Due 28 OctAUQuarterly BAS Due (July–September) NewUSForm 1099-NEC & Contractor Payment Reporting Check See deadlines ›
Due 31 OctPaper Self Assessment Return Deadline NewSole Trader Allowable Expenses & Simplified Expenses Check See deadlines ›
Due 2 NovForm 941 Quarterly Payroll Tax Return Due (Q3) NewForm 1099-NEC & Contractor Payment Reporting Check See deadlines ›
Due 31 OctEU One Stop Shop (OSS) VAT Return — July to September NewEU Product Liability Directive Readiness Check See deadlines ›
Due 28 OctQuarterly BAS Due (July–September) NewAutomated Decision-Making Privacy Check (Australia) See deadlines ›

Data & Privacy European Union

EU GDPR Compliance Check

Check whether your organisation meets EU GDPR requirements — now distinct from UK GDPR following Brexit — covering lawful basis, data subject rights, and cross-border transfers.

Start free check 10 questions · 8 minutes · No signup
Trending now

Did you know? The numbers behind this check.

  • €20m or 4% of global turnoverMaximum fine (serious infringements)
  • €10m or 2% of global turnoverMaximum fine (other infringements)
  • 72 hours to supervisory authorityBreach notification deadline
  • 1 calendar monthData subject request response window

Why this matters.

The EU General Data Protection Regulation (Regulation 2016/679) applies to any organisation established in the EU, or that targets goods or services at EU residents, or monitors their behaviour within the EU — regardless of where the organisation itself is based. Following Brexit, EU GDPR and UK GDPR are now separate legal frameworks with different supervisory authorities. Lead supervisory authorities under the one-stop-shop mechanism handle cross-border complaints. Fines reach up to €20 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements.

The EU’s enforcement environment has intensified significantly: the Irish Data Protection Commission has issued hundreds of millions in fines against large technology companies; national DPAs across Germany, France, Italy, and Spain have been active against SMEs. For any non-EU business processing EU residents’ data, Article 27 requires appointment of an EU representative, and Chapter V governs cross-border data transfers — with Standard Contractual Clauses (SCCs) being the most common transfer mechanism following the Schrems II ruling.

Have these to hand.

  • A record of processing activities (ROPA) or list of data types you process
  • Whether you have an establishment (office, subsidiary) in an EU member state
  • Whether you transfer personal data outside the EU/EEA
  • Your current privacy notice/policy
  • Details of any third-party data processors you use

What you’ll get.

  • 1A score out of 100Where you stand today, at a glance.
  • 2Findings ranked by riskWhat could cost you, highest risk first.
  • 3A plan with timeframesWhat to fix first and by when.

Use this free tool to assess your organisation’s compliance with EU GDPR and get a prioritised action plan — covering lawful basis, data subject rights, international transfers, and supervisory authority obligations.

General guidance only, not legal advice. Consult a qualified solicitor or adviser in your jurisdiction for specific issues.