A GDPR compliance checklist in XLS format works best when it treats each processing activity as its own row and each compliance requirement as its own column, so you can see at a glance where the gaps are and who owns them. The regulation itself doesn’t prescribe a format, but the Article 30 record of processing activities is the natural spine of the spreadsheet, and every other obligation — lawful basis, security, transfers, data subject rights, DPIA status — hangs off that spine as an additional column. Below is what the file needs to contain, how to structure it, and where to pull templates that already align with what supervisory authorities expect to see.
How to Structure the Spreadsheet
Each row represents a single processing activity: payroll, email marketing, customer support ticketing, website analytics, recruitment, and so on. The columns capture the compliance attributes for that activity. At a minimum, build in these fields:
- Processing activity — a plain-language description of what you do with the data.
- Data categories — the types of personal data involved, with a flag for any special-category data.
- Lawful basis — which of the six Article 6 bases applies.
- Data subjects — whose data it is (employees, customers, website visitors).
- Retention period — how long the data is kept before deletion or anonymization.
- Data recipients — third-party processors, cloud providers, or group companies that receive the data.
- Transfer mechanism — for cross-border transfers, which safeguard applies (adequacy decision, SCCs, DPF certification).
- Security measures — the specific technical controls protecting this data set.
- DPIA required — whether a Data Protection Impact Assessment has been conducted or is still needed.
- Compliance status — fully compliant, partially compliant, or needs remediation.
- Owner — the person or team responsible for maintaining compliance for this activity.
- Last reviewed — the date the row was last checked.
Use standardized dropdown menus for lawful basis, compliance status, and data category so entries stay consistent across contributors. Color-code the compliance status column — green, yellow, red — for an immediate visual read on where remediation is needed. A spreadsheet where everyone free-types their own terminology becomes nearly useless for gap analysis within a few months.
Secure the file itself with password protection and role-based access. It contains a detailed map of your data flows and is operationally sensitive. Store it in a central, version-controlled location so you can produce the current version quickly during an audit.
What Each Column Needs to Capture Correctly
Lawful Basis Under Article 6
Every processing activity needs a documented legal justification. Article 6 lists exactly six bases: consent, contractual necessity, legal obligation, protection of vital interests, public interest, and legitimate interests. Restrict the dropdown to those six.
A precision point worth flagging in the checklist: Article 6 requires “consent,” not “explicit consent.” Explicit consent is a higher standard that applies only in specific situations, such as processing special-category data under Article 9 or certain international transfers. Mislabeling ordinary consent as explicit in your checklist creates confusion during audits because it implies you’re collecting something you may not actually need.
Records of Processing Activities (Article 30)
Article 30 is what the spreadsheet exists to satisfy. Controllers must record the purpose of the processing, the categories of personal data involved, who receives the data, expected timeframes for deletion, and a description of security measures.1General Data Protection Regulation (GDPR). General Data Protection Regulation Article 30 – Records of Processing Activities Processors have a slightly narrower obligation but still need to document the categories of processing they perform on behalf of each controller.
Distinguish clearly between standard personal data (names, emails, purchase history) and special categories such as health records, biometric data, or information revealing racial origin. Special-category data triggers stricter rules under Article 9, including the need for explicit consent or another narrow exception. If your checklist doesn’t flag which rows involve special-category data, you’ll miss those heightened requirements entirely.
Organizations with fewer than 250 employees technically qualify for an exemption from mandatory record-keeping under Article 30(5), but only if the processing is occasional, involves no special-category data, and poses no risk to individuals’ rights.2GDPR-Info.eu. Records of Processing Activities In practice, almost every business processes data regularly through websites, payroll, or customer databases. If you run a CRM system or collect email addresses, you don’t qualify. Treat the RoPA as mandatory regardless of headcount.
Data Subject Rights
Articles 12 through 22 give individuals a suite of rights: access, rectification, erasure, restriction, portability, and objection. Your spreadsheet should track whether you have functioning procedures for each right and identify who handles incoming requests.3General Data Protection Regulation (GDPR). Art. 12 GDPR – Transparent Information, Communication and Modalities for the Exercise of the Rights of the Data Subject
The right to erasure has exceptions that catch organizations off guard. You can refuse a deletion request when the data is needed for exercising freedom of expression, complying with a legal obligation, public health purposes, archiving in the public interest, or establishing or defending legal claims.4General Data Protection Regulation (GDPR). Art. 17 GDPR – Right to Erasure (Right to Be Forgotten) Add a column noting which processing activities might invoke one of these exceptions so your team doesn’t reflexively delete data that should be retained.
If any of your processing involves purely automated decisions with significant effects on people — credit scoring, automated hiring screens, insurance risk assessments — Article 22 requires safeguards including human review, the ability to express a point of view, and the ability to contest the decision.5General Data Protection Regulation (GDPR). Art. 22 GDPR – Automated Individual Decision-Making, Including Profiling Flag those rows separately and document the safeguards in place.
Security Measures (Article 32)
Article 32 requires technical and organizational measures proportionate to the risk. The regulation names pseudonymization and encryption, ongoing confidentiality and resilience of systems, the ability to restore data access after an incident, and regular testing of those measures.6General Data Protection Regulation (GDPR). Art. 32 GDPR – Security of Processing The security column should link each processing activity to the specific controls protecting it, not a generic yes/no.
The “state of the art” language means these measures aren’t static. What counted as adequate encryption in 2020 may not pass muster in 2026. Record when each security measure was last evaluated so review cycles surface controls that have aged out.
DPIA Triggers (Article 35)
Article 35 requires a Data Protection Impact Assessment whenever processing is likely to create a high risk to individuals’ rights. Three situations specifically require one: systematic and extensive profiling that produces legal effects, large-scale processing of special-category data, and large-scale systematic monitoring of publicly accessible areas.7General Data Protection Regulation (GDPR). Art. 35 GDPR – Data Protection Impact Assessment National supervisory authorities also publish their own lists of processing types that trigger DPIAs, so check the relevant authority in your jurisdiction.
Include a field indicating whether each activity has been assessed for DPIA eligibility, and if a DPIA was conducted, where the completed assessment is stored. Discovering a high-risk activity during an audit is far worse than having a documented assessment on file.
Breach Notification (Articles 33 and 34)
When a breach occurs, Article 33 requires notification to your supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to pose any risk to individuals.8General Data Protection Regulation (GDPR). Art. 33 GDPR – Notification of a Personal Data Breach to the Supervisory Authority If you miss that window, you must explain the delay. Article 34 separately requires you to notify affected individuals directly when a breach poses a high risk to their rights, unless encryption or another measure has rendered the data unintelligible, or you’ve since taken steps that eliminate the high risk.9General Data Protection Regulation (GDPR). Art. 34 GDPR – Communication of a Personal Data Breach to the Data Subject
Add a dedicated section for breach preparedness: who detects breaches, the internal escalation process, template notifications for both the supervisory authority and affected individuals, and the criteria for deciding whether individual notification is required. The 72-hour clock is ruthless, and most organizations that miss it do so because they didn’t have a clear internal escalation path mapped out in advance.
Cross-Border Transfers
Transferring personal data outside the European Economic Area triggers Articles 44 through 49, which require adequate protection at the receiving end. The transfer column should identify every activity involving data leaving the EEA, which countries receive it, the legal mechanism authorizing each transfer, and any supplementary measures in place.10General Data Protection Regulation (GDPR). Art. 44 GDPR – General Principle for Transfers
The most common mechanisms are adequacy decisions, Standard Contractual Clauses, and Binding Corporate Rules for intra-group transfers. Following the Schrems II ruling, organizations relying on SCCs must evaluate the legal environment of the receiving country and adopt supplementary measures where local surveillance laws could undermine protections.11EveryCRSReport.com. EU Data Transfer Requirements and U.S. Intelligence Laws – Understanding Schrems II and Its Impact on the EU-U.S. Privacy Shield
For transfers to the United States, the EU-U.S. Data Privacy Framework took effect on July 10, 2023, replacing the invalidated Privacy Shield.12Data Privacy Framework. Data Privacy Framework (DPF) Program Overview U.S.-based organizations self-certify through the International Trade Administration and must re-certify annually. Before relying on a vendor’s DPF certification, verify their status on the official Data Privacy Framework List, which distinguishes between active and inactive participants.13Data Privacy Framework. Data Privacy Framework List Build a column for each U.S. vendor’s DPF status and set a reminder to re-verify it at least annually.
Processor Contracts (Article 28)
If you share personal data with any external vendor — cloud hosting, payroll providers, marketing platforms — Article 28 requires a written contract spelling out the processor’s obligations. Mandatory terms include processing only on your documented instructions, maintaining confidentiality, implementing Article 32 security measures, obtaining your authorization before engaging sub-processors, assisting with data subject rights requests, and provisions for data deletion or return at the end of the contract.
Add a row or subsection for every processor relationship. Track whether a compliant contract is in place, when it was last reviewed, and whether the processor uses sub-processors. The processor remains liable to you for its sub-processors’ compliance, but you’re the one answering to the supervisory authority if the chain breaks.
Privacy by Design (Article 25)
Article 25 requires data protection to be built into systems from the start. Controllers must implement measures — at the design stage and during processing itself — that effectively enforce principles like data minimization.14General Data Protection Regulation (GDPR). Art. 25 GDPR – Data Protection by Design and by Default By default, your systems should collect only the data necessary for each specific purpose, limit how long it’s stored, and restrict who can access it. For new projects, document how data minimization was considered before the system went live. For legacy systems, note any remediation plans.
Whether You Need a DPO (Article 37)
Article 37 makes a Data Protection Officer mandatory in three situations: your organization is a public authority, your core activities involve regular and systematic monitoring of individuals on a large scale, or your core activities involve large-scale processing of special-category data or criminal offense data.15General Data Protection Regulation (GDPR). Art. 37 GDPR – Designation of the Data Protection Officer Some member states go further; Germany requires a DPO for organizations with 20 or more employees regularly processing personal data.
The DPO advises the organization on compliance, monitors adherence to the regulation, provides guidance on DPIAs, and serves as the contact point for the supervisory authority and individuals.16European Data Protection Board. Data Protection Officer The DPO must be involved early in decisions affecting data protection, not consulted after the fact. Failing to appoint a mandatory DPO is itself a violation that can attract fines up to €10 million or 2% of global annual turnover under Article 83(4).17General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines Include a section documenting whether you’re required to appoint a DPO, who holds the role, and how independence from conflicting duties is maintained.
One boundary worth noting: if any of your services are aimed at or accessible to minors, Article 8 sets a default digital consent age of 16 that member states can lower to 13.18General Data Protection Regulation (GDPR). Art. 8 GDPR – Conditions Applicable to Child’s Consent in Relation to Information Society Services The checklist should reflect the applicable age in each country where you operate and document the age-verification mechanism you use.
Where to Find Official Templates
Start with the resources published by national supervisory authorities. The UK’s Information Commissioner’s Office provides self-assessment checklists organized by business size, with tools for both small business owners and medium-sized organizations.19Information Commissioner’s Office. Data Protection Self Assessment – Medium Businesses France’s CNIL offers an open-source Privacy Impact Assessment tool that walks you through conducting and documenting DPIAs.20CNIL. The Open Source PIA Software Helps to Carry Out Data Protection Impact Assessment
The European Data Protection Board publishes guidelines, recommendations, and best practices covering specific GDPR topics, from pseudonymization to processor binding corporate rules.21European Data Protection Board. Guidelines, Recommendations, Best Practices These aren’t ready-made spreadsheets, but they clarify what regulators expect each checklist item to contain, which is more useful than a template that looks complete but reflects out-of-date interpretations.
When evaluating third-party templates, look for references to specific GDPR articles, placeholders for Article 30 RoPA fields, and dedicated sections for DPIAs and breach response. A template that doesn’t mention processor contracts or cross-border transfer mechanisms is almost certainly incomplete. Avoid generic compliance files from promotional sites; an outdated template can be worse than none, because it creates a false sense of completeness.
Keeping the Checklist Current
A compliance spreadsheet created once and left untouched is evidence of exactly the kind of neglect regulators penalize. Set a quarterly or semi-annual review cycle, and trigger immediate updates whenever you onboard a new vendor, launch a product feature that processes data differently, or change cloud providers. The “last reviewed” column tells you which rows have gone stale.
During a regulatory audit or in the aftermath of a breach, this file is your primary evidence of accountability. Version-controlling it and reviewing it on a regular cadence — rather than the night before the audit — is what turns a spreadsheet into a defense.