Is my organization GDPR compliant?

Have you appointed a Data Protection Officer (DPO) for your organization?

Have your employees, freelancers, or consultants received any training or written instructions regarding the GDPR?

Have the privacy policies you use to obtain consent from those you have a relationship with been adapted to the GDPR?

Have you decided on the time frames beyond which you will be destroying the personal data that are available to you?

Have you set up internal procedures for responding within a month to requests from data subjects (right to access, to rectification, to erasure, etc.)?

Have you made all of your processors (companies that handle personal data for you, like your exetrnal salary department, for instance) sign the contract that is required by the GDPR?

Have you set up handling procedures for the potential loss or theft of data?

Have you set up the record of processing activities that creates a record for every time your organization processes some personal data?

Have you written out and had management approval of the technical and organizational security measures that are used to secure the personal data you process?

Are you able to show, at a third party's request, or during a potential inspection, that you have built up a file that covers all of the obligations that the GDPR lays out?