GDPR Readiness Check
Check common gaps in how you handle personal data: records, lawful basis, privacy notices, people's rights, breaches and suppliers. Not legal advice or a compliance check.
- Free
- No sign-up to try
- Works as you type
Answer for how you handle personal data today. This highlights common gaps in data protection practice; it isn't legal advice or a statement that you comply.
0 of 13 answered
Answer the questions to see your score by area as you go.
Answer at least 11 of 13 questions to save your results as a Room.
How it works
How the GDPR Readiness Check works
- 1
Answer the questions
Pick the answer closest to where you are today. It takes a few minutes.
- 2
See your score
Your score by area appears as you answer, with the weakest areas first.
- 3
Save your results
Create a Room with your scores, next steps and an adviser to talk them through.
Worked example
What it makes
13 questions across 4 areas. Each answer scores 0 to 3; an area's score is its points as a share of the most it could get.
Know your data
- Do you have a record of the personal data you process and why?
- Have you identified a lawful basis for each use of personal data?
- How long do you keep personal data?
Transparency and rights
- Is your privacy notice clear and current?
- Can you handle a request from someone to see, correct or delete their data?
- Where you rely on consent, how is it collected and recorded?
Security and breaches
- How is personal data protected?
- What happens if personal data is lost or exposed?
- Do you assess the risks before new uses of personal data that could significantly affect people?
Accountability and suppliers
- Who is responsible for data protection?
- Do contracts with suppliers who handle personal data cover data protection?
- Do you know when personal data is transferred to other countries, and on what terms?
Results bands: Not ready (0+), Getting there (40+), Mostly ready (70+), Ready (90+). A self-assessment from your own answers: a starting point for a conversation, not an audit, certification or professional advice.
Who it's for
Who uses it
Small business owners
Find the data protection basics that are missing.
Operations and marketing teams
Check consent, retention and requests are handled.
Data protection leads
Run a quick internal check before a fuller review.
Good to know
What to consider
- Not legal advice and not a statement that you comply. How the rules apply depends on your situation; ask a qualified adviser.
- It covers common practice areas, not every obligation.
Questions
About the GDPR Readiness Check
We're outside Europe. Is it relevant?
GDPR can apply to organisations outside the EU that handle EU residents' data, and many other privacy laws share similar principles. Whether it applies to you is a question for a qualified adviser.
Is this an audit or a certification?
No. It scores your own answers against a written rubric to show where you stand and what to do next. Use it to start a conversation, not as an audit, certification or professional advice.
Make your results now
Free, no sign-up to try. It becomes a Room you can edit, publish and share.
Create my resultsRelated
Related tools
- Cybersecurity Self-AssessmentCheck the basic security controls a small team should have, such as sign-in, updates, backups, devices and staff awareness, and get the next steps for each gap.
- Vendor Risk AssessmentScore a supplier on security, data handling, continuity and business risk using the questions you'd put to them, and see which gaps to close before you rely on them.
- Security Review ChecklistMake a security review checklist for a new tool or vendor: what it touches, sign-in and access, data handling, vendor evidence and a recorded decision.