GDPR Compliance

About this Service

This GDPR Gap Assessment is a self-assessment tool designed to help organisations evaluate their current level of GDPR readiness and identify potential gaps in their privacy documentation, policies, procedures, and operational practices.

The assessment is intended for informational and planning purposes only. It does not constitute legal advice, certification, regulatory approval, or confirmation that your organisation complies with the UK GDPR, EU GDPR, or any other applicable privacy legislation.

Accuracy of Information

The quality and usefulness of the assessment depend entirely on the accuracy and completeness of the information you provide.

By submitting this assessment, you confirm that:

• the information provided is true, accurate, and complete to the best of your knowledge;
• you are authorised to submit this information on behalf of your organisation, where applicable; and
• you understand that incomplete or inaccurate information may affect the accuracy of the assessment and any documents or recommendations produced.

No Legal or Regulatory Advice

The assessment and any resulting reports, recommendations, scores, or generated documentation are provided as guidance only.

They should not be relied upon as legal advice or as evidence of GDPR compliance.

Where appropriate, you should seek independent legal, regulatory, or professional advice before relying on any recommendations or implementing significant privacy-related decisions.

Scope of the Assessment

This assessment evaluates your responses against generally accepted GDPR good practices and accountability principles.

It does not:

• guarantee compliance with applicable legislation;
• identify every legal obligation applicable to your organisation;
• replace a professional GDPR audit;
• replace legal advice;
• assess technical cybersecurity vulnerabilities;
• assess sector-specific regulatory obligations unless expressly stated.

Certain industries (such as healthcare, education, financial services, charities, or public authorities) may be subject to additional legal or regulatory requirements beyond the scope of this assessment.

One-Time Online Session

This assessment must be completed during a single online session.

Responses are not automatically saved, and you cannot pause and resume the assessment at a later time.

If you leave, refresh, or close the page before submitting the completed assessment, your responses may be lost and a new assessment may be required.

Storage of Submitted Information

To protect your privacy:

• your responses are not stored in the online assessment system or database;
• once submitted, a copy of your responses is sent to the email address you provide;
• a copy is also sent securely to us for the purpose of preparing your assessment, report, generated documentation, or any related services you have requested.

You are responsible for ensuring that the email address provided is accurate and accessible.

Confidentiality

Information submitted through this assessment will be treated as confidential and used solely for:

• preparing your requested assessment or documentation;
• communicating with you regarding your order;
• providing any follow-up services you request;
• complying with applicable legal or contractual obligations.

We will not use your information for unrelated purposes without an appropriate lawful basis.

Personal information

You should provide only the information reasonably necessary to complete this assessment.

Unless specifically requested, please do not include:

• passwords;
• payment card information;
• government-issued identity numbers;
• medical records;
• special category personal information;
• confidential information relating to third parties that is not required for the assessment.

Intellectual Property

The assessment methodology, questionnaires, reports, templates, generated documentation, and supporting materials remain our intellectual property unless otherwise agreed in writing.

Upon successful purchase, you are granted a non-exclusive licence to use the resulting documents within your own organisation.

The assessment, reports, templates, or generated documents may not be resold, redistributed, or commercially exploited without our prior written permission.

Limitation of Liability

To the maximum extent permitted by law, we shall not be liable for any loss, damage, regulatory action, financial loss, business interruption, or other consequences arising from:

• inaccurate information supplied by you;
• failure to implement recommended actions;
• changes in legislation or regulatory guidance after the assessment;
• reliance solely on the assessment without obtaining appropriate professional advice where required.

Our total liability relating to this service shall not exceed the amount paid for the assessment.

Cancellation and Refunds

As this service begins immediately after payment and involves the provision of digital content and professional services, purchases may not be refundable once access to the assessment has been provided, except where required by applicable consumer protection laws.

Changes to this Service

We reserve the right to improve, update, or modify the assessment, questionnaires, scoring methodology, and generated documentation to reflect changes in legislation, regulatory guidance, or best practices.

Such changes will not affect reports already delivered.

Acceptance

By proceeding with payment and submitting this assessment, you confirm that you have read, understood, and agree to these Terms & Conditions.

It applies to people who buy or receive services (includes clients, service users, residents, general patients in non-specialist contexts):

• Privacy Policy;
• Customer Privacy Notice;
• Data Inventory;
• ROPA;
• Data Retention Schedule;
• Processor Register;
• Data Subject Rights Procedure;
• Data Breach Procedure

Additional privacy and regulatory obligations may apply.

If your organisation provides healthcare services or processes health-related personal information, you are likely processing special category data under GDPR. This type of information requires a higher level of protection and must be handled with additional safeguards.

Depending on your role (e.g. healthcare provider, clinic, therapist, medical practice, or health-tech service), you may also be subject to sector-specific laws, professional codes of conduct, or regulatory requirements that go beyond GDPR.

This assessment focuses on general GDPR compliance requirements and does not cover healthcare-specific regulatory frameworks in detail. You may need additional specialist guidance to ensure full compliance.

Documents commonly required: 

• Privacy Policy
• Patient Privacy Notice (or Service User Privacy Notice)
• Data Inventory
• Record of Processing Activities (ROPA)
• Data Retention Schedule
• Processor Register (third-party healthcare systems, labs, cloud providers)
• Data Subject Rights Procedure
• Data Breach Response Procedure

Special category (high-risk processing): 

• Data Protection Impact Assessment (DPIA) (strongly recommended in most healthcare contexts)
• Special Category Data Policy or Handling Procedure (health data governance rules)
• Lawful Basis & Condition for Processing Special Category Data documentation (e.g. healthcare provision, consent where applicable)
• Confidentiality & Professional Duty Policy (where relevant)

Security and Access Control: 

• Information Security Policy
• Access Control Policy (role-based access to patient records)
• Audit Logging / Access Monitoring Procedure
• Device Security / Mobile Device Policy (if applicable)
• Encryption Policy or Technical Security Standard

Operational Procedures: 

• Data Subject Rights Procedure (including access to medical records requests)
• Data Sharing / Care Coordination Procedure (sharing with labs, specialists, insurers, etc.)
• Incident & Data Breach Response Procedure (with healthcare escalation considerations)

Consent and Patient Communication (where applicable): 

• Consent Management Procedure (if consent is used as a lawful basis for any processing)
• Patient Communication / Information Provision Procedure
• Child / Vulnerable Person Safeguarding Privacy Procedure (if applicable)

Retention and Records Management

• Medical Records Retention Schedule (often sector-specific and longer than standard business retention)
• Records Management Policy (including archiving, clinical record integrity, and deletion restrictions)

Additional considerations

You may also need to consider:

• Whether you are processing special category health data under GDPR Article 9
• Whether processing is necessary for healthcare provision or medical diagnosis
• Whether a DPIA is required before introducing new systems or technologies
• Whether you are acting as a data controller, joint controller, or processor
• Whether additional professional or statutory confidentiality obligations apply.

It applies to leads, enquiries, quote requests, and pre-contract interactions (excluding marketing):

• Privacy Policy;
• Data Inventory;
• ROPA;
• Data Subject Rights Procedure;
• Data Breach Procedure.

It applies to employees, apprentices, trainees, interns, agency staff, and volunteers with employee-like access:

• Employee Privacy Notice;
• Data Inventory;
• ROPA;
• Data Retention Schedule;
• Information Security Policy;
• Access Control Policy;
• Training Records;
• Data Subject Rights Procedure;
• Data Breach Procedure.

It applies to recruitment candidates (including CV data, interviews, and agency-supplied candidates):

• Recruitment Privacy Notice;
• Data Retention Schedule (recruitment-specific);
• Data Inventory;
• ROPA;
• Data Subject Rights Procedure;
• Data Breach Procedure.

It applies to independent workers (consultants, sole traders, and gig workers):

• Supplier/Vendor Privacy Notice;
• Data Inventory;
• ROPA;
• Processor/Vendor Register;
• Data Retention Schedule;
• Data Subject Rights Procedure;
• Data Breach Procedure.

It applies to business contacts at third-party organisations: 

• Supplier Privacy Notice;
• Processor/Vendor Register;
• Data Inventory;
• ROPA;
• Data Retention Schedule;
• Data Subject Rights Procedure;
• Data Breach Procedure.

It applies to users of websites, including anonymous visitors, portal users, and form users:

• Privacy Policy;
• Cookie Policy;
• Consent Management records (if applicable);
• Data Inventory;
• ROPA;
• Data Subject Rights Procedure;
• Data Breach Procedure.

It applies to newsletter subscribers, mailing lists, and promotional audiences: 

• Privacy Policy;
• Consent Register;
• Consent Management Procedure;
• Data Inventory;
• ROPA;
• Data Subject Rights Procedure;
• Data Breach Procedure.

It applies to membership organisations, clubs, associations, and subscription members: 

• Member Privacy Notice;
• Data Inventory;
• ROPA;
• Data Retention Schedule;
• Consent Register (if applicable);
• Data Subject Rights Procedure;
• Data Breach Procedure.

If your organisation collects personal information from donors, sponsors, or supporters, you should document how this information is collected, used, shared, retained, and protected. Depending on your activities, you may also need procedures for managing consent, fundraising communications, and donor preferences.

Charities and non-profit organisations may also be subject to additional legal or regulatory obligations relating to fundraising, financial transparency, and record keeping that are outside the scope of this GDPR assessment.

Documents commonly required (excluding marketing): 

• Privacy Policy;
• Donor Privacy Notice;
• Data Inventory;
• ROPA;
• Data Retention Schedule;
• Processor Register;
• Data Subject Rights Procedure;
• Data Breach Procedure.

If your organisation provides education, training, or learning services, you should document how student information is collected, used, stored, shared, retained, and protected. Educational organisations often process a wider range of personal information, including academic records, attendance information, assessment results, and, in some cases, special category personal information.

Depending on your jurisdiction and the age of the students, additional education-specific laws or safeguarding requirements may apply. These requirements are outside the scope of this GDPR assessment.

Documents commonly required:

• Privacy Policy
• Student Privacy Notice
• Data Inventory
• Record of Processing Activities (ROPA)
• Data Retention Schedule
• Processor Register
• Data Subject Rights Procedure
• Data Breach Response Procedure
• Consent Management Procedure (where consent is relied upon)
• Data Protection Impact Assessment (DPIA), where high-risk processing is carried out (for example, large-scale monitoring, biometrics, or certain educational technologies).

Additional privacy obligations may apply.

If your organisation collects or processes personal information relating to children or minors, you should ensure that their information receives appropriate protection. Depending on the age of the child, the type of services provided, and the applicable laws in your jurisdiction, you may need to obtain parental or guardian consent, provide privacy information in clear and age-appropriate language, and implement additional safeguards to protect children's personal information.

This assessment covers the general GDPR requirements for processing personal information. However, organisations working with children should also consider any sector-specific legal, safeguarding, or regulatory obligations that may apply.

Depending on your jurisdiction and the age of the students, additional education-specific laws or safeguarding requirements may apply. These requirements are outside the scope of this GDPR assessment.

The standard GDPR documentation remains applicable, with particular attention to:

• Privacy Policy (child-appropriate where needed);
• DPIA (often required);
• Data Inventory;
• ROPA;
• Consent Management Procedure (where applicable);
• Data Subject Rights Procedure;
• Data Breach Procedure;
• Enhanced safeguards documentation

Additional Considerations

You should also consider whether your organisation has documented:

• How the age of children is verified, where necessary.
• When parental or guardian consent is required and how it is obtained.
• How privacy information is presented in language appropriate for the intended age group.
• Any additional security and safeguarding measures used to protect children's personal information.
• Procedures for responding to requests from children or their parents/guardians, where applicable.

Based on the information you provided and the documents you need to have in place, this section will help you identify:

• Which GDPR-related documents your organisation already has.
• Whether they have been reviewed and kept up to date.
• Whether you understand the purpose of each document.
• Which documents may still need to be created.

For each document, indicate its current status.

To comply with the GDPR, organisations should understand what personal information they process, why they process it, where it is stored, who has access to it, and how it is protected.

This section assesses whether your organisation has identified and documented these activities.