Worksheets

An Excel register of processing activities (ROPA-style). Add your systems, purposes, and retention periods. It does not inventory your estate for you.

A Word checklist of GDPR program tasks, from records of processing to incident handling. Use it to see what is still blank. Completing the list is not a certification and does not by itself prevent a fine.

A Word checklist to help you decide whether a DPIA is likely required. Answer the questions for the processing in front of you. A “yes” is a prompt to assess, not a completed DPIA.

An Excel log for personal-data incidents: what happened, who was affected, and what you did. Fill a row per incident. It is a record, not a notification to a regulator.

A Word checklist of incident-response steps: contain, record, assess, and follow up. Keep it next to your register. Notification duties depend on the incident, not on ticking every box.