Please fill out the following details so we can assist you better:

Your Name

Company Name

Company Email ID

Contact Number

GDPR Data Processing Assessment

1. Data Processing Scope

What categories of personal data do you collect, process, or store?

Do you process any special category data under GDPR Article 9?
 Yes No

Approximate number of data subjects processed (Monthly/Annually)

Do you process children's data (Below 16 years)?
 Yes No

Do you process data of vulnerable individuals?
 Yes No

Organization Role
 Data Controller Data Processor Both

Lawful Basis for Processing Activities
 Consent Contract Legal Obligation Legitimate Interest Vital Interests Public Task Other

If Other, Please Specify

Do you conduct profiling, automated decision making, or behavioural monitoring?
 Yes No

2. Data Flow & System Landscape

List systems/applications that collect or process personal data

Do you maintain data flow diagrams and Article 30 Records of Processing Activities (RoPA)?
 Yes No In Progress

Do you use third-party SaaS tools that process personal data?
 Yes No

If Yes, Please Specify the SaaS Tools

Do you transfer personal data outside the EU/EEA?
 Yes No

Transfer Mechanism Used
---Standard Contractual Clauses (SCCs)Adequacy DecisionBinding Corporate Rules (BCRs)Explicit ConsentOther

If Other, Please Specify

Do you maintain an inventory of all data assets and processing systems?
 Yes No In Progress

3. GDPR Security & Privacy Controls

Do you have a documented data retention and deletion policy?
 Yes No In Progress

Do you have a GDPR-compliant privacy policy and consent mechanism?
 Yes No In Progress

Do you have a data breach notification process aligned with Articles 33 & 34?
 Yes No In Progress

Are access control, encryption, MFA, and logging implemented?
 Access Control Encryption Multi-Factor Authentication (MFA) Security Logging

Do you conduct periodic VAPT, security audits, or penetration testing?
 Yes No Planned

Do you have incident response procedures and evidence logs?
 Yes No In Progress

Do you maintain backup and disaster recovery mechanisms?
 Yes No Partially Implemented

4. Third Party & Vendor Ecosystem

How many vendors process personal data on your behalf?

Do you have Data Processing Agreements (DPAs) with all processors?
 Yes No Partially

Do you conduct vendor risk assessments?
 Yes No Planned

Which cloud providers do you use?
 AWS Microsoft Azure Google Cloud Platform (GCP) Oracle Cloud IBM Cloud Private Cloud Other

If Other, Please Specify

Do you verify sub-processors used by your vendors?
 Yes No Partially

5. Governance, Documentation & Compliance Readiness

Do you have GDPR-aligned policies (Privacy, Retention, Consent, Breach, Data Subject Rights, Grievance Redressal)?
 Yes No Partially

Do you have a designated Data Protection Officer (DPO)?
 Yes No

Do you have an EU Representative (Article 27)?
 Yes No Not Applicable

Do you maintain audit logs and compliance evidence?
 Yes No Partially

Do you have defined timelines for responding to Data Subject Rights (DSR) requests?
 Yes No

Have you conducted a DPIA for high-risk processing activities?
 Yes No Planned

Do you have a GDPR awareness training program for employees?
 Yes No Planned

Annexure C – Expected Deliverables

Required GDPR Compliance Services
 Gap Assessment RoPA Documentation Policy Drafting Consent Management DPIA Data Audits Employee Training Implementation Support

Preferred Timeline for GDPR Compliance
---Within 30 Days1–3 Months3–6 Months6–12 MonthsMore than 12 Months

Support Requirement
 One-Time Compliance Ongoing Annual Support

Additional Information / Comments

Δ