GDPR · 12 min read · Updated 2026-07-06
GDPR checklist for maintainable evidence
A GDPR evidence checklist for SaaS teams covering processor records, vendors, DSARs, DPIAs, breach response and security controls.
Direct answer: what a maintainable GDPR checklist includes
A maintainable GDPR checklist covers the operational records that show how personal data is handled: data mapping, RoPA, lawful basis, privacy notices, consent records, processor agreements, subprocessor reviews, data subject requests, DPIAs, breach response, retention, deletion, access reviews and security controls.
For SaaS teams, the checklist works best as a set of owned records rather than a one-off legal document. Each record needs the system or process involved, the personal data affected, the owner who reviewed it, the supporting evidence and the next review date.
General information only; this is not legal advice. Ask qualified privacy counsel or a data protection specialist for legal interpretation.
Controller vs processor evidence
- Record when you act as a controller, processor or both.
- Keep customer processing instructions, DPA terms and product data-flow notes.
- Make customer-facing statements match the role you actually perform.
Data mapping and RoPA
- List systems that collect, store, process or transfer personal data.
- Record categories of data subjects and personal data.
- Map subprocessors, hosting regions and retention periods.
- Keep the RoPA owner and review date visible.
Lawful basis
- Record lawful basis by processing activity.
- Keep legitimate interest assessments where relevant.
- Separate account administration, marketing, analytics and product processing.
- Review lawful basis when product features change.
Privacy notices and consent records
- Keep current privacy notices with publication dates.
- Record who approved material changes.
- Store consent configuration and withdrawal workflows where consent is used.
- Avoid privacy promises that are not supported by operational evidence.
DPA and subprocessor review
- Keep signed DPAs or accepted terms for processors.
- Record subprocessor lists, review dates and customer notification workflows.
- Connect critical subprocessors to vendor risk reviews.
DSAR workflow
- Document intake, identity verification, search, approval and response steps.
- Record owner, deadline and evidence of completion.
- Keep exemptions or refusals reviewed by an appropriate owner.
DPIA workflow
- Define triggers for high-risk processing.
- Record risk assessment, mitigations, reviewers and outcome.
- Review DPIAs when processing purposes, data types or vendors change.
Breach response
- Keep an incident response process with privacy escalation criteria.
- Record assessment of personal data impact.
- Track notification decisions, responsible owners and timestamps.
Retention and deletion
- Define retention periods by data category or system.
- Record deletion workflows and exceptions.
- Keep evidence of deletion jobs, customer offboarding and backup retention assumptions.
Access reviews and security controls
- Review privileged access to systems containing personal data.
- Keep MFA, logging, backup and encryption evidence where applicable.
- Connect access review findings to remediation tasks.
Evidence table
| Area | What to check | Evidence to keep | Owner | Review frequency | Status |
|---|---|---|---|---|---|
| RoPA | Processing activities are current | RoPA export, system map | Privacy owner | Quarterly | Not started |
| Lawful basis | Basis is recorded per activity | Lawful basis register, assessment notes | Privacy owner | Annually | Not started |
| Notices | Privacy notice reflects current processing | Published notice, approval history | Legal/ops | Annually | Not started |
| Vendors | Processors and subprocessors are reviewed | DPA, subprocessor list, vendor review | Vendor owner | Annually | Not started |
| DSAR | Request workflow is tested | Procedure, request log, response evidence | Support lead | Annually | Not started |
| DPIA | High-risk processing is assessed | DPIA record, mitigation notes | Product owner | On change | Not started |
| Breach | Privacy incident decisions are recorded | Incident log, notification assessment | Security lead | Per incident | Not started |
| Access | Personal-data system access is reviewed | Access export, review sign-off | IT owner | Quarterly | Not started |
Common mistakes
- Keeping GDPR records only in legal folders.
- Not connecting subprocessors to vendor security reviews.
- Letting privacy notices drift away from product reality.
- Treating DSAR and breach workflows as documents without evidence of operation.
Keeping GDPR evidence current in Trustega
Trustega keeps processor records, vendor reviews, security evidence, access review notes and customer-ready answers together, so privacy and security work can be reviewed without chasing multiple teams.
Common questions
Is this guide legal or certification advice?
No. This guide is for general information and is not legal advice. Use qualified legal, privacy or audit advisers for formal interpretation and assurance decisions.
Can a small SaaS team use this without a GRC team?
Yes. The workflows are designed for lean teams, but each record still needs a named owner, a review date and evidence that matches the actual scope.