Use this checklist to ensure your agency and white-label software are GDPR-compliant. This checklist is not legal advice but a practical guide to help you meet your responsibilities as a data controller.
Data Collection & Consent
- You clearly inform users what personal data you collect and why
- You collect freely given, specific, informed, and unambiguous consent for data processing
- You provide users with an easy way to withdraw consent at any time
- You only collect data that is strictly necessary (data minimization)
- You keep records of how and when each user gave their consent Privacy Policy
- Your privacy policy is written in clear, understandable language
- It includes the legal basis for processing personal data
- It explains data retention periods and user rights
- It lists all third-party services that receive user data
- The privacy policy is easily accessible on your site/platform
Data Storage & Access
- All user data is stored securely (e.g. encrypted, protected with access controls)
- Only authorized team members can access user data
- You know where all data is stored (including backups and cloud services)
- You have a process to respond to data access, correction, or deletion requests within 30 days Data Processing Agreement (DPA)
- You have signed a DPA with DropSaaS
- You maintain a list of all data processors you use
- You have contracts in place with all external providers who process personal data on your behalf Record of Processing Activities (RoPA)
- You have documented all data processing activities
- For each activity, you have listed: data types, purpose, legal basis, data recipients, and retention period
- You review and update this record regularly Security & Breach Management
- You have security measures in place to protect user data (e.g. SSL, password policies, firewalls)
- You have a written plan for responding to data breaches
- You can detect and report data breaches to the authorities within 72 hours
- You train your team on GDPR principles and data security
User Rights Management
- You provide users with clear instructions on how to: access, correct, delete, object, or port their data
- You respond to these requests promptly and within GDPR time limits