A GDPR checklist for apps with EU users

---

Before you serve EU users

If your app can be used by someone in the EU, GDPR applies to their personal data. This is a control inventory, not a pass/fail certificate — each unchecked item is a remediation task, and counsel should review the result.

The checklist

Lawful basis per purpose — consent, contract, or legitimate interest documented for each thing you do with personal data (Art. 6).
Transparent notice — a privacy policy stating what you collect, why, and the basis, in plain language (Art. 12–14).
User-rights handling — a working path for access, deletion, portability, and objection (Art. 15–22).
Processor agreements — written terms with each SDK/processor that touches personal data (Art. 28).
International transfer — a mechanism (e.g., SCCs) if you send EU data outside the EEA.
Breach path — a process to detect and report a personal-data breach within 72 hours (Art. 33).

How to use the output

Each unchecked item becomes a tracked fix with an owner. A generator like PolicyDeck drafts the notice from your answers; the agreements, transfer mechanism, and breach process stay with your team and counsel. The finished checklist is evidence you looked — not a claim of compliance.

What the checklist is not

It is a GDPR control inventory for an app, not a full legal assessment. It does not cover every obligation (e.g., DPIAs for high-risk processing) and a completed checklist is not a guarantee. Compliance depends on actual practices plus counsel review.

Authoritative references

GDPR Art. 6 (lawful basis): https://gdpr-info.eu/art-6-gdpr/
GDPR Art. 12–14 (transparency): https://gdpr-info.eu/art-12-gdpr/
GDPR Art. 33 (breach notification): https://gdpr-info.eu/art-33-gdpr/

FAQ

Is this checklist the same as being GDPR-compliant?

No. It is a control inventory for an app. Compliance depends on actual practices plus counsel review; a completed checklist is not a guarantee.

Do I need a lawful basis for every purpose?

Under Art. 6, yes — a documented basis (consent, contract, or legitimate interest) for each processing purpose involving personal data.

What's the 72-hour rule?

Under Art. 33, a personal-data breach generally must be reported to the supervisory authority within 72 hours of becoming aware. The checklist flags that you need a path for it.

Can PolicyDeck complete the checklist for me?

PolicyDeck drafts the privacy notice from your answers. Processor agreements, transfer mechanisms, and the breach path stay with your team and counsel.

Is a generated policy a guarantee of compliance?

No. A generated document is a template and a starting point; compliance depends on accurate inputs and counsel review.

## Disclaimer

Disclaimer (template, not legal advice): PolicyDeck generates plain-English legal document templates (privacy policy, terms, EULA, cookie policy) from your answers. It is not a substitute for a qualified attorney, and a generated document is a starting point, not a guarantee that your app meets GDPR, CCPA, or any other regulation. Have counsel review before relying on a document, especially for high-risk data or regulated markets.

Generate an App Store-ready privacy policy that maps to your GDPR checklist — try PolicyDeck — try PolicyDeck.