In 2016 the joint working party on GDPR created a useful mnemonic to help you work through the new requirements for data protection.

Decide who is responsible
Action plan
Think about and record the personal data you process
Assure your lawful basis for processing
Process according to data protection principles
Review and check with your processors
Obtain consent if you need to
Tell people about your processes – the Privacy Notice
Ensure data security
Consider personal data breaches
Think about data subject rights
Ensure privacy by design and default
Data Protection impact assessment.