offer goods or services to people in the EU or monitor their behaviour (Article 3(2))
SaaS providers and IT outsourcers that process data on behalf of EU clients as processors
HR, marketing, e-commerce and healthcare teams handling customer or employee data

What the free GDPR self-assessment checks

Lawful basis for each processing activity and valid consent
Records of processing activities (Article 30)
Privacy notices and handling of data subject rights: access, erasure, portability, objection
Processors and data processing agreements (Article 28) and international data transfers
Security of processing (Article 32): access control, encryption, backups
Personal data breach handling and notification within 72 hours (Articles 33–34)
Data protection impact assessments (Article 35) and the data protection officer (Article 37)

Typical GDPR gaps

The self-assessment shows which of these apply to you, so you can fix them before an audit by a client or a supervisory authority.

No up-to-date record of processing activities
Data processing agreements missing for some vendors, especially SaaS tools
No documented procedure for data subject requests or breach notification
Consent collected in a way that is not freely given, specific or provable
Retention periods not defined, so data is kept indefinitely

Assessment, not certification

There is no single mandatory GDPR certificate. What customers and regulators look for is evidence that you meet the requirements. The self-assessment gives you a structured view of that evidence and the gaps.

For the information security part of the GDPR, many companies also use ISO/IEC 27001 and ISO/IEC 27701. baltum.ai is independent software, not a certification body or a law firm, and the assessment is not legal advice.

Related standards

How the free assessment works

Choose the standard

The questions are written in plain language, so you do not need a compliance specialist to answer them.

Answer 20–40 questions

Describe how your organisation actually works today. Honest answers give the most useful result.

Get your report

A readiness score, a gap analysis by requirement area and prioritised AI recommendations, with a PDF you can share.

Frequently asked questions

Is there an official GDPR certificate?

The GDPR allows approved certification schemes (Article 42), but they are rare and not mandatory. Most companies demonstrate compliance with documentation, contracts and security measures, often supported by ISO/IEC 27001 or ISO/IEC 27701 certification.

What are the fines under the GDPR?

Up to €20 million or 4% of worldwide annual turnover for the most serious infringements, and up to €10 million or 2% for others. Supervisory authorities also take into account cooperation and the measures already in place.

Does the GDPR apply to companies outside the EU?

Yes, if they offer goods or services to people in the EU or monitor their behaviour, and when they process data as a processor for EU clients. This is common for software and outsourcing companies from Ukraine, the Caucasus and Central Asia.

Is the self-assessment a GDPR audit?

No. It is a structured self-check that shows your readiness and gaps. It does not replace legal advice or an audit, but it tells you where to focus first.