Your freeGDPR assessment
Does GDPR apply to your organisation, to what, and where should you start? Answer a dozen questions, no legal expertise needed.
- 3 minutes
- No email needed
- Your answers stay on your device
Your GDPR checklist
Enable JavaScript to get your personalised summary. In the meantime, here are the questions to ask yourself:
- Do you have an up-to-date list of all the files and software where you keep information about people?
- Have you checked whether you need to appoint a Data Protection Officer (DPO)?
- Do your forms and website tell people what you do with their data?
- Have the service providers that handle your data (payroll, hosting, business software…) signed a GDPR clause?
- If someone asks to see or delete their data, do you know who replies, and how?
- If an email account were hacked tomorrow, would you know who to notify, and how quickly?
- Do you know how long you keep each type of data, and do you delete it afterwards?
- If you were inspected, could you produce your GDPR documents the same day?
Step 1
You started an assessment on this device.
That is common: we mark it ‘to be checked’, with no penalty. It is exactly what the tool helps you clarify.
Why are we asking this?
This is the record of processing activities: the first document the CNIL asks for during an inspection.GDPR Article 30
That is common: we mark it ‘to be checked’, with no penalty. It is exactly what the tool helps you clarify.
Why are we asking this?
Appointing one is mandatory for every public body, and for some large-scale processing.GDPR Article 37
That is common: we mark it ‘to be checked’, with no penalty. It is exactly what the tool helps you clarify.
Why are we asking this?
Everyone must know who processes their data, why, for how long, and how to exercise their rights.GDPR Articles 13 and 14
That is common: we mark it ‘to be checked’, with no penalty. It is exactly what the tool helps you clarify.
Why are we asking this?
You remain responsible for the data you entrust to them: the contract must set out what the provider does with it.GDPR Article 28
That is common: we mark it ‘to be checked’, with no penalty. It is exactly what the tool helps you clarify.
Why are we asking this?
You have one month to reply. Without a procedure, requests get lost and the deadline passes.GDPR Articles 12 to 22
That is common: we mark it ‘to be checked’, with no penalty. It is exactly what the tool helps you clarify.
Why are we asking this?
A personal data breach must be notified to the CNIL within 72 hours when it poses a risk, and recorded in every case.GDPR Articles 33 and 34
That is common: we mark it ‘to be checked’, with no penalty. It is exactly what the tool helps you clarify.
Why are we asking this?
Keeping data for longer than necessary is one of the failings the CNIL identifies most often.GDPR Article 5(1)(e)
That is common: we mark it ‘to be checked’, with no penalty. It is exactly what the tool helps you clarify.
Why are we asking this?
The GDPR requires you to be able to demonstrate compliance: without dated evidence, an action you have taken does not count.GDPR Articles 5(2) and 24
That is common: we mark it ‘to be checked’, with no penalty. It is exactly what the tool helps you clarify.
Why are we asking this?
Data pasted into a consumer AI tool can leave your organisation. The AI Act adds its own obligations.GDPR Articles 24 and 32
That is common: we mark it ‘to be checked’, with no penalty. It is exactly what the tool helps you clarify.
Why are we asking this?
It is one of the first things the CNIL checks, and one of the most frequently penalised.French Data Protection Act (Loi Informatique et Libertés), Article 82
That is common: we mark it ‘to be checked’, with no penalty. It is exactly what the tool helps you clarify.
Why are we asking this?
CCTV of a place open to the public requires prefectoral authorisation; publishing someone’s image requires their consent.French Internal Security Code, Article L251-1; GDPR Article 6
That is common: we mark it ‘to be checked’, with no penalty. It is exactly what the tool helps you clarify.
Why are we asking this?
A monitoring system must be proportionate, known to employees and presented to staff representatives before it is introduced.GDPR Article 5(1)(c); French Labour Code, Article L2312-38
That is common: we mark it ‘to be checked’, with no penalty. It is exactly what the tool helps you clarify.
Why are we asking this?
Even when hosted in Europe, data entrusted to a US provider can be demanded by that country’s authorities.GDPR Articles 44 to 49
That is common: we mark it ‘to be checked’, with no penalty. It is exactly what the tool helps you clarify.
Why are we asking this?
Processing sensitive data is prohibited in principle: each use must rely on an exception set out in the GDPR.GDPR Article 9
Your starting point
To deal with first
To strengthen
Already in place
Your first 3 steps in DPO Connect
An indicative guide based on your answers: this is not an audit. Your answers stay on your device; nothing has been sent to us.
30 minutes by video call: keep this summary to hand, we start from your priorities. You can also call us on +590 590 22 80 20.
Would you rather talk it through directly?Book a 30-minute call.
How the assessment works
Describe your organisation
Local authority, business, non-profit: the questionnaire adapts and leaves out what does not apply to you.
Answer the key questions
A dozen questions in everyday language. ‘I don’t know’ is an accepted answer.
Leave with your priorities
Your scope, your three priorities and your first steps in DPO Connect, to print or share.
Frequently asked questions about the assessment
Is the GDPR assessment an audit?
No. The DPO Connect GDPR assessment is an indicative guide: based on a dozen answers, it shows which requirements apply to your organisation and where to start. The full audit, in the software, covers all applicable requirements and the related proof.
Are my answers sent to anyone?
No, unless you ask. Your assessment answers are calculated and stored in your browser: nothing is sent to IPEOS or to any third party, and no email address is required to see the result. If you ask to receive your summary by email, it is sent to you without being kept by the website; your answers are only passed to the DPO Connect team if you tick the box asking to be contacted. The ‘Clear my answers’ button deletes them from your device.
How much does DPO Connect cost?
The price of DPO Connect depends on the size of your organisation and the scope to manage. It is presented to you during a 30-minute call that goes over your assessment, with no commitment. For local authorities, the offer is compatible with public procurement.
What happens after the assessment?
After the assessment, you can book a 30-minute call: we go through your priorities in DPO Connect and you leave with a plan to get started. You can also print your summary or share it with your management through a link.
Would you rather talk it through directly?
30 minutes by video call: we show you DPO Connect on a case close to yours, and the pricing that fits your organisation.