← All templates

GDPR

EU General Data Protection Regulation. Covers lawful processing, data subject rights, security measures, and breach notification.

31 questions·Version 2018
Use this template free

Lawful Basis

  • Do you have a documented lawful basis for all personal data processing activities?Art.6
  • Do you maintain a Record of Processing Activities (ROPA)?Art.30
  • Do you conduct Data Protection Impact Assessments (DPIAs) for high-risk processing?Art.35

Data Subject Rights

  • Can you fulfil data subject access requests within 30 days?Art.15
  • Do you have a process for handling right to erasure requests?Art.17
  • Do you support data portability requests?Art.20
  • Do you have a process for handling objections to processing?Art.21

Privacy by Design

  • Do you implement privacy by design and by default in new systems?Art.25
  • Is personal data minimisation applied to all processing activities?Art.5
  • Are retention periods defined and enforced for all personal data categories?Art.5

Data Processing Agreements

  • Do you have a Data Processing Agreement (DPA) template available?Art.28
  • Are DPAs in place with all sub-processors?Art.28
  • Do you maintain an up-to-date list of all sub-processors?Art.28

Security Measures

  • Do you encrypt personal data at rest and in transit?Art.32
  • Do you have access controls limiting who can access personal data?Art.32
  • Do you conduct regular security testing of systems holding personal data?Art.32

Breach Notification

  • Can you detect and assess a personal data breach within 24 hours?Art.33
  • Can you notify the supervisory authority within 72 hours of discovering a breach?Art.33
  • Do you have a documented breach response procedure?Art.33

International Transfers

  • Do you transfer personal data outside the EU/EEA?Art.44
  • If yes, is the transfer covered by an adequacy decision or standard contractual clauses?Art.46

Data Protection Officer

  • Have you appointed a Data Protection Officer (DPO)?Art.37
  • Do you have a designated privacy contact for data subjects?Art.13

Transparency

  • Do you provide clear privacy notices to data subjects at point of collection?Art.13
  • Is your privacy policy publicly accessible and up to date?Art.13

Consent

  • Where consent is the lawful basis, is it freely given, specific, informed, and unambiguous?Art.7
  • Do you have a mechanism for withdrawing consent easily?Art.7

Special Categories

  • Do you process any special category data (health, biometric, political, religious)?Art.9
  • If yes, do you have explicit consent or another valid legal basis for this processing?Art.9

Compliance

  • Have you registered with your national data protection authority where required?Art.30
  • Do you conduct regular GDPR compliance audits?Art.24

Send this questionnaire to your vendors

VendorAuditly automatically scores responses, maps answers to framework controls, and tracks coverage over time. Free to start.

Get started free →← All templates