In 2016 the joint working party on GDPR created a useful mnemonic to help you work through the new requirements for data protection.
Decide who is responsible Action plan Think about and record the personal data you process Assure your lawful basis for processing Process according to data protection principles Review and check with your processors Obtain consent if you need to Tell people about your processes – the Privacy Notice Ensure data security Consider personal data breaches Think about data subject rights Ensure privacy by design and default Data Protection impact assessment.
