Skip to content
GDPR Compliance
On Trove · from Trove (checklist); European Union, CNIL and ENISA (reproduced texts)

GDPR Compliance

Checklist and Official Texts

Load when checking whether a product, feature, vendor or process complies with the EU GDPR.

Read a preview

You can read the contents and the first 2,000 characters.
Free accounts get the whole book.

  • By Trove (checklist); European Union, CNIL and ENISA (official texts)
  • 166 chapters
  • Updated Oct 24, 2026

What’s inside

  • Sources, licences and currency
  • Running a GDPR compliance review
  • Scope and roles
  • Principles and lawful basis
  • Consent
  • Transparency and privacy notices

What is GDPR Compliance?

Load when checking whether a product, feature, vendor or process complies with the EU GDPR, or when building software that handles personal data. Trove's 101-rule GDPR compliance checklist (each rule has a severity, a trigger, an action, a measurable criterion and a counter-example, and cites the law page by page), plus the full official GDPR text (every article and recital), the CNIL GDPR Developer Guide and ENISA's Data Protection Engineering report. Covers lawful basis, consent, privacy notices, data subject requests, records of processing, privacy by design, security, processors, breaches, DPIAs, DPOs, international transfers and developer practices. Companion book: EDPB Guidelines for GDPR Compliance.

Read more

Trove (checklist); European Union, CNIL and ENISA (official texts) · markdown · Listed Oct 24, 2026

  • gdpr
  • privacy
  • data protection
  • compliance
  • eu law

From the first page

1. Read this page, then go to Chapter 2 — Decision Matrix (p. 2). Find your task and jump to the listed chapters. Do not read linearly. 2. Every page in Part A is one chapter and is self-contained. Rules are numbered Rule .. 3. Each rule ends with a Source line. Follow the page number to read the official text before you rely on the rule. 4. To audit a whole product or company, follow the procedure in Chapter 4 (p. 4) and report a gap map. 5. Read Chapter 3 (p. 3) for what this book does not cover, its currency date and the licences of the reproduced texts.

Preview · 2,000 of 732,774 characters

EDPB Guidelines for GDPR Compliance
X Algorithm Growth Hacking: A Complete Guide Based on the Open-Source Code
OpenAI Prompting Best Practices
PlanetScale Database Skills — The Complete Guide

Contents

  1. 01GDPR Compliance: Checklist and Official Textsp.1
    1. How to use this bookp.1
    2. Partsp.1
  2. 02Decision Matrixp.2
  3. 03Sources, licences and currencyp.3
    1. Narrativep.3
    2. Reproduced textsp.3
    3. Scope limitsp.3
    4. Currencyp.3
  4. 04Running a GDPR compliance reviewp.4
    1. Narrativep.4
    2. Procedurep.4
    3. Output formatp.4
    4. Agent rulesp.4
  5. 05Scope and rolesp.5
    1. Narrativep.5
    2. Agent rulesp.5
  6. 06Principles and lawful basisp.6
    1. Narrativep.6
    2. Agent rulesp.6
  7. 07Consentp.7
    1. Narrativep.7
    2. Agent rulesp.7
  8. 08Transparency and privacy noticesp.8
    1. Narrativep.8
    2. Agent rulesp.8
See all 166 parts
  1. 09Data subject rightsp.9
    1. Narrativep.9
    2. Agent rulesp.9
  2. 10Accountability and records of processingp.10
    1. Narrativep.10
    2. Agent rulesp.10
  3. 11Data protection by design and by defaultp.11
    1. Narrativep.11
    2. Agent rulesp.11
  4. 12Security of processingp.12
    1. Narrativep.12
    2. Agent rulesp.12
  5. 13Processors and joint controllersp.13
    1. Narrativep.13
    2. Agent rulesp.13
  6. 14Personal data breachesp.14
    1. Narrativep.14
    2. Agent rulesp.14
  7. 15Data protection impact assessmentsp.15
    1. Narrativep.15
    2. Agent rulesp.15
  8. 16Data protection officer and EU representativep.16
    1. Narrativep.16
    2. Agent rulesp.16
  9. 17International transfersp.17
    1. Narrativep.17
    2. Agent rulesp.17
  10. 18Building software that processes personal datap.18
    1. Narrativep.18
    2. Agent rulesp.18
  11. 19Red Flag Tablep.19
  12. 20Fines, liability and complaintsp.20
    1. Narrativep.20
    2. Fine tiersp.20
    3. Agent rulesp.20
  13. 21GDPR (Regulation (EU) 2016/679) — About this text and article indexp.21
    1. The textp.21
    2. Recitalsp.21
    3. Articlesp.21
  14. 22GDPR Recitals 1–20p.22
    1. Citationsp.22
    2. Recitalsp.22
  15. 23GDPR Recitals 21–40p.23
  16. 24GDPR Recitals 41–60p.24
  17. 25GDPR Recitals 61–80p.25
  18. 26GDPR Recitals 81–100p.26
  19. 27GDPR Recitals 101–120p.27
  20. 28GDPR Recitals 121–140p.28
  21. 29GDPR Recitals 141–160p.29
  22. 30GDPR Recitals 161–173p.30
  23. 31GDPR Article 1 — Subject-matter and objectivesp.31
  24. 32GDPR Article 2 — Material scopep.32
  25. 33GDPR Article 3 — Territorial scopep.33
  26. 34GDPR Article 4 — Definitionsp.34
  27. 35GDPR Article 5 — Principles relating to processing of personal datap.35
  28. 36GDPR Article 6 — Lawfulness of processingp.36
  29. 37GDPR Article 7 — Conditions for consentp.37
  30. 38GDPR Article 8 — Conditions applicable to child's consent in relation to information society servicesp.38
  31. 39GDPR Article 9 — Processing of special categories of personal datap.39
  32. 40GDPR Article 10 — Processing of personal data relating to criminal convictions and offencesp.40
  33. 41GDPR Article 11 — Processing which does not require identificationp.41
  34. 42GDPR Article 12 — Transparent information, communication and modalities for the exercise of the rights of the data subjectp.42
  35. 43GDPR Article 13 — Information to be provided where personal data are collected from the data subjectp.43
  36. 44GDPR Article 14 — Information to be provided where personal data have not been obtained from the data subjectp.44
  37. 45GDPR Article 15 — Right of access by the data subjectp.45
  38. 46GDPR Article 16 — Right to rectificationp.46
  39. 47GDPR Article 17 — Right to erasure (‘right to be forgotten’)p.47
  40. 48GDPR Article 18 — Right to restriction of processingp.48
  41. 49GDPR Article 19 — Notification obligation regarding rectification or erasure of personal data or restriction of processingp.49
  42. 50GDPR Article 20 — Right to data portabilityp.50
  43. 51GDPR Article 21 — Right to objectp.51
  44. 52GDPR Article 22 — Automated individual decision-making, including profilingp.52
  45. 53GDPR Article 23 — Restrictionsp.53
  46. 54GDPR Article 24 — Responsibility of the controllerp.54
  47. 55GDPR Article 25 — Data protection by design and by defaultp.55
  48. 56GDPR Article 26 — Joint controllersp.56
  49. 57GDPR Article 27 — Representatives of controllers or processors not established in the Unionp.57
  50. 58GDPR Article 28 — Processorp.58
  51. 59GDPR Article 29 — Processing under the authority of the controller or processorp.59
  52. 60GDPR Article 30 — Records of processing activitiesp.60
  53. 61GDPR Article 31 — Cooperation with the supervisory authorityp.61
  54. 62GDPR Article 32 — Security of processingp.62
  55. 63GDPR Article 33 — Notification of a personal data breach to the supervisory authorityp.63
  56. 64GDPR Article 34 — Communication of a personal data breach to the data subjectp.64
  57. 65GDPR Article 35 — Data protection impact assessmentp.65
  58. 66GDPR Article 36 — Prior consultationp.66
  59. 67GDPR Article 37 — Designation of the data protection officerp.67
  60. 68GDPR Article 38 — Position of the data protection officerp.68
  61. 69GDPR Article 39 — Tasks of the data protection officerp.69
  62. 70GDPR Article 40 — Codes of conductp.70
  63. 71GDPR Article 41 — Monitoring of approved codes of conductp.71
  64. 72GDPR Article 42 — Certificationp.72
  65. 73GDPR Article 43 — Certification bodiesp.73
  66. 74GDPR Article 44 — General principle for transfersp.74
  67. 75GDPR Article 45 — Transfers on the basis of an adequacy decisionp.75
  68. 76GDPR Article 46 — Transfers subject to appropriate safeguardsp.76
  69. 77GDPR Article 47 — Binding corporate rulesp.77
  70. 78GDPR Article 48 — Transfers or disclosures not authorised by Union lawp.78
  71. 79GDPR Article 49 — Derogations for specific situationsp.79
  72. 80GDPR Article 50 — International cooperation for the protection of personal datap.80
  73. 81GDPR Article 51 — Supervisory authorityp.81
  74. 82GDPR Article 52 — Independencep.82
  75. 83GDPR Article 53 — General conditions for the members of the supervisory authorityp.83
  76. 84GDPR Article 54 — Rules on the establishment of the supervisory authorityp.84
  77. 85GDPR Article 55 — Competencep.85
  78. 86GDPR Article 56 — Competence of the lead supervisory authorityp.86
  79. 87GDPR Article 57 — Tasksp.87
  80. 88GDPR Article 58 — Powersp.88
  81. 89GDPR Article 59 — Activity reportsp.89
  82. 90GDPR Article 60 — Cooperation between the lead supervisory authority and the other supervisory authorities concernedp.90
  83. 91GDPR Article 61 — Mutual assistancep.91
  84. 92GDPR Article 62 — Joint operations of supervisory authoritiesp.92
  85. 93GDPR Article 63 — Consistency mechanismp.93
  86. 94GDPR Article 64 — Opinion of the Boardp.94
  87. 95GDPR Article 65 — Dispute resolution by the Boardp.95
  88. 96GDPR Article 66 — Urgency procedurep.96
  89. 97GDPR Article 67 — Exchange of informationp.97
  90. 98GDPR Article 68 — European Data Protection Boardp.98
  91. 99GDPR Article 69 — Independencep.99
  92. 100GDPR Article 70 — Tasks of the Boardp.100
  93. 101GDPR Article 71 — Reportsp.101
  94. 102GDPR Article 72 — Procedurep.102
  95. 103GDPR Article 73 — Chairp.103
  96. 104GDPR Article 74 — Tasks of the Chairp.104
  97. 105GDPR Article 75 — Secretariatp.105
  98. 106GDPR Article 76 — Confidentialityp.106
  99. 107GDPR Article 77 — Right to lodge a complaint with a supervisory authorityp.107
  100. 108GDPR Article 78 — Right to an effective judicial remedy against a supervisory authorityp.108
  101. 109GDPR Article 79 — Right to an effective judicial remedy against a controller or processorp.109
  102. 110GDPR Article 80 — Representation of data subjectsp.110
  103. 111GDPR Article 81 — Suspension of proceedingsp.111
  104. 112GDPR Article 82 — Right to compensation and liabilityp.112
  105. 113GDPR Article 83 — General conditions for imposing administrative finesp.113
  106. 114GDPR Article 84 — Penaltiesp.114
  107. 115GDPR Article 85 — Processing and freedom of expression and informationp.115
  108. 116GDPR Article 86 — Processing and public access to official documentsp.116
  109. 117GDPR Article 87 — Processing of the national identification numberp.117
  110. 118GDPR Article 88 — Processing in the context of employmentp.118
  111. 119GDPR Article 89 — Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposesp.119
  112. 120GDPR Article 90 — Obligations of secrecyp.120
  113. 121GDPR Article 91 — Existing data protection rules of churches and religious associationsp.121
  114. 122GDPR Article 92 — Exercise of the delegationp.122
  115. 123GDPR Article 93 — Committee procedurep.123
  116. 124GDPR Article 94 — Repeal of Directive 95/46/ECp.124
  117. 125GDPR Article 95 — Relationship with Directive 2002/58/ECp.125
  118. 126GDPR Article 96 — Relationship with previously concluded Agreementsp.126
  119. 127GDPR Article 97 — Commission reportsp.127
  120. 128GDPR Article 98 — Review of other Union legal acts on data protectionp.128
  121. 129GDPR Article 99 — Entry into force and applicationp.129
  122. 130CNIL GDPR Developer Guide — About this documentp.130
    1. The guide's own introductionp.130
    2. Sheetsp.130
  123. 131CNIL GDPR Developer Guide — Sheet 0: Develop in compliance with the GDPRp.131
    1. Whether you work alone, are part of a team developing a project, manage a development team, or are a service provider carrying out developments for third parties, it is essential to ensure that user data and all personal data processing are sufficiently protected throughout the lifecycle of the project.p.131
  124. 132CNIL GDPR Developer Guide — Sheet 1: Identify personal datap.132
    1. Definitionp.132
    2. Examples of personal datap.132
    3. Anonymisation of personal datap.132
    4. Pseudonymization of personal datap.132
  125. 133CNIL GDPR Developer Guide — Sheet 2: Prepare your developmentp.133
    1. Methodological choicesp.133
    2. Technological choicesp.133
  126. 134CNIL GDPR Developer Guide — Sheet 3: Secure your development environmentp.134
    1. Assess your risks and adopt the appropriate security measuresp.134
    2. Secure your servers and workstations in a homogeneous and reproducible wayp.134
    3. Put special emphasis on access management and traceability of operationsp.134
  127. 135CNIL GDPR Developer Guide — Sheet 4: Manage your source codep.135
    1. Set up your version control system efficiently, thinking about its security.p.135
    2. Be aware of your source code content.p.135
    3. Examples of toolsp.135
  128. 136CNIL GDPR Developer Guide — Sheet 5: Make an informed choice of architecturep.136
    1. Examining life cycle of data and processes, from collection to erasurep.136
    2. In case of use of external hostingp.136
  129. 137CNIL GDPR Developer Guide — Sheet 6: Secure your websites, applications and serversp.137
    1. Securing communication networksp.137
    2. Securing Authenticationsp.137
    3. Securing infrastructuresp.137
  130. 138CNIL GDPR Developer Guide — Sheet 7: Minimize data collectionp.138
    1. Before collection, think about the different types of data you need to collect and try to limit your collection to what is strictly necessary.p.138
    2. Once the data has been collected, set up automatic deletion mechanisms.p.138
  131. 139CNIL GDPR Developer Guide — Sheet 8: Manage user profilesp.139
    1. Good practices for user managementp.139
    2. Streamline the management of clearance profilesp.139
  132. 140CNIL GDPR Developer Guide — Sheet 9: Control your libraries and SDKsp.140
    1. Make an informed choicep.140
    2. Evaluate the selected elementsp.140
    3. Maintain libraries and SDKsp.140
  133. 141CNIL GDPR Developer Guide — Sheet 10: Ensure quality of the code and its documentationp.141
    1. Document code and architecturep.141
    2. Check the quality of your code and its documentation.p.141
  134. 142CNIL GDPR Developer Guide — Sheet 11: Test your applicationsp.142
    1. Automate testingp.142
    2. Integrate testing into your business strategy.p.142
    3. Watch out for your test data!p.142
  135. 143CNIL GDPR Developer Guide — Sheet 12: Inform usersp.143
    1. Who to inform and when?p.143
    2. What information do I have to give?p.143
    3. In what form should I provide this information?p.143
    4. What communication should be made when data security is compromised?p.143
    5. Useful resourcesp.143
  136. 144CNIL GDPR Developer Guide — Sheet 13: Prepare for the exercise of people rightsp.144
    1. Minimum measures to be put in placep.144
    2. Here are some examples of rights and their possible implementationp.144
    3. In conclusionp.144
  137. 145CNIL GDPR Developer Guide — Sheet 14: Define a data retention periodp.145
    1. Data retention cyclesp.145
    2. Some examples of shelf lifep.145
  138. 146CNIL GDPR Developer Guide — Sheet 15: Take into account the legal basis in the technical implementationp.146
    1. Definition of the legal bases in the GDPRp.146
    2. Choose the appropriate legal basisp.146
    3. Rights exercises and modalities of information to be provided according to legal basisp.146
    4. The specific case of cookies and other trackersp.146
  139. 147CNIL GDPR Developer Guide — Sheet 16: Use analytics on your websites and applicationsp.147
    1. Obtaining consentp.147
    2. To benefit from the exemption from consentp.147
    3. In practicep.147
  140. 148ENISA Data Protection Engineering — About this documentp.148
    1. About ENISA, contributors and editors (from the PDF)p.148
    2. Legal notice (from the PDF)p.148
    3. Copyright notice (from the PDF)p.148
    4. Pages in this bookp.148
  141. 149ENISA Data Protection Engineering — EXECUTIVE SUMMARYp.149
  142. 150ENISA Data Protection Engineering — 1. INTRODUCTIONp.150
    1. 1.1 DATA PROTECTION BY DESIGNp.150
    2. 1.2 SCOPE AND OBJECTIVESp.150
    3. 1.3 STRUCTURE OF THE DOCUMENTp.150
  143. 151ENISA Data Protection Engineering — 2. ENGINEERING DATA PROTECTIONp.151
    1. 2.1 FROM DATA PROTECTION BY DESIGN TO DATA PROTECTION ENGINEERINGp.151
    2. 2.2 CONNECTION WITH DPIAp.151
    3. 2.3 PRIVACY ENHANCING TECHNOLOGIESp.151
  144. 152ENISA Data Protection Engineering — 3. ANONYMISATION AND PSEUDONYMISATIONp.152
    1. 3.1 ANONYMISATIONp.152
    2. 3.2 k-ANONYMITYp.152
    3. 3.3 DIFFERENTIAL PRIVACYp.152
    4. 3.4 SELECTING THE ANONYMISATION SCHEMEp.152
  145. 153ENISA Data Protection Engineering — 4. DATA MASKING AND PRIVACY-PRESERVING COMPUTATIONSp.153
    1. 4.1 HOMOMORPHIC ENCRYPTIONp.153
    2. 4.2 SECURE MULTIPARTY COMPUTATIONp.153
    3. 4.3 TRUSTED EXECUTION ENVIRONMENTSp.153
    4. 4.4 PRIVATE INFORMATION RETRIEVALp.153
    5. 4.5 SYNTHETIC DATAp.153
  146. 154ENISA Data Protection Engineering — 5. ACCESS. COMMUNICATION AND STORAGEp.154
    1. 5.1 COMMUNICATION CHANNELSp.154
    2. 5.2 PRIVACY PRESERVING STORAGEp.154
    3. 5.3 PRIVACY-ENHANCING ACCESS CONTROL, AUTHORIZATION AND AUTHENTICATIONp.154
  147. 155ENISA Data Protection Engineering — 6.1 PRIVACY POLICIESp.155
  148. 156ENISA Data Protection Engineering — 6.2 PRIVACY ICONSp.156
  149. 157ENISA Data Protection Engineering — 6.3 STICKY POLICIESp.157
  150. 158ENISA Data Protection Engineering — 6.4 PRIVACY PREFERENCE SIGNALSp.158
  151. 159ENISA Data Protection Engineering — 6.5 PRIVACY DASHBOARDSp.159
    1. 6.5.1 Services-side privacy dashboardsp.159
    2. 6.5.2 User-side privacy dashboardsp.159
  152. 160ENISA Data Protection Engineering — 6.6 CONSENT MANAGEMENTp.160
  153. 161ENISA Data Protection Engineering — 6.7 CONSENT GATHERINGp.161
  154. 162ENISA Data Protection Engineering — 6.8 CONSENT MANAGEMENT SYSTEMSp.162
  155. 163ENISA Data Protection Engineering — 6.9 EXERCISING RIGHT OF ACCESSp.163
    1. 6.9.1 Delegation of Access Rights Requestsp.163
  156. 164ENISA Data Protection Engineering — 6.10 EXERCISING RIGHT TO ERASURE, RIGHT TO RECTIFICATIONp.164
  157. 165ENISA Data Protection Engineering — 7. CONCLUSIONSp.165
    1. 7.1 DEFINING THE MOST APPLICABLE TECHNIQUEp.165
    2. 7.2 ESTABLISHING THE STATE-OF-THE-ARTp.165
    3. 7.3 DEMONSTRATE COMPLIANCE AND PROVIDE ASSURANCEp.165
  158. 166ENISA Data Protection Engineering — 8. REFERENCESp.166