DSGVO Checklist

Consent Mechanisms

Implement valid opt-in consent collection per Art. 6(1)(a)

Legitimate Interest Documentation

Document legitimate interest assessments per Art. 6(1)(f)

Data Processing Agreements

Execute Art. 28 DPA with all processors (hosting, email, analytics)

Legal Basis Mapping

Map every processing activity to its Art. 6 legal basis

Consent Withdrawal Process

Provide easy mechanism to withdraw consent at any time

Records of Processing Activities

Maintain Art. 30 records (Verzeichnis von Verarbeitungstätigkeiten)

Right of Access (Art. 15)

Process to respond to access requests within 30 days

Right to Rectification (Art. 16)

Process to correct inaccurate personal data on request

Right to Erasure (Art. 17)

Process to delete personal data ('right to be forgotten')

Right to Data Portability (Art. 20)

Ability to export personal data in machine-readable format

Right to Object (Art. 21)

Process to handle objections to processing, especially direct marketing

Encryption at Rest & in Transit

TLS 1.2+ for transit, AES-256 for stored personal data

Pseudonymization

Replace identifiers where full identification is unnecessary

Access Controls

Role-based access, least-privilege principle, MFA for admin

Backup & Recovery

Regular encrypted backups with tested restoration procedures

Logging & Monitoring

Audit logs for data access (without logging personal data itself)

Data Protection Officer (DPO)

Appoint DPO if required (Art. 37) and publish contact details

Privacy Impact Assessments

Conduct DPIA for high-risk processing (Art. 35)

Employee Training

Regular data protection awareness training for all staff

Breach Notification Process

72-hour notification process to supervisory authority (Art. 33)

Cookie Banner / Consent Manager

TTDSG-compliant cookie banner with granular opt-in controls

Privacy Policy (Datenschutzerklärung)

Complete, accessible privacy policy per Art. 13/14

Terms of Service / Impressum

Legal notice per TMG §5 and clear terms of service

Data Processing Register

Public-facing summary of data processing categories

Third-Party Audit

Review all third-party scripts, fonts, and CDNs for data transfers