GDPR compliance steps: building a programme you can prove, from scope to upkeep

What GDPR compliance steps lead to, if not a certificate

Nobody issues GDPR certification the way a certification body issues an ISO certificate. The Regulation places the burden on you: under Article 5(2) the controller must be able to demonstrate that the principles are met, and Article 24 asks for measures that prove processing follows the law, reviewed as things change. Compliance is judged whenever someone asks.

Three kinds of reviewer ask. Supervisory authorities investigate complaints and breaches, with powers that reach a ban on processing and fines. Enterprise customers send questionnaires and sometimes their own auditors. People whose data you hold exercise their rights and expect an answer on time. The steps below give each of them the same answer: a documented decision, a control that operates and a record that proves it.

The obligations themselves are explained in the GDPR requirements guide; this guide covers the order of work.

Steps 1 and 2: define the programme, then measure the gap

Step 1: settle scope, roles and reach

List the legal entities, countries and sites in scope. For each major activity, decide whether you act as controller (deciding why and how data is processed) or processor (acting on another organisation's instructions); many businesses are both. If you are established outside the EU, check whether Article 3(2) reaches you and, if so, whether Article 27 requires an EU representative. Record whether the Article 37 tests require a data protection officer, and name a privacy lead either way. Then note who will judge the result, a customer, a regulator or a group parent, because that shapes the evidence you prioritise.

Step 2: gap analysis

Sterling's gap analysis, the first stage of the engagement, inventories processing activities, the systems holding personal data and the flows between them, suppliers and group companies included. Existing notices, contracts, controls and procedures are tested against each obligation; what works is kept, and each gap gets an action, an owner and a date. The free online readiness check is a shorter self-assessment for before an engagement; it does not replace the inventory the later steps depend on.

Step 3: implement the decisions and controls

Implementation is the longest step. Work in this order, because each decision feeds the next.

• Lawful basis per activity. Choose one of the six Article 6 bases for each activity and record why, with legitimate-interest assessments where needed. Consent must be provable and as easy to withdraw as to give; special-category data needs a documented Article 9 condition.
• Record of processing. Turn the inventory into the Article 30 record. The under-250 exemption falls away for processing that is not occasional, carries a risk or involves special-category data, so check before relying on it.
• Notices. Write privacy information for each audience (customers, employees, applicants, website visitors) and place it where the data is collected.
• Processors and transfers. Put Article 28(3) terms in every processor contract, approve sub-processors, and record the safeguard for each flow outside the EU and EEA.
• Rights and breaches. Give requests one route, an identity check and a log so each is answered within one month; set up an incident procedure that assesses risk and, where notification is required, notifies the supervisory authority without undue delay and, where feasible, within 72 hours.
• Security, retention and DPIAs. Match security to the risk, build retention and deletion into the systems, and complete a DPIA before high-risk processing goes live.

The resulting documents are listed in GDPR documentation; training is covered in the GDPR training guide.

Step 4: operate, audit and review

A programme proves itself only after it has run: requests logged and answered, breaches recorded (including those you decided not to report, with the reason), DPIA screening applied to new projects. Give the controls time to leave records before anyone outside looks.

An internal audit against the Regulation then tests whether the record matches the systems people use, whether notices match what is collected and whether deadlines were met. A management review with the DPO or privacy lead decides what changes. Sterling raises findings first, so they are closed with evidence before a customer or regulator sees them. The GDPR internal audit guide covers the audit itself.

Step 5: the regulator or customer review

With no certification audit to book, the external review arrives on someone else's timetable: a customer questionnaire, a client audit, due diligence in a transaction or a regulator's enquiry after a complaint. Each asks you to show the programme, and a programme built through the earlier steps answers from evidence that already exists.

If a certificate is wanted, two routes exist: an approved Article 42 scheme, voluntary and few in number, whose certificate under Article 42(4) does not reduce your responsibility; or ISO/IEC 27701, a certifiable privacy management system standard that is not an Article 42 certification. The comparison with ISO/IEC 27701, ISO/IEC 27001 and SOC 2 explains when each fits.

Step 6: keep the programme current

A GDPR programme decays quietly: a new platform arrives without an agreement, a supplier moves hosting abroad. Tie privacy to events that already happen: new systems trigger DPIA screening, new suppliers trigger contract review, change updates the record, and every request and breach is logged. An annual internal audit and management review close the loop. The Commission has proposed simplifications, including a wider record-keeping exemption, but until they are adopted the current text and thresholds apply. Sterling's Sustain™ phase provides internal audits, DPIA support and regulatory updates after the build.

How long the steps take, and what slows them down

Three to eight months is the realistic range from scoping to a programme ready for review: shorter with an ISO/IEC 27001 system and a data inventory already in place, longer with hundreds of activities, many suppliers and several countries. Writing speed rarely sets the date; these do:

• Undecided lawful bases and retention periods. Until the business commits, nothing downstream can be finalised.
• Supplier negotiations. Signed agreements and sub-processor answers from large suppliers take time.
• IT changes. Deletion, access restriction and logging often need system work that competes with other projects.
• A single owner. When one person carries the whole programme, it stops when they are busy; process owners must hold their own parts.
• Templates without an inventory. Policies adopted before anyone has mapped the data describe a business that does not exist.

What each part of the work costs is covered in GDPR compliance cost: what moves the price.

GDPR compliance steps: questions buyers ask