Are the Senior Management aware and talking about GDPR?

Have you got a GDPR strategy and implementation plan?

Have you got a Data Protection officer?

Do you know what data you hold, how it is collected, where it is stored, and what you do with it?

Does your web site include GDPR compliant opt-ins and privacy statements?

Have you got complaint handling, requests for information, and SAR processes?

Are you sure that you have a legal right to collect and process the data you collect?

Do you need to verify the ages of your visitors or collect consent from parents?

Do you have data breach detection and reporting processes?

Have you checked that your IT and processes are actually secure?

Do you send data to other EU countries or outside the EU?

Are your staff trained on data protection rules and procedures?