Free Tool · No Signup Required

GDPR Readiness Assessment

Built by the PolicySuite team About us

15 questions. 5 minutes. Instant personalised gap report with specific policy recommendations for every area you're missing.

🇬🇧 UK GDPR + 🇪🇺 EU GDPR ⏱️ ~5 minutes 🔒 Private — answers never leave your browser

Quick answer. A GDPR readiness assessment scores your current data-protection posture against the UK GDPR and EU GDPR Article 5(2) accountability requirements: documented privacy notice, ROPA (Article 30), DPIA process (Article 35), DSAR procedure, breach notification (72-hour ICO window), processor DPAs (Article 28) and lawful-basis register. This free tool covers the 15 highest-risk areas and produces an instant ICO-shaped gap report — no sign-up, browser-only, five minutes.

0 of 15 answered

1. Foundations

Quick answer. 1. Foundations — in our experience, the short answer is bespoke generation cited to primary sources beats generic templates. Many uk smes typically discover the gap only at audit time; for example, a missing legislation.gov.uk reference. Bespoke generation closes the gap pre-emptively.

The core documents every organisation handling personal data needs.

Do you have a documented privacy notice published to employees and customers? Explains what personal data you collect, why, and their rights.
Is there a documented data retention schedule? Specifies how long each type of data is kept before deletion.
Do you maintain a Record of Processing Activities (ROPA)? Article 30 of the UK GDPR requires most organisations to keep one.

2. Data Subject Rights

Quick answer. 2. Data Subject Rights — in our experience, the short answer is bespoke generation cited to primary sources beats generic templates. Many uk smes typically discover the gap only at audit time; for example, a missing legislation.gov.uk reference. Bespoke generation closes the gap pre-emptively.

Handling requests from individuals about their personal data.

Do you have a documented DSAR (Data Subject Access Request) procedure?
Are erasure, rectification and portability requests handled in a documented way?
Can you respond to a subject rights request within 30 days (legal limit)?

3. Breach & DPIA

Quick answer. 3. Breach & DPIA — in our experience, the short answer is bespoke generation cited to primary sources beats generic templates. Many uk smes typically discover the gap only at audit time; for example, a missing legislation.gov.uk reference. Bespoke generation closes the gap pre-emptively.

Dealing with incidents and assessing risk for new processing.

Is there a documented data breach response plan with roles and steps?
Do you have a DPIA (Data Protection Impact Assessment) template and process?
Can you notify the ICO of a qualifying breach within 72 hours? Article 33 requirement. Missing this is one of the most common enforcement triggers.

4. Processors & Transfers

Quick answer. 4. Processors & Transfers — in our experience, the short answer is bespoke generation cited to primary sources beats generic templates. Many uk smes typically discover the gap only at audit time; for example, a missing legislation.gov.uk reference. Bespoke generation closes the gap pre-emptively.

Third parties handling data, and cross-border transfers.

Do you have a Data Processing Agreement (DPA) with every third party that processes personal data for you?
Are international data transfers covered by SCCs, UK IDTA, or an adequacy decision?
Do you maintain a list of sub-processors with a change-notification process?

5. Governance

Quick answer. 5. Governance — in our experience, the short answer is bespoke generation cited to primary sources beats generic templates. Many uk smes typically discover the gap only at audit time; for example, a missing legislation.gov.uk reference. Bespoke generation closes the gap pre-emptively.

Accountability structures — who's responsible, training, cookie consent.

Do you have a DPO appointed, or a clear data-protection lead with time allocated?
Do staff receive GDPR / data protection training at least annually?
Do your public-facing websites use a compliant cookie-consent mechanism? Affirmative opt-in, granular categories, easy to refuse, honours withdrawal.
0
% READY
—

Area-by-area breakdown

Quick answer. Area-by-area breakdown — in our experience, the short answer is bespoke generation cited to primary sources beats generic templates. Many uk smes typically discover the gap only at audit time; for example, a missing legislation.gov.uk reference. Bespoke generation closes the gap pre-emptively.

Recommended policy packs to close your gaps

Quick answer. Recommended policy packs to close your gaps — in our experience, the short answer is bespoke generation cited to primary sources beats generic templates. Many uk smes typically discover the gap only at audit time; for example, a missing legislation.gov.uk reference. Bespoke generation closes the gap pre-emptively.

Ranked by the specific gaps you flagged. Pricing is live from our pricing engine.

Questions about this tool

Quick answer. Questions about this tool — in our experience, the short answer is bespoke generation cited to primary sources beats generic templates. Many uk smes typically discover the gap only at audit time; for example, a missing legislation.gov.uk reference. Bespoke generation closes the gap pre-emptively.

Is this really free?

Yes. There's no charge and no signup required to see your score. We only ask for your email if you want the detailed PDF report.

How accurate is it?

It covers the 15 most common GDPR gaps we see across PolicySuite customers. It's not a formal audit but it reliably flags the highest-risk areas. We built the question set from UK ICO enforcement actions and EDPB guidance.

What happens to my answers?

Your answers are processed entirely in your browser — nothing is sent to our servers unless you submit your email for the PDF. See our privacy policy.

How the GDPR readiness check works

Quick answer. The readiness check walks the eight ICO accountability framework areas and the GDPR Article 30 ROPA requirements, then surfaces the policies most controllers find missing or outdated against current EDPB guidance. Bespoke generation typically replaces a £5,000–£15,000 consultancy engagement with a one-off £400 pack — a 12× to 38× cost reduction with the same audit-readiness.

References and primary sources

Quick answer. The guidance above is cross-referenced against the primary-source documents below. Each link resolves to an official regulator or standards-body publication so the chain stays intact end-to-end.

In our experience, the documents that survive enterprise vendor review and ICO audits cite primary sources clause-by-clause. Many uk smes typically discover policy gaps only when the buyer’s legal team challenges a generic phrase — for example, a missing legislation.gov.uk reference or an outdated ACAS Code citation. Bespoke generation closes the gap pre-emptively.