the whole job

GDPR: the whole job, in order

GDPR almost certainly applies to you already. This plan covers its security side only: the measures you need, your processors, the 72-hour breach clock and the records that show your work. Six phases, in the order that holds up, with an owner, an output and the proof for each step.

last checked 2 November 2026

how to read this plan

Each step has an owner, a kind of work and two outputs. The kinds of work are different jobs: choices that someone with authority signs, systems and settings that someone builds, and checks that someone keeps running. The order follows dependencies, so a step needs the ones before it. The rest of GDPR, such as legal grounds, notices and the rights of people, is outside this plan. Under each step a small note names the legal basis, or says practice where no text sets it.

  • decide and documentchoices, policies and records that someone with authority signs
  • build and configuresystems, settings and procedures that make the choice real
  • prove and operatechecks, logs and records that show it keeps working
01

settle who answers

Name who answers for compliance and check whether you can skip any records.

  1. name who answers for data protection

    The controller is responsible for compliance and must be able to show it. Decide which person at management level answers for it and who reports to them on the security side.

    • owner board
    • decide and document
    what it produces
    a board decision naming an accountable owner and an operational lead
    the proof it leaves
    the minutes of that decision

    the work page

    basis GDPR Art. 5(2), 24(1)

  2. check whether you may skip records of processing

    Under 250 staff you may skip the records only if the processing is occasional, low-risk and has no special categories of data. Test that against your staff records, which you process regularly, and write down the answer.

    • owner legal or DPO
    • decide and document
    what it produces
    a one-page note with the answer and the reasoning
    the proof it leaves
    the note, approved by management

    basis GDPR Art. 30(5)

you are done with this phase when you can show a board decision naming an owner and a one-page note on records.
02

see what you hold

Record what personal data you process and where, and add the risk to people to your risk assessment.

  1. write the records of processing

    List each processing activity with its purpose, the kinds of data, who receives them and which systems hold them. Start from the system list your IT team already has, and add staff records and supplier data.

    • owner legal or DPO
    • build and configure
    what it produces
    records of processing with a system and an owner per activity
    the proof it leaves
    the records, dated and reviewed by the owner

    the work pagethe control: asset-inventory

    basis GDPR Art. 30(1)

  2. add the risk to people to your risk assessment

    Security has to fit the risk to people, which differs from the risk to the company. Add personal data as its own column, score what a leak or loss would do to the individuals, and pick measures to match.

    • owner head of IT
    • decide and document
    what it produces
    a risk register with a risk-to-people column and chosen measures
    the proof it leaves
    the register, approved by management

    the work pagethe control: risk-register

    basis GDPR Art. 32(1)

you are done with this phase when you can show records of processing and a risk assessment that covers the risk to people.
03

put the measures in place

Make the measures real: access, encryption, backups and regular tests.

  1. limit who can reach personal data

    Keep the confidentiality of systems that hold personal data, sized to the risk. List who can reach each one, remove access nobody can explain and review the list on a rhythm.

    • owner head of IT
    • build and configure
    what it produces
    an access list per system and a dated review
    the proof it leaves
    the review record, with removals noted

    the work pagethe control: access-reviews

    basis GDPR Art. 32(1)(b)

  2. encrypt where it fits

    Decide where encryption fits the risk, for example on laptops, in storage and in transit. Write down who holds the keys and what happens when one is lost.

    • owner head of IT
    • build and configure
    what it produces
    a one-page encryption and key note
    the proof it leaves
    the note, reviewed by the owner each year

    the control: encryption-keys

    basis GDPR Art. 32(1)

  3. make backups you have restored

    The law asks for the ability to restore availability and access to personal data in a timely manner. Back up the systems that hold it and restore from them on a schedule. A backup you have never restored is a hope.

    • owner head of IT
    • build and configure
    what it produces
    a backup scope and a restore test
    the proof it leaves
    restore test records with dates and results

    the work pagethe control: backup-recovery

    basis GDPR Art. 32(1)(c)

  4. test the measures on a rhythm

    The law asks for a process for regularly testing and evaluating the measures. Scan what is exposed, patch by priority and record what you decided not to fix. Write down what you did about each failed test.

    • owner head of IT
    • prove and operate
    what it produces
    a testing routine and a list of accepted risks
    the proof it leaves
    test results, patch records and the accepted-risk list

    the work pagethe control: vulnerability-management

    basis GDPR Art. 32(1)(d)

you are done with this phase when you can show each measure working, with an owner and the proof it leaves.
04

check your processors

Know who processes personal data for you and hold them to the terms the law lists.

  1. list every processor

    A processor handles personal data for you. Start from the supplier list in finance and the app list from your identity provider. Mark the ones that hold personal data and ask each what guarantees it gives.

    • owner procurement
    • build and configure
    what it produces
    a processor register with the data each one handles
    the proof it leaves
    the register and the guarantees received

    the work pagethe control: supplier-management

    basis GDPR Art. 28(1)

  2. check each contract for the required terms

    Processing has to run under a contract with listed terms, including security, assistance and audits. Compare each contract with the list, mark the gaps and fix them at the next renewal or sooner.

    • owner legal or DPO
    • prove and operate
    what it produces
    a contract check per processor with the gaps marked
    the proof it leaves
    the checks, and signed terms where they changed

    the work pagethe control: supplier-management

    basis GDPR Art. 28(3)

  3. ask about further processors

    Ask each processor which further processors it uses. The same duties have to pass down to them by contract. Record the answers next to the processor.

    • owner procurement
    • build and configure
    what it produces
    a list of further processors per processor
    the proof it leaves
    the answers received, dated

    the work pagethe control: supplier-management

    basis GDPR Art. 28(4)

you are done with this phase when you can show a processor list with a checked contract for each.
05

be ready for a breach

Decide who judges a breach, how you tell the authority and the people affected, and how you log it.

  1. decide who judges a breach and when the clock starts

    Name who decides whether a security event is a personal data breach, at any hour. The clock starts when you become aware, which the European Data Protection Board reads as a reasonable degree of certainty that a breach happened. Waiting for the full picture does not move the start.

    • owner head of IT
    • decide and document
    what it produces
    a breach procedure with named roles and a contact sheet
    the proof it leaves
    the procedure and the contact sheet, reviewed yearly

    the work pagethe control: incident-management

    basis GDPR Art. 33(1)

  2. prepare the notification to the authority

    Tell the authority within 72 hours of becoming aware, where feasible, unless a risk to people is unlikely. If you are later, give the reasons. Information may come in phases. Prepare a template, find your authority's channel and decide who may send it. A proposal would lengthen the clock and is not law.

    • owner legal or DPO
    • build and configure
    what it produces
    a notification template and a rule for who sends it
    the proof it leaves
    the template and a dry run

    the work page

    basis GDPR Art. 33(1), 33(4)

  3. decide when you tell the people affected

    When the risk to people is high, tell them without undue delay. Write down who judges the level of risk and what the message to them says in plain words.

    • owner legal or DPO
    • decide and document
    what it produces
    a rule for judging the risk and a message template
    the proof it leaves
    the rule and the template, approved by management

    the work page

    basis GDPR Art. 34(1)

  4. keep a breach log

    Document every personal data breach, including the ones you did not notify: facts, effects and the action taken, with the reasoning for not notifying. The log lets the authority verify compliance.

    • owner head of IT
    • build and configure
    what it produces
    a breach log with a fixed set of fields
    the proof it leaves
    the log, with entries dated

    the work pagethe control: incident-management

    basis GDPR Art. 33(5)

you are done with this phase when you can show a breach procedure with named roles, a notification template and a log.
06

show your work

Keep the proof together and report to management.

  1. keep the proof in one place

    Collect the outputs of every step above in one folder: records, risk register, access reviews, restore tests, processor checks and the breach log. After a breach you still have to show that your measures were appropriate, and this folder is how.

    • owner head of IT
    • prove and operate
    what it produces
    an evidence folder organised by measure
    the proof it leaves
    the folder, with each item dated

    basis GDPR Art. 5(2), 24(1)

  2. run a breach drill

    Run a short exercise on a realistic scenario with the people who would be in the room. Time the steps up to the notification decision, write down what went wrong and who fixes it.

    • owner everyone
    • prove and operate
    what it produces
    an exercise report with actions and owners
    the proof it leaves
    the report and the action list, closed or dated

    basis working practice. No legal text sets this.

  3. report to management

    Once a year, show management the state of each measure, the processors with open gaps and the breaches logged. Record what they decided.

    • owner board
    • prove and operate
    what it produces
    a yearly report to the board
    the proof it leaves
    the report and the minutes

    the work page

    basis working practice. No legal text sets this.

you are done with this phase when you can hand a regulator or a court one folder that shows each measure working.

who carries what

The same steps, grouped by the person who has to act.

board

legal or DPO

head of IT

procurement

everyone

controls you will need

Each control has its own page: what it is, what to look for, where it goes wrong and the proof it leaves.

    check it yourself

    your next step

    Pick one recent security event and write down, in one paragraph, whether it was a personal data breach and why.

    open the incident work