GDPR · ISO/IEC 27701:2025
How well does your organisation meet the GDPR?
70 requirements covering the GDPR (principles, governance, lawfulness, transparency, rights, design, processors, security, breaches, DPIA, transfers and special situations), the EDPB guidelines that interpret it, and the Annex A controls and clauses 4-10 of ISO/IEC 27701:2025. You get compliance percentages, prioritised gaps, guidance and a PDF report. Usable by controllers and processors in any Member State; national specifics (e.g. Art. 88 labour rules, age thresholds, ePrivacy transposition) are out of scope. Regulatory snapshot: 31 October 2026.
No data from this assessment is transmitted to GoToCertify.
How it works
- Profile: a few facts and yes/no questions exclude non-applicable requirements.
- Assessment: a 0-4 maturity level per requirement, with evidence and notes.
- Dashboard: compliance % by area, by source and by control group; P1/P2 gaps.
- PDF report: results, prioritised action plan with guidance, control map, roadmap.
70 requirements · 14 assessment areas · mapped to ISO 27701 · 60-120 minutes
GDPR (Reg. (EU) 2016/679)Applicable since 25/05/2018 and unchanged at the snapshot date: the Digital Omnibus amendments proposed in November 2025 are still under negotiation (Council mandate 21/10/2026) and appear only as notes. Regulation (EU) 2025/2518 on cross-border procedures applies from 02/04/2027.
EDPB guidelines and CJEU case lawConsent, legitimate interest, Art. 25, breach notification, right of access, pseudonymisation and anonymisation, supplementary measures for transfers, AI models, consent-or-pay, plus the Schrems II, SCHUFA, KNLTB and Latombe judgments.
ISO/IEC 27701:2025The new standalone privacy information management system standard (published 14/10/2025). Each requirement is linked to Table A.1 (controller), A.2 (processor) and A.3 (security) controls and to clauses 4-10: the coverage map is a basis for the Statement of Applicability.
Assessment areas
- PRI – Principles and accountability
Art. 5 principles are the yardstick for every other obligation and are directly sanctionable (Art. 83(5)). Translate them into a data protection policy and into documented decisions (purpose, basis, retention) so that compliance can be demonstrated on request (Art. 5(2), 24). - GOV – Governance, DPO and management system
Assign clear ownership: top-management sponsor, DPO where mandatory (Art. 37), privacy champions in business units. A privacy information management system (ISO/IEC 27701:2025 clauses 4-7) gives the structure: scope, legal register, risk-based planning, resources and controlled documentation. - ROP – Records of processing and data inventory
The Art. 30 record is the backbone of accountability and the first document a supervisory authority asks for. Keep it alive: link it to systems, suppliers, retention and transfers, and review it at every new project. - LAW – Lawfulness, consent and special categories
Every processing needs a documented Art. 6 basis chosen before processing starts; special categories also need an Art. 9(2) condition. Consent must meet Art. 7 (free, specific, informed, unambiguous, withdrawable) and legitimate interest requires a recorded balancing test (EDPB Guidelines 1/2024, consultation version). - TRN – Transparency and information
Notices must be concise, intelligible, easily accessible and complete (Art. 12-14). Use layered notices, maintain one source of truth per processing, and review notices whenever purposes, recipients, retention or transfers change. - DSR – Data subject rights and automated decisions
Rights requests must be answered within one month (extendable by two) with identity checks proportionate to the risk. Map where data lives so that access, erasure and portability can be executed end to end, and identify every decision taken solely by automated means (Art. 22). - PBD – Privacy by design, minimisation and retention
Build privacy checkpoints into project, procurement and development methodologies (Art. 25). Default settings must process only what is necessary; a retention schedule with automated deletion or anonymisation is the most frequently missing control. - PRC – Processors, sub-processors and contracts
Controllers must select processors offering sufficient guarantees and bind them with an Art. 28(3) contract; processors must act only on documented instructions, manage sub-processors and support the controller. ISO/IEC 27701:2025 Table A.2 covers the processor side. - SEC – Security of processing
Art. 32 requires risk-appropriate technical and organisational measures. Table A.3 of ISO/IEC 27701:2025 lists the security controls most relevant to personal data: access control, cryptography, logging, backup, endpoint and media handling, secure development and incident management. - BRN – Personal data breach management
Detect, assess and document every breach; notify the supervisory authority within 72 hours unless the breach is unlikely to result in a risk (Art. 33) and inform data subjects when the risk is high (Art. 34). Test the procedure with exercises. The Digital Omnibus proposal (96 hours, high-risk threshold) is not law yet. - DPI – DPIA and prior consultation
Screen every new or changed processing against Art. 35(3), the EDPB nine criteria (WP248 rev.01) and the national DPIA lists. Where residual risk stays high, consult the supervisory authority before starting (Art. 36). - TRF – International transfers
Map every transfer and onward transfer, including remote access and cloud support. Rely on adequacy (including the EU-US Data Privacy Framework for certified recipients), SCCs 2021/914 with a transfer impact assessment, or BCRs; use Art. 49 derogations only occasionally. - SPC – Special situations
Employees, children, direct marketing and tracking technologies, and AI training on personal data raise specific conditions: Art. 88 and national labour rules, Art. 8 age thresholds, Art. 21(2) opt-out and ePrivacy consent for cookies, and the EDPB Opinion 28/2024 on AI models. - AUD – Training, audits and continual improvement
Awareness training for all staff (Art. 39(1)(b)), periodic internal audits, management reviews and corrective actions turn a one-off compliance project into a sustained programme and are the evidence authorities weigh when setting fines (Art. 83(2)).
Key regulatory dates
| Date | Source | Status | |
|---|---|---|---|
| 25/05/2018 | GDPR | Regulation (EU) 2016/679 applicable in all Member States (in force since 24/05/2016) | In force |
| 16/07/2020 | CJEU | Schrems II (C-311/18): Privacy Shield invalid; transfer impact assessments required for Art. 46 tools | In force |
| 27/09/2021 | Commission | SCCs 2021/914 mandatory for new contracts (old SCCs repealed); legacy contracts had to migrate by 27/12/2022 | In force |
| 10/07/2023 | Commission | EU-US Data Privacy Framework adequacy decision (EU) 2023/1795; upheld by the General Court on 03/09/2025 (T-553/23); appeal C-703/25 P lodged 31/10/2025 and pending before the Court of Justice | In force – monitor |
| 12/09/2025 | Data Act | Regulation (EU) 2023/2854 applicable: access and portability rights for connected products, interface with GDPR Art. 20 | In force |
| 14/10/2025 | ISO | ISO/IEC 27701:2025 published (standalone PIMS); three-year transition: certification bodies migrate accreditation during 2026-2027 and all certified clients must be transitioned by 31/10/2028, when 2019-edition certificates cease to be valid | In force – transition |
| 01/01/2026 | GDPR procedural regulation | Regulation (EU) 2025/2518 in force (OJ L, 12/12/2025) | In force |
| 02/04/2027 | GDPR procedural regulation | Regulation (EU) 2025/2518 applicable: harmonised cross-border complaint handling, rights to be heard, time limits | Future – prepare |
| 02/12/2027 | AI Act (as amended by Reg. (EU) 2026/1744) | High-risk obligations for Annex III systems (incl. HR, credit, education); AI Act Art. 86 right to explanation; FRIA; coordination with GDPR Art. 22 and DPIA | Future |
| To be determined | Digital Omnibus (proposal) | Commission proposal of 19/11/2025 amending the GDPR and ePrivacy (breach notification 96h/high-risk threshold, pseudonymised data, DPIA lists, Art. 30 exemption, cookies). Council mandate 21/10/2026; Parliament position pending; NOT adopted | Proposal – monitor |
Frequently asked questions
Is the GDPR self-assessment free?
Yes. The tool is free, requires no account and stores nothing on our servers: the assessment runs entirely in your browser and you download the PDF report and an optional save file to your computer.
Which standard is the GDPR assessment mapped to?
Every requirement is linked to the controls of ISO/IEC 27701:2025. The coverage map produced by the tool can be used as a basis for a Statement of Applicability.
How is the compliance percentage calculated?
Each applicable requirement is scored on a maturity scale from 0 (not started) to 4 (fully compliant). The compliance percentage is the ratio between the score obtained and the maximum obtainable. Priorities P1/P2/P3 combine criticality and maturity level.
Who is the assessment for?
Compliance, legal, IT security and risk functions of organisations established or operating in the EU; it is a self-assessment and does not constitute legal advice.
How up to date is the regulatory content?
The regulatory snapshot is dated 2026-10-31 (version 1.0). Proposals not yet adopted are labelled as such. References point to official sources (EUR-Lex, European authorities, ISO).
Other assessments
- EU AI Act – Regulation (EU) 2024/1689 as amended by the Digital Omnibus – mapped to ISO/IEC 42001:2023
- NIS2 Directive – Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 - mapped to ISO/IEC 27001:2022
- DORA – Regulation (EU) 2022/2554 on digital operational resilience for the financial sector – mapped to ISO/IEC 27001:2022 and ISO 22301:2019
- AI Act – Italia – AI Act, L. 132/2025, D.Lgs. 160/2026 e 179/2026 – mappato su ISO/IEC 42001:2023 (contenuti in italiano)
Self-assessment tool for information purposes only; it does not constitute legal advice. References and dates must be verified against the official texts (EUR-Lex, EDPB, ISO). National implementing laws are out of scope. No data from this assessment is transmitted to GoToCertify. © 2026 GoToCertify.