Skip to content
SimpleAct Logo

Guide · GDPR obligations

Last reviewed: 6 October 2026

GDPR compliance for businesses: obligations overview & roadmap

Which obligations does the GDPR impose, who has to meet them and where do you start? Here you find all key articles as a table linked to our guides, a nine-step roadmap, the deadlines, the rules on data protection officers, the fine levels – and a self-check with a gap list.

Start the self-checkGo to the obligations table
  • 22 obligations with article and addressee
  • Nine-step roadmap
  • Self-check with a gap list to copy
  • Fine levels under Art. 83 at a glance
app.simpleact.de

GDPR self-check

Sample result · 16 questions

A

Status by area

  • Basics & transparency3/4
  • Vendors & third countries1/2
  • Security & risk2/3
  • Processes & deadlines1/3
  • Organisation & AI2/4

Gap list

  • No data breach processArt. 33
  • Retention periods not setArt. 5(1)(e)
  • Third-country transfer without basisArt. 44 et seq.

Each gap with guide and fine level

In short

GDPR compliance means processing personal data according to the principles in Art. 5 and being able to demonstrate it. The core is the record of processing, legal bases, information duties, contracts with processors, TOMs, processes for data subject requests and breaches, retention periods and – where needed – a DPIA and a data protection officer. It applies to organisations of every size.

Basics

What GDPR compliance actually means

The General Data Protection Regulation (Regulation (EU) 2016/679) has applied directly in all EU Member States since 25 May 2018 (Art. 99(2)). In Germany it is supplemented by the Federal Data Protection Act (BDSG), for example on the duty to designate a data protection officer. It covers every organisation that processes personal data – from a craft business with a customer file to a group of companies. There is no minimum size below which the GDPR does not apply; individual duties such as the record of processing have only narrow exemptions.

The yardstick is Art. 5(1): data must be processed lawfully, fairly and transparently, for specified purposes, limited to what is necessary, accurate, kept no longer than needed and appropriately secured. Art. 5(2) adds accountability: the controller is responsible for compliance and must be able to demonstrate it. That second part is what turns data protection into a documentation task.

Art. 24(1) makes this concrete: the controller implements appropriate technical and organisational measures "to ensure and to be able to demonstrate" that processing complies with the Regulation – taking into account the nature, scope, context and purposes of processing and the risks for data subjects. The second sentence requires those measures to be reviewed and updated where necessary. Compliance is therefore not a project with an end date but a cycle.

Many obligations fall on the controller, the body that decides on the purposes and means of processing. Some also fall on the processor that handles data on its behalf – such as its own record of processing (Art. 30(2)), security of processing (Art. 32) and the duty to inform the controller of a breach without undue delay (Art. 33(2)). In the obligations table below you see who each duty applies to.

This page is a guide: it orders the obligations, suggests a sequence and shows gaps. For each topic we link to a dedicated guide with a template. If you later want to run registers and deadlines in software, the GDPR software page describes how that looks in SimpleAct. This page is not legal advice.

GDPR applies from (Art. 99(2))
25.05.2018
GDPR applies from (Art. 99(2))
Deadline for data subject requests (Art. 12(3))
1 month
Deadline for data subject requests (Art. 12(3))
Breach notification, where feasible (Art. 33(1))
72 h
Breach notification, where feasible (Art. 33(1))

Art. 5 GDPR

The seven principles as the yardstick

Every single GDPR obligation can be traced back to one of these principles. Infringements of Art. 5 fall into the higher fine level under Art. 83(5).

Lawfulness, fairness and transparency
What it requiresEvery processing needs a legal basis and is understandable for data subjects.
How it shows in daily workLegal basis in the RoPA, clear privacy notices
ProvisionArt. 5(1)(a)
Purpose limitation
What it requiresData is collected for specified, explicit and legitimate purposes and not further processed incompatibly.
How it shows in daily workPurpose documented per activity; new purposes are checked
ProvisionArt. 5(1)(b)
Data minimisation
What it requiresOnly data that is adequate, relevant and limited to what is necessary.
How it shows in daily workForms without "just in case" fields; prompts without unnecessary personal data
ProvisionArt. 5(1)(c)
Accuracy
What it requiresData is accurate and, where necessary, kept up to date; inaccurate data is rectified or erased.
How it shows in daily workProcess for rectification requests, master data upkeep
ProvisionArt. 5(1)(d)
Storage limitation
What it requiresData is kept in identifiable form only as long as necessary for the purpose.
How it shows in daily workRetention periods per data category, deletion log
ProvisionArt. 5(1)(e)
Integrity and confidentiality
What it requiresAppropriate security, protection against unauthorised processing, loss and destruction.
How it shows in daily workTOMs under Art. 32, access concept, backups
ProvisionArt. 5(1)(f)
Accountability
What it requiresThe controller is responsible for compliance and must be able to demonstrate it.
How it shows in daily workCurrent registers, approvals, training records, change history
ProvisionArt. 5(2)

Obligations overview

The key GDPR obligations at a glance

Article, obligation, who it applies to and where to read on. C = controller, P = processor. The table is a selection of the obligations most often relevant in organisations.

Scroll the table sideways →

The key GDPR obligations at a glance
ArticleObligationWhoResource
Art. 5(1)Comply with the principles: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentialityCPrinciples table
Art. 5(2), Art. 24Demonstrate compliance; implement appropriate TOMs and review and update them where necessaryCRoadmap
Art. 6Set one of the six legal bases for each processing (consent, contract, legal obligation, vital interests, public task, legitimate interests)CRecords of processing
Art. 7Be able to demonstrate consent; allow withdrawal at any timeCConsent management
Art. 9Process special categories (e.g. health data) only on the basis of an exception under para. 2CDPIA
Art. 12Communicate transparently; respond to requests without undue delay and at the latest within one monthCData subject rights
Art. 13, 14Inform data subjects about purposes, legal basis, recipients, storage period and rightsCData subject rights
Art. 15–21Fulfil access, rectification, erasure, restriction, portability and objectionCData subject rights
Art. 17, Art. 5(1)(e)Erase data when the purpose ends; set retention periods and evidence deletionsCDeletion concept
Art. 22No solely automated decisions with legal or similarly significant effects without an exception and safeguardsCDPIA
Art. 25Data protection by design and by defaultCTOMs
Art. 26For joint controllers, set out the allocation of duties in an arrangementC (joint)Data processing
Art. 28Choose processors carefully and bind them by contract with the content of para. 3(a)–(h)C, PDPA under Art. 28
Art. 30Keep a record of processing activities and make it available to the authority on requestC, PRecords of processing
Art. 32Ensure a level of security appropriate to the risk through TOMs and review it regularlyC, PTOMs under Art. 32
Art. 33Notify breaches to the authority without undue delay and, where feasible, within 72 hours, and document them; the processor informs the controller without undue delayC, PReporting a breach
Art. 34Inform data subjects without undue delay where a high risk is likelyCReporting a breach
Art. 35Carry out a data protection impact assessment before processing likely to result in a high riskCDPIA
Art. 36Consult the authority beforehand if the DPIA indicates a high risk that is not mitigatedCDPIA
Art. 37–39, § 38 BDSGDesignate a data protection officer where the conditions are met; publish contact details and communicate them to the authorityC, PData protection officer
Art. 44–49Transfer to third countries only with an adequacy decision, appropriate safeguards or a derogationC, PThird-country transfers
Art. 82, 83Liability for damage; fines depending on the duty infringed up to €10m / 2 % or €20m / 4 %C, PFines

C = controller · P = processor

For cookies and similar technologies, Germany additionally applies § 25 TDDDG: storing and reading information on end devices generally requires consent unless it is strictly necessary for a service the user explicitly requested.

Roadmap

GDPR compliance in nine steps

An order that has proven itself in practice – as a recommendation, not a requirement of the law. If you already have parts in place, start at the first missing step.

  1. 1

    Clarify responsibilities

    Who owns data protection in management, who coordinates? Check early whether a data protection officer must be designated (Art. 37, § 38 BDSG) – they advise on all further steps.

  2. 2

    Record processing activities

    Collect all processes involving personal data – HR, customers, suppliers, website, IT, AI tools – and document them in the record of processing under Art. 30.

  3. 3

    Set legal bases

    Determine the legal basis under Art. 6 (and for special categories Art. 9) for each processing. Where consent is needed, make sure it can be demonstrated under Art. 7.

  4. 4

    Inform

    Write privacy notices under Art. 13 and 14 for website, customers, applicants and employees. Derive the content from the RoPA so both match.

  5. 5

    Check service providers

    Identify processors, conclude DPAs under Art. 28(3), secure third-country transfers under Art. 44 et seq. Do not forget AI providers.

  6. 6

    Document security

    Describe TOMs under Art. 32 and back them with evidence; plan data protection by design (Art. 25) for new systems.

  7. 7

    Assess risks

    For each processing, check whether a DPIA under Art. 35 is required, and document the decision – even if it reads "not required".

  8. 8

    Set up processes

    Define procedures for data subject requests (one month), breaches (72 hours) and deletion, with owners and deputies. Train staff.

  9. 9

    Review and evidence

    Set fixed review dates, as the second sentence of Art. 24(1) and Art. 32(1)(d) require. An annual pass plus triggers such as new systems or incidents has proven useful.

Self-check

Where does your organisation stand?

Answer 16 questions. On the right you see your status per area and a gap list with article, fine level and guide – ready to copy into your action plan. Your answers do not leave the browser.

Basics & transparency

  • Is there a current record of processing activities?

    Art. 30 · All processes with personal data, last reviewed within the past twelve months

  • Is the legal basis set for every processing?

    Art. 6, 9 · Art. 6(1)(a)–(f), for health data and similar also Art. 9

  • Are data subjects informed through privacy notices?

    Art. 13, 14 · Website, customers, applicants, employees – at collection or at the latest after one month

  • Can you demonstrate consent, including for cookies?

    Art. 7, § 25 TDDDG · Who, when, for what – and withdrawal possible at any time

Vendors & third countries

  • Are DPAs in place with all processors?

    Art. 28 · Cloud, hosting, payroll, support, newsletter, AI services

  • Are transfers to third countries safeguarded?

    Art. 44–49 · Adequacy decision, standard contractual clauses or derogation – per recipient

Security & risk

  • Are TOMs documented and backed by evidence?

    Art. 32 · Encryption, access control, backups, restore, review

  • Is data protection considered from the start for new systems?

    Art. 25 · Privacy-friendly defaults, review before rollout

  • Is it checked and documented whether a DPIA is needed?

    Art. 35 · Especially for AI, profiling, sensitive data, monitoring

Processes & deadlines

  • Is there a process for data subject requests with deadline tracking?

    Art. 12, 15–22 · Intake channel, identity check, response within one month

  • Is there a breach process that meets the 72 hours?

    Art. 33, 34 · Internal reporting path, assessment, notification, documentation of all breaches

  • Are retention periods set and deletions evidenced?

    Art. 5(1)(e), 17 · Per data category, with trigger and owner

Organisation & AI

  • Has it been checked whether a data protection officer must be designated?

    Art. 37, § 38 BDSG · In Germany, among others, where as a rule 20 people are constantly involved in automated processing

  • Are staff trained and is this documented?

    Art. 24, 39(1)(b) · Basics, handling requests and breaches, AI tools

  • Are documentation and measures reviewed regularly?

    Art. 5(2), 24(1) · Fixed date plus triggers such as new systems or incidents

  • Are AI tools that process personal data recorded in the RoPA?

    Art. 30, 28, 35 · With the provider as processor, third country and DPIA check where relevant

app.simpleact.de

Your status

0 of 16 answered

A
0%of the answered items in place
  • Basics & transparency0/4
  • Vendors & third countries0/2
  • Security & risk0/3
  • Processes & deadlines0/3
  • Organisation & AI0/4

Answer the questions on the left – the result appears here.

Self-assessment for orientation, not legal advice and not an audit. "Don't know" counts as a gap because an unknown status cannot be demonstrated.

Deadlines

The GDPR deadlines you need to know

Most GDPR obligations apply continuously. Some have fixed deadlines that start with an event – they need a practised procedure.

Request from a data subject (access, erasure …)
DeadlineWithout undue delay, at the latest 1 month after receipt
NoteExtension by two further months possible for complexity or number of requests; inform within the first month with reasons
ProvisionArt. 12(3)
Breach with risk
DeadlineWithout undue delay and, where feasible, within 72 hours of becoming aware
NoteGive reasons for a later notification; none needed where a risk is unlikely
ProvisionArt. 33(1)
Breach at the processor
DeadlineWithout undue delay to the controller
NoteWorth specifying in the DPA
ProvisionArt. 33(2)
Breach likely to result in a high risk
DeadlineWithout undue delay to data subjects
NoteExceptions under para. 3, e.g. where the data was effectively encrypted
ProvisionArt. 34(1)
Collection from the data subject
DeadlineAt the time of collection
NoteThe privacy notice must be available before data is collected
ProvisionArt. 13(1)
Data not obtained from the data subject
DeadlineWithin a reasonable period, at the latest 1 month
NoteEarlier if the data is used to communicate or disclosed
ProvisionArt. 14(3)
Processing likely to result in a high risk
DeadlineBeforehand, i.e. before processing starts
NoteIf the DPIA shows a high risk without mitigation: prior consultation under Art. 36
ProvisionArt. 35(1)

Deadlines under the AI Act (e.g. for serious incidents) run separately. The EU AI Act dates are on our deadlines page.

Data protection officer

When a data protection officer is mandatory

The GDPR names three cases; the BDSG adds to them for Germany. It is enough if one of them applies.

Public body
ConditionProcessing by a public authority or body (except courts acting in their judicial capacity)
ProvisionArt. 37(1)(a) GDPR
Monitoring as core activity
ConditionCore activities consist of processing that requires regular and systematic monitoring of data subjects on a large scale
ProvisionArt. 37(1)(b) GDPR
Sensitive data as core activity
ConditionCore activities consist of large-scale processing of special categories under Art. 9 or data on criminal offences under Art. 10
ProvisionArt. 37(1)(c) GDPR
20-person threshold
ConditionAs a rule at least 20 people are constantly involved in the automated processing of personal data
Provision§ 38(1) sentence 1 BDSG
Certain processing, regardless of headcount
ConditionProcessing subject to a DPIA under Art. 35, or commercial processing for transfer, anonymised transfer or market or opinion research
Provision§ 38(1) sentence 2 BDSG

Once a data protection officer (DPO) is designated, their contact details must be published and communicated to the supervisory authority (Art. 37(7)). They can be an employee or an external service provider and are designated on the basis of professional qualities (Art. 37(5), (6)). They receive no instructions regarding the exercise of their tasks (Art. 38(3)). They may fulfil other tasks as long as these do not result in a conflict of interests (Art. 38(6)) – which is why management or the head of IT is usually not a good choice.

Their tasks are set out in Art. 39(1): inform and advise, monitor compliance – including awareness-raising and training of staff –, advise on the DPIA where requested, cooperate with the supervisory authority and act as its contact point. Responsibility for GDPR compliance, however, stays with the organisation, not the DPO.

A voluntary designation can make sense even without a duty (Art. 37(4)). Organisations that do not need a DPO should still name a person who coordinates data protection – the obligations in the table above apply regardless.

Fines

What infringements can cost: the two levels of Art. 83

Art. 83 has two upper limits. Which one applies depends on the obligation infringed. For undertakings, the higher of the fixed amount and the percentage of worldwide annual turnover applies.

Art. 83(4)
MaximumUp to €10m or 2 % of worldwide annual turnover
Infringements of (selection)Obligations of the controller and processor under Art. 8, 11, 25 to 39, 42 and 43 – i.e. among others privacy by design, DPA, record of processing, TOMs, breach notification, DPIA and data protection officer
Art. 83(5)
MaximumUp to €20m or 4 % of worldwide annual turnover
Infringements of (selection)Principles including the conditions for consent (Art. 5, 6, 7, 9), data subject rights (Art. 12 to 22), transfers to third countries (Art. 44 to 49), non-compliance with an order of the supervisory authority

The amounts are upper limits, not standard rates. The supervisory authority decides case by case and under Art. 83(2) considers, among other things, the nature, gravity and duration of the infringement, intent or negligence, action taken to mitigate the damage and cooperation with the authority. Good documentation helps twice: it prevents infringements and, if it comes to it, shows what was done.

Independently of fines, any person who has suffered material or non-material damage as a result of an infringement is entitled under Art. 82(1) to compensation from the controller or processor.

GDPR and AI

What changes when AI processes personal data

The AI Act does not replace the GDPR. Where an AI system processes personal data, both frameworks apply side by side. Typical touchpoints:

Art. 30

Entry in the record of processing

The AI tool itself is not a processing activity – the purpose you use it for is. You record, for example, "applicant pre-selection" with the AI provider as recipient.

Art. 28

Provider as processor

Cloud AI services usually process prompts and documents on your behalf. That requires a DPA; check in particular whether the provider uses your data for its own purposes such as training.

Art. 44–49

Third countries

Many AI providers are based in the US or use data centres there. The transfer needs a basis under Art. 44 et seq., such as an adequacy decision or standard contractual clauses.

Art. 35

DPIA for new technologies

Art. 35(1) explicitly mentions the use of new technologies. For AI with profiling, sensitive data or evaluation of people, a DPIA is likely. Deployers of high-risk AI also use the provider's information for it (Art. 26(9) AI Act).

Art. 22

Automated decisions

Solely automated decisions with legal or similarly significant effects are permitted under Art. 22 only by exception. Plan genuine human review for AI-supported decisions.

Art. 5

Data minimisation in the prompt

Not every task needs real names. Rules on which data may be entered into AI tools put Art. 5(1)(c) into practice.

For high-risk AI under Annex III, the deployer obligations of the AI Act apply from 2 December 2027 following the Digital Omnibus. The GDPR obligations already apply today.

Common mistakes

Where GDPR compliance fails in practice

Documented once, never looked at again

A RoPA from 2018 often describes systems that no longer exist. The second sentence of Art. 24(1) requires review and updating.

Templates unrelated to the organisation

Copied templates listing measures that do not exist are exposed at the first question. Templates are a start, not documentation.

No procedure for emergencies

If you only work out who decides when the breach happens, you lose the 72 hours. Reporting path, deputies and templates need to be settled beforehand.

Forgotten service providers

Newsletter tool, video conferencing, AI assistant: every service with personal data needs a check, usually a DPA and possibly a third-country basis.

Deletion stays theoretical

Retention periods in a concept help little if nobody deletes. Without a log, storage limitation cannot be demonstrated.

Data protection as a one-person job

Without owners in the departments, data protection learns about new processing only once it is long running.

With SimpleAct

From roadmap to day-to-day operation

The guides on this page work without software too. When registers should grow together and deadlines run, the SimpleAct GDPR module (from Professional) keeps the areas from the table in one system – linked to the AI inventory for the EU AI Act.

  • Records of processing, DPIA, TOMs, DPAs
  • Data subject requests and breaches with calculated deadlines
  • Deletion log, consent, privacy notices
  • Compliance checklist and register export

See the GDPR software

Which areas exist, how they connect to the AI inventory and which plan fits is shown on the product page.

Go to the GDPR software

Open-Source Framework

simpleact-gdpr-compliance-workspace

The three GDPR foundations, documented openly: record of processing, lawful basis and data subject rights.

View on GitHub

FAQ

Frequently asked questions about GDPR compliance

To every organisation established in the EU that processes personal data and, under certain conditions, to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour. There is no minimum size. Purely personal or household activities are exempt, for example.
Record of processing (Art. 30), legal bases (Art. 6), information duties (Art. 13, 14), data subject rights (Art. 12–22), contracts with processors (Art. 28), technical and organisational measures (Art. 32), breach notification (Art. 33, 34), retention periods (Art. 5(1)(e), Art. 17) and – where needed – a DPIA (Art. 35) and a data protection officer (Art. 37, § 38 BDSG in Germany).
Under Art. 5(2) the controller is responsible for compliance with the principles and must be able to demonstrate it. Art. 24(1) requires appropriate measures to ensure and demonstrate compliance, and their review and updating. In practice: current registers, documented decisions and evidence.
As a rule, yes. Art. 30(5) exempts organisations with fewer than 250 employees only if the processing carries no risk, is occasional and does not involve special categories or criminal data. Payroll or customer management is not occasional – so the exemption rarely applies.
Under Art. 37(1) GDPR for public bodies and where core activities consist of large-scale systematic monitoring or large-scale processing of sensitive data. In Germany additionally under § 38 BDSG where as a rule at least 20 people are constantly involved in automated processing of personal data, or for processing subject to a DPIA and commercial data transfer or market and opinion research.
Without undue delay and, where feasible, within 72 hours of becoming aware, to the competent supervisory authority (Art. 33(1)) – unless it is unlikely to result in a risk to data subjects. Every breach must be documented regardless (para. 5). Where a high risk is likely, data subjects must also be informed without undue delay (Art. 34).
Art. 12(3) requires a response without undue delay and at the latest within one month of receipt. For complex requests or a high number of requests, an extension by two further months is possible; you inform the person within the first month with reasons. In principle the information is free of charge (Art. 12(5)).
Art. 83 has two upper limits: up to €10m or 2 % of worldwide annual turnover, for example for infringements of Art. 25 to 39 (DPA, RoPA, TOMs, breaches, DPIA, DPO), and up to €20m or 4 % for infringements of the principles, legal bases, consent conditions, data subject rights and third-country rules. For undertakings the higher amount applies; the authority sets the actual amount case by case.
It depends on the starting point: the number of processing activities, vendors and sites, and how much is already documented. The law sets no deadline – the GDPR has applied since 25 May 2018. What matters is starting with the basics (RoPA, legal bases, DPAs, deadline processes) and reviewing the status regularly afterwards.
Yes, as soon as personal data is processed – in prompts, uploaded documents or outputs. That requires a RoPA entry, a legal basis, usually a DPA with the provider, possibly a third-country basis and a DPIA check. The AI Act applies on top and does not change the GDPR obligations.
The controller decides on the purposes and means of processing. The processor processes data on behalf of and on instructions from the controller, such as a hosting or payroll provider. Where several parties jointly decide on purposes and means, they are joint controllers under Art. 26 and need an arrangement on the allocation of duties.
In Germany, generally yes for storing and reading information on end devices, under § 25(1) TDDDG. Exempt is what is strictly necessary to provide a service the user explicitly requested (§ 25(2)). The subsequent processing of personal data falls under the GDPR, and consent must be demonstrable and withdrawable at any time under Art. 7.

More questions? We're happy to help. Send email · Try 7 days (credit card required)

Sources and status

Last reviewed on · SimpleAct editorial team

This page and the self-check are for orientation and are not legal advice. The text of the GDPR in the Official Journal of the EU and of the BDSG is authoritative. Roadmap, order and review intervals are recommendations.

Changes to this page

  • 6 October 2026 – Rebuilt as a guide: principles of Art. 5 as a table, obligations overview with 22 rows, nine-step roadmap, interactive self-check with gap list, deadlines table, section on the data protection officer (Art. 37–39, § 38 BDSG), fine levels under Art. 83(4) and (5). The product description now lives on the GDPR software page.
  • 13 June 2026 – First version with an overview of obligations.

Guides to the obligations

Put the roadmap into practice – with one system for GDPR and the EU AI Act

In 30 minutes we show how records of processing, deadlines and evidence come together in SimpleAct – guided by your gap list.

Book a demoTry 7 days (credit card required)