GDPR Controls List for Data Protection Compliance

A GDPR controls list covers nine areas of obligation that every organization handling personal data of people in the European Economic Area must address: lawful basis for processing, organizational governance, risk assessments, technical security, privacy by design across the data lifecycle, special category data safeguards, data subject rights fulfillment, vendor and international transfer controls, and breach notification. Gaps in any category expose the organization to fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher.¹ The controls below follow the order in which most compliance programs need to build them.

Lawful Basis Documentation

No processing is lawful without a valid ground under Article 6, and identifying that ground is the first control every other control depends on. The six available grounds are consent, contractual necessity, legal obligation, vital interests, public interest, and legitimate interests. Legitimate interests is not available to public authorities acting in their official capacity.²

The control is documentary: for every processing activity, record which basis applies and why. Getting this wrong is not academic. A program built on consent collapses the moment consent is withdrawn if the actual dependency was contractual. Auditors and supervisory authorities check this first.

When consent is the chosen basis, Article 7 imposes stricter conditions: you must be able to demonstrate consent was given, the request must appear in plain language and separately from other terms, and withdrawal must be as easy as the original consent.³ Bundling consent with unrelated contract terms is prohibited. For online services offered directly to children, parental authorization is required for anyone under 16, though member states may lower the threshold to 13.

Governance and Accountability Controls

Three governance controls together form the accountability backbone the regulation expects.

The first is appointing a Data Protection Officer. The obligation applies when core activities involve large-scale monitoring of individuals, large-scale processing of special category data, or when the organization is a public authority.⁴ Contact details must be published and reported to the supervisory authority. Failing to appoint a DPO when required falls in the lower fine tier of up to €10 million or 2% of global turnover.¹

The second is Records of Processing Activities under Article 30. This is a detailed register of every processing activity: purposes, categories of individuals affected, recipients of the data, and planned retention periods. Organizations with fewer than 250 employees have a narrow exemption, but it disappears if the processing is more than occasional, involves special category data, or poses any risk to individuals’ rights.⁵ In practice, most businesses that handle customer data regularly cannot rely on the exemption.

The third is staff training. No article prescribes a specific curriculum, but demonstrating accountability under Article 5(2) is effectively impossible without one. Keep records of sessions, attendance, and topics covered so the evidence exists when an auditor asks.

Data Protection Impact Assessments

Article 35 requires a DPIA whenever new processing is likely to result in a high risk to individuals’ rights, particularly when new technology is involved.⁶ Three scenarios always trigger the requirement:

Systematic and extensive automated evaluation of personal aspects that produces legal or similarly significant effects, such as automated credit scoring.
Large-scale processing of special category data, including health records, biometric identifiers, or criminal history information.
Systematic monitoring of publicly accessible areas on a large scale, such as wide-area CCTV or location tracking.

The assessment must describe the planned processing and its purpose, evaluate whether the processing is proportionate to that purpose, analyze the risks to individuals, and identify the safeguards planned to address those risks. If residual risk remains high after mitigation, the supervisory authority must be consulted before processing begins. Skipping a required DPIA is a common enforcement trigger and sits in the €10 million fine tier.¹

Technical Security Measures

Article 32 requires security measures appropriate to the risk, weighing the state of current technology, the cost of implementation, and the sensitivity of the data.⁷ Pseudonymization and encryption are named as examples, but the obligation extends further: ongoing confidentiality, integrity, and availability of processing systems; the ability to restore access after a technical or physical incident; and regular testing of all measures.

Access control is the starting point. Restrict data access to the roles that actually need it, enforce that restriction with multi-factor authentication, and use network segmentation so a compromise of one system does not expose everything. Supervisory authorities treat the absence of these baseline controls as negligence.

Regular testing closes the loop. Penetration tests and vulnerability scans surface weaknesses, but only produce compliance value when findings are remediated and the test-fix-retest cycle is logged. Organizations already operating under ISO 27001 or the NIST Cybersecurity Framework can reuse much of that work: the NIST “Protect” function aligns with Article 32, and “Detect” and “Respond” align with breach notification duties.

Privacy by Design and Lifecycle Controls

Article 25 requires privacy to be built into products and systems from the design stage, not added afterward.⁸ The default configuration of any product or service must process personal data with the highest privacy protection: limited collection, short storage, restricted accessibility.⁹

Article 5 reinforces this with data minimization and purpose limitation: collect only what is adequate, relevant, and limited to what the stated purpose requires, and do not repurpose data collected for one reason into an unrelated activity without a fresh legal basis.¹⁰ Every field on every form and every column in every database should be defensible against these principles.

Pseudonymization and anonymization are the two lifecycle techniques for reducing risk. Pseudonymized data replaces identifiers with codes but can still be re-identified with the key, so GDPR continues to apply to it. Anonymized data has been altered so re-identification is not possible by any reasonably available means, and once anonymization is genuine, the regulation no longer applies. Operational systems that still need to trace records to individuals typically use pseudonymization; analytics and research that don’t should aim for full anonymization.

Retention schedules define how long each category of data remains in the system, and secure deletion must follow once the original purpose expires. Automated retention management prevents the drift regulators view as a red flag. Deletion must reach backups and archives too. A record still living on a backup tape has not been meaningfully erased.

Special Category Data Controls

Article 9 prohibits processing of certain data by default because of the harm exposure can cause: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric identifiers used for identification, health data, and information about sex life or sexual orientation.

Processing these categories lawfully requires both a standard Article 6 basis and one of the specific exceptions in Article 9(2). The exceptions most organizations rely on include explicit consent, obligations in the employment and social security context, protection of vital interests where the individual cannot consent, medical diagnosis or treatment, and substantial public interest grounds established by law. Explicit consent here is a higher standard than ordinary consent and must reference the sensitive nature of the data.

Operationally, special category data warrants tighter access restrictions, stronger encryption, mandatory DPIAs for large-scale processing, and shorter retention periods than ordinary personal data. Organizations handling health records, biometric authentication data, or employee diversity information should treat these as a separate control set.

Data Subject Rights Fulfillment

Individuals have enforceable rights that the organization’s systems and processes must be capable of executing. Article 12 sets a one-month response window from receipt of a request, extendable by two additional months for complex or high-volume requests, provided the individual is notified of the extension within the initial month.¹¹

Article 15 gives individuals the right to obtain a copy of their personal data along with the purposes of processing, recipients, and retention periods.¹² Rectification allows correction of inaccurate or incomplete records. Both require the organization to know where an individual’s data actually lives across all systems, which is where many compliance programs fall short.

The right to erasure under Article 17 requires deletion when data is no longer necessary for its original purpose, when consent is withdrawn, when the individual objects and no overriding grounds exist, or when data was collected unlawfully. Refusal is permitted when data is needed for freedom of expression, legal obligations, public health, public interest archiving, or the establishment of legal claims.¹³ Document the reason for each decision, whether erasure is granted or denied.

Article 20 gives individuals the right to receive their personal data in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance.¹⁴ Portability applies only when processing is based on consent or a contract and is carried out by automated means. Where technically feasible, the individual can request direct transmission from one controller to another.

The right to object under Article 21 is absolute for direct marketing, including related profiling. When an individual objects to marketing, processing must stop with no balancing test and no exceptions.¹⁵ Individuals must be informed of this right at the point of first contact, presented clearly and separately from other information. For objections against processing based on legitimate interests or public interest, processing may continue only where the organization demonstrates compelling grounds that override the individual’s interests.

Vendor Contracts and International Transfers

When a third-party processor handles personal data on the organization’s behalf — a cloud provider, payroll service, or marketing platform — Article 28 requires a written contract that defines the scope of processing, the types of data involved, security requirements, and the processor’s obligations regarding data subject rights and confidentiality.¹⁶ The contract must also address sub-processors, audit rights, and the handling of data when the engagement ends. The controller remains responsible for what its processors do, so due diligence before signing carries as much weight as the contract text.

Moving personal data outside the European Economic Area requires an additional layer of controls. Article 46 lists the approved mechanisms: standard contractual clauses adopted by the European Commission, binding corporate rules for intra-group transfers, approved codes of conduct, and certification mechanisms.¹⁷ For transfers to the United States, the EU-U.S. Data Privacy Framework allows certified American organizations to receive personal data from the EEA. Certification requires the U.S. organization to fall under FTC or DOT enforcement authority, choose a verification method (self-assessment or outside review), and designate a dispute resolution mechanism.¹⁸ Standard contractual clauses remain the most widely used mechanism for transfers to countries without an adequacy decision.

Breach Notification Controls

Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals’ rights.¹⁹ Missing that window is possible, but the notification must then include reasons for the delay. The notification itself must describe the nature of the breach with approximate numbers of individuals and records affected, name the DPO or primary contact, describe the likely consequences, and list the measures taken or proposed to address it.²⁰

When a breach is likely to result in a high risk to individuals, Article 34 adds a separate duty to notify the affected people directly, in clear and plain language, with the DPO’s contact information, the likely consequences, and the remedial measures.²¹

The real control here is preparation. Seventy-two hours does not allow time to design a response from scratch. Pre-built incident response procedures, defined internal escalation paths, template notifications, and rehearsed tabletop exercises are what turn the deadline into something achievable. Missing the 72-hour window puts the organization in the higher fine tier of up to €20 million or 4% of global turnover.¹

1
General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines
2
General Data Protection Regulation (GDPR). Art. 6 GDPR – Lawfulness of Processing
3
GDPR-Text.com. Article 7 GDPR – Conditions for Consent
4
General Data Protection Regulation. Art. 37 GDPR – Designation of the Data Protection Officer
5
General Data Protection Regulation (GDPR). Art. 30 GDPR – Records of Processing Activities
6
General Data Protection Regulation (GDPR). Art. 35 GDPR – Data Protection Impact Assessment
7
General Data Protection Regulation (GDPR). Art. 32 GDPR – Security of Processing
8
General Data Protection Regulation (GDPR). Art. 25 GDPR – Data Protection by Design and by Default
9
European Commission. What Does Data Protection by Design and by Default Mean
10
General Data Protection Regulation (GDPR). Art. 5 GDPR – Principles Relating to Processing of Personal Data
11
General Data Protection Regulation (GDPR). Art. 12 GDPR – Transparent Information, Communication and Modalities for the Exercise of the Rights of the Data Subject
12
General Data Protection Regulation (GDPR). Art. 15 GDPR – Right of Access by the Data Subject
13
General Data Protection Regulation (GDPR). Art. 17 GDPR – Right to Erasure (Right to Be Forgotten)
14
General Data Protection Regulation (GDPR). Art. 20 GDPR – Right to Data Portability
15
General Data Protection Regulation (GDPR). Art. 21 GDPR – Right to Object
16
General Data Protection Regulation (GDPR). Art. 28 GDPR – Processor
17
General Data Protection Regulation (GDPR). Art. 46 GDPR – Transfers Subject to Appropriate Safeguards
18
Data Privacy Framework. Data Privacy Framework Participants List
19
General Data Protection Regulation (GDPR). Art. 33 GDPR – Notification of a Personal Data Breach to the Supervisory Authority
20
GDPR-Text.com. Article 33 – Notification of a Personal Data Breach to the Supervisory Authority
21
General Data Protection Regulation (GDPR). Art. 34 GDPR – Communication of a Personal Data Breach to the Data Subject