GDPR requirements depend on the processing activity, territorial scope and whether an organisation acts as controller or processor. Start by identifying those facts, then connect each applicable duty to an owner and evidence that it is working. An organisation’s size can affect particular provisions, but does not by itself remove core obligations.
This article sets out the core GDPR requirements that organisations should assess, structured around the regulation’s main pillars. Whether you are building a compliance programme from scratch or auditing an existing one, these are the obligations that supervisory authorities expect you to meet.
What Are the Core GDPR Requirements?
The GDPR requirements are organised around binding principles codified in Article 5. These principles govern every processing activity and serve as the foundation for all specific obligations in the regulation. They include lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
Violating these principles triggers the highest penalty tier under the GDPR. For a detailed breakdown of each principle, see our data privacy principles guide.
Territorial scope
The GDPR applies to processing in the context of an EU establishment’s activities, whether or not processing occurs in the EU. For an organisation without such an establishment, Article 3(2) covers processing related to offering goods or services to people in the Union or monitoring their behaviour there. Citizenship or simply holding an EEA resident’s details does not establish scope. Apply the territorial-scope analysis to each relevant activity and confirm the EEA framework where appropriate.
Lawful basis for processing
Every processing activity must rest on one of six legal bases defined in the GDPR. The most commonly relied upon are consent, contractual necessity, and legitimate interest. Choosing the wrong legal basis, or failing to document the choice, is one of the most frequent compliance failures.
Where you rely on consent, it must be freely given, specific, informed, and unambiguous. Silence and pre-ticked boxes do not provide affirmative consent. Bundled choices or conditional access require careful assessment of specificity and whether consent is freely given. The EDPB Guidelines on consent remain the authoritative reference. For practical implementation guidance, see our valid GDPR consent guide.
Where you rely on legitimate interest, you must conduct and document a balancing test: identify the legitimate interest, demonstrate that processing is necessary to achieve it, and balance it against the rights and freedoms of data subjects. The ICO’s legitimate interests guidance provides a useful assessment template.
How Should Organisations Handle Data Subject Rights?
The GDPR grants individuals enforceable rights that organisations must facilitate. These include the right of access, rectification, erasure, restriction of processing, data portability, and objection. Organisations must also address rights related to automated decision-making and profiling.
Meeting these GDPR requirements demands operational readiness: documented procedures for receiving and processing each type of request, response timelines that comply with the one-calendar-month rule and any properly justified extension under Article 12(3), proportionate identity checks where needed, and the technical capacity to fulfil erasure and portability requests across all systems.
Supervisory authorities increasingly treat rights management as a litmus test for the maturity of an organisation’s compliance programme. Procedural failures in this area carry real financial consequences.
Data retention and storage limitation
Among the most overlooked GDPR requirements is the storage limitation principle. Organisations must not retain identifiable data longer than necessary for the stated processing purpose. This means defining and enforcing retention periods for each data category, supported by automated deletion or anonymisation processes. A documented retention schedule is not only a legal requirement but a practical risk mitigation measure.
Data Protection Impact Assessments
A Data Protection Impact Assessment is required before any processing that is likely to result in a high risk to individuals’ rights and freedoms. Article 35(3) specifically includes systematic and extensive automated evaluation supporting decisions with legal or similarly significant effects, large-scale special-category or criminal-data processing, and large-scale systematic monitoring of publicly accessible areas.
The DPIA must describe the processing operations, assess their necessity and proportionality, evaluate the risks to data subjects, and identify mitigation measures. Failing to conduct a DPIA where one is required is itself a sanctionable violation, independent of whether any actual harm materialises.
Organisational Governance and Accountability
The accountability principle is the structural requirement that binds all other GDPR requirements together. Controllers must not merely comply with the regulation; they must be able to demonstrate compliance at any time and to any supervisory authority that requests evidence.
Role of the Data Protection Officer
Article 37 requires a Data Protection Officer for public authorities or bodies, except courts acting judicially; where core activities require regular and systematic monitoring of people on a large scale; or where core activities involve large-scale processing of special-category or criminal conviction/offence data. A voluntary designation carries the same role safeguards. Assess those criteria before deciding, and protect the DPO’s independence and reporting arrangements.
Privacy by design and by default. Privacy by design is a binding GDPR requirement, not a best practice. Data protection must be embedded into processing activities from the earliest design stage. This means applying data minimisation, pseudonymisation, and access controls as default settings rather than afterthoughts.
Security Measures and Breach Notification
Article 32 requires technical and organisational measures appropriate to risk, taking account of the state of the art, costs and processing context. Encryption and pseudonymisation are measures to consider, not an unqualified statutory prescription for every dataset. Assess access controls, resilience, restoration capability and regular testing against the actual risks; document the choices and verify their operation.
A controller must notify a personal data breach to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless it is unlikely to result in a risk to people. Document all breaches, including the reason for not notifying. High-risk breaches require communication to people without undue delay, subject to Article 34(3). The breach notification playbook separates assessment, authority reporting and individual communication.
Processor Obligations Under the GDPR
GDPR requirements do not apply only to controllers. Data processors have direct legal obligations under the regulation, including maintaining records of processing activities, implementing appropriate security measures, notifying the controller without undue delay upon becoming aware of a breach, and cooperating with supervisory authorities.
The relationship between controller and processor must be governed by a binding contract or other legal act, in writing including electronic form, that specifies the subject matter, duration, nature, and purpose of the processing, as well as the obligations and rights of each party. Supervisory authorities regularly sanction deficiencies in processor agreements and oversight failures.
Turn Requirements Into Evidence an Owner Can Produce
Use one real processing activity to test the programme. For an online order service, follow the customer record from checkout through delivery, support, accounting and deletion. The objective is to find where a documented rule diverges from actual practice.
| Requirement | Evidence to request | Owner’s practical check |
|---|---|---|
| Lawfulness and transparency | Purpose-level legal-basis decision and the notice shown at collection | Does the checkout collect optional data under an unexplained purpose? |
| Records and minimisation | Article 30 record, where required, and actual field list | Do exported spreadsheets or support tools contain additional data? |
| Retention and rights | Deletion configuration and a completed request trail | Do invoices with a legal retention duty remain separate from obsolete marketing profiles? |
| Supplier governance | Article 28 terms, service scope and sub-processor information | Do instructions match the supplier’s actual access and uses? |
| International transfers | Recipients, remote access locations and the applicable Chapter V mechanism | Is an adequacy decision applicable or are safeguards and supplementary measures needed? |
| Security and incidents | Access review, restoration result and notification procedure | Can the team restore the service and identify the person responsible for breach decisions? |
Assign each gap a responsible owner and completion evidence. An outdated policy is repaired by correcting both the document and the underlying process. Record justified non-applicability too: for example, why DPO appointment or a DPIA is not required for a particular activity. Reopen the decision when facts change.
What Practical Steps Should You Take First?
For organisations approaching GDPR requirements systematically, the starting point is a comprehensive GDPR compliance checklist. Prioritise the following actions:
- Map your data. Identify every category of personal data you process, the purposes, legal bases, recipients, and retention periods.
- Verify legal bases. Confirm that every processing activity rests on a documented, defensible legal basis.
- Establish rights procedures. Implement documented workflows for handling data subject requests within the one-month deadline.
- Appoint a DPO if required. Assess whether the mandatory appointment threshold applies and ensure the DPO has the independence and resources the regulation requires.
- Review processor agreements. Audit all contracts with processors to verify they include the mandatory clauses.
- Conduct DPIAs. Identify high-risk processing activities and complete impact assessments before processing begins.
- Prepare for breaches. Document an incident response plan and test it periodically.
FAQ
What are the main GDPR requirements for small businesses?
The GDPR applies regardless of organisation size. Small businesses must comply with the same core requirements: establishing a lawful basis for processing, respecting data subject rights, implementing appropriate security measures, and maintaining records where Article 30 applies. Its under-250-employee exemption is narrow: non-occasional processing, processing likely to risk people’s rights, or special-category/criminal data can defeat it. The obligation to appoint a DPO depends on the nature and scale of processing rather than company size, but all other fundamental requirements apply equally.
How quickly must a breach be reported under the GDPR?
A controller notifies without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to result in a risk to people. A late notification must include reasons for delay; incomplete information can be provided in phases under Article 33(4). Processors instead notify their controller without undue delay. High-risk cases also require Article 34 communication, subject to its exceptions.
Does the GDPR apply to organisations outside Europe?
Yes, where Article 3’s conditions are met. For a non-established organisation, relevant processing must relate to offering goods or services to people in the Union or monitoring their behaviour there. A generally accessible website alone does not establish targeting. Assess any separate EU representative requirement under Article 27.