Complete GDPR Compliance Checklist for Non-EU Businesses — 2026

This checklist covers every GDPR requirement that applies to non-EU businesses processing EU personal data. Use it as your master compliance tracker. Each item links to a detailed guide.

Mandatory Requirements (All Non-EU Businesses)

• ✅ EU Representative (Article 27) — appointed and designated in writing. EU Shield from EUR 490/yr
• ✅ Privacy Policy — includes controller identity, EU Rep contact, processing purposes, legal bases, data subject rights, retention criteria, transfer mechanisms. Template →
• ✅ Record of Processing Activities (Article 30) — document all processing. Template →
• ✅ Cookie Consent — ePrivacy Directive compliant CMP deployed. Guide →
• ✅ Data Subject Request Process — handle DSARs within 30 days. Guide →
• ✅ Data Breach Notification Procedure (Article 33) — 72-hour notification plan. Guide →

Conditional Requirements

• ☐ Data Protection Officer (Article 37) — if large-scale monitoring or special category data. Comparison →
• ☐ Data Processing Agreements (Article 28) — with data processors (hosting, email, analytics, payment). Template →
• ☐ Data Protection Impact Assessment (Article 35) — for high-risk processing. AI Act guide →
• ☐ Cross-Border Transfer Mechanisms (Chapter V) — SCCs or adequacy for transfers. Guide →
• ☐ Consent Records (Article 7) — documented proof of opt-in consent. CMP guide →

Contextual Obligations

• ☐ Data minimization — only collect what’s needed. Guide →
• ☐ Data retention schedule — delete when purpose ends. Guide →
• ☐ Security measures (Article 32) — encryption, access controls, incident response
• ☐ Children’s data (Article 8) — parental consent for under-16s. Education guide →
• ☐ Direct marketing compliance — opt-in for email/SMS. Guide →

Not sure where to start? Contact us — we’ll help you through each step.