GDPR Compliance Audit Checklist & Readiness Scanner

Trap 1: Relying on 'Legitimate Interest' for Behavioral Ad Tracking (Art. 6(1)(f) Misuse) Many ad-funded web properties claim that running invasive third-party tracking cookies (such as Meta Pixel, Criteo, or Google Remarketing) falls under "legitimate business interest." The European Data Protection Board (EDPB) and Court of Justice of the EU (e.g. Meta v. Bundeskartellamt) have explicitly ruled that cross-site behavioral tracking and profiling CANNOT rely on legitimate interest—it requires unambiguous, explicit opt-in consent.

Trap 2: Failure to Execute Data Processing Agreements (DPAs) with Subprocessors (Art. 28) Using third-party SaaS tools (error monitoring like Sentry, support widgets like Intercom, hosting on AWS) without an executed Data Processing Agreement makes any data transfer to that service legally unauthorized. Even if the vendor is GDPR-compliant, your company is in direct breach of Article 28(3) until the DPA contract with standard contractual terms is signed and logged.

Trap 3: Missing the Mandatory 72-Hour Data Breach Notification Window (Art. 33) When a security breach occurs (stolen database, compromised credentials, or ransomware), Article 33 mandates that the lead Data Protection Authority must be notified within 72 hours of becoming aware of the incident. Companies that spend two weeks investigating internally before alerting authorities routinely receive the harshest Tier 2 administrative penalties.

Trap 4: Charging Fees or Creating Friction for Data Subject Access Requests (DSARs - Art. 12) Article 12(5) strictly establishes that information provided under access, erasure, or portability requests must be provided entirely free of charge. Requiring users to send notarized physical letters, call international telephone numbers, or pay administrative processing fees violates European transparency rules and triggers immediate regulatory investigation.

Trap 5: Pre-Ticked Cookie Banners & Implied Consent (Planet49 & EDPB Guidelines) Designing cookie consent banners where analytics or marketing categories are checked by default, or where scrolling the webpage is treated as "implied consent", is legally invalid. Under CJEU jurisprudence, only an active affirmative action constitutes legal assent. Pre-ticked boxes provide zero legal cover during an audit.