GDPR Checklist — Amazing Agents Toolkit

Important note

This checklist is not legal advice. It's a practical structuring sheet we use internally for our audit processes. For setups in regulated industries (health, finance, legal) or when processing special categories of data, always bring in a data protection officer or specialist lawyer. This list helps you have the right conversation with them — it doesn't replace it.

The list

15 checkpoints before going live.

Order of work: first tick off every 🔴 must-have point — if one is left open, the agent does NOT go live. Then the 🟡 should-haves. Then, optionally, the 🟢 nice-to-haves.

🔴 Must-Have · Mandatory before going into production

Legal basis for data processing documented

Contract (Art. 6.1.b), legitimate interest (Art. 6.1.f), consent (Art. 6.1.a) — one of these must be clearly assigned. In writing, not just verbally.

Must

Data processing agreement (DPA) with the LLM provider

With OpenAI, Anthropic, Google, etc. — a DPA is mandatory whenever personal data is processed. Even if the provider says "the user is responsible" — you need the contract.

Must

Data flow diagram in place

A sketch showing: where the data comes from, where it goes, who has access, where it's stored. Sounds trivial, but is missing in 80% of the setups we audit.

Must

Privacy notices / privacy policy updated

If you process data from customers, employees, or applicants with AI, it must be stated in the privacy policy. Including provider, purpose, and retention period.

Must

Record of processing activities (RoPA) updated

Mandatory for every company with 250+ employees, or whenever special categories of data are processed. The AI agent is a processing activity — it must be listed.

Must

Deletion concept defined

How long is data stored? What happens once the period expires? What happens on a data subject's request? Concrete answers — no "case by case" phrasing.

Must

🟡 Should-Have · Strongly recommended

EU/DACH data residency checked

Which servers are actually used? With OpenAI's "Zero Data Retention" and EU servers: fine. With standard API endpoints: USA. This has consequences for your compliance.

Should

Pseudonymization in prompts where possible

If the use case allows it: strip names, emails, and phone numbers before the LLM call, or replace them with placeholders. Massively reduces GDPR risk.

Should

Audit trail for agent decisions

Which input led to which output? When? With which model? Keep for at least 12 months — for complaints and self-auditing.

Should

Data protection impact assessment (DPIA) for high-risk setups

Mandatory for systematic profiling, processing of special categories, or large-scale processing. When in doubt: better to do it than not — GDPR provides for steep fines.

Should

Escalation path for data subject rights

What happens when someone requests access, correction, or deletion? Who's responsible? How fast can you respond? 1 month is the statutory deadline.

Should

EU AI Act classification checked

Your agent's risk class: Minimal, Limited, High, or Unacceptable? High-risk applications need additional measures. The phase-in schedule takes effect gradually in 2026.

Should

🟢 Nice-to-Have · Good, but not mandatory

Transparency notice in the frontend where the end customer meets the agent

"This response was created with AI assistance" — builds trust, and is planned under the EU AI Act anyway. Building it in upfront is cheaper than retrofitting it.

Nice

Opt-out option for end users

"I only want human handling" — if your use case allows it, offering this option is good practice and reduces complaints.

Nice

Quarterly review of compliance measures

GDPR and AI law keep evolving. A 90-minute quarterly meeting is enough — but that quarterly meeting prevents most expensive surprises.

Nice

The most common traps we see

Trap 1: The DPA with the LLM provider gets forgotten — every other point is fulfilled, but this one is missing. Trap 2: The privacy policy gets updated once and then forgotten — it needs to be updated again whenever you switch tools. Trap 3: "We only process internal data" — employee data falls under GDPR too. Trap 4: No audit trail — this only becomes apparent once the first complaint comes in.

Guide

How to use the list.

Step 1 · Before setup begins

Go through the must-have points with your data protection officer or whoever is responsible for data protection. Clarify together: what do we already have? What's missing? Who's responsible for creating what? This clarification typically takes 60–90 minutes — and saves weeks at the end.

Step 2 · During implementation

Pin the list up visibly or into the project's Notion. For every major architecture decision: a 30-second check — does this violate a point? Incremental compliance is 10x cheaper than retrofitting it.

Step 3 · Before going live

Final audit with the data protection officer. All 6 must-haves ticked off? All 6 should-haves reviewed (even if you decided not to implement them)? Written sign-off from the data protection officer. Only then go live.

Step 4 · Quarterly

Take point 15 seriously. A 90-minute review every quarter: What's changed legally? What have we changed in our setup? Are all compliance points still current? This meeting is the cheapest insurance against fines there is.

GDPR
Checklist.

15 checkpoints before going live.

🔴 Must-Have · Mandatory before going into production

🟡 Should-Have · Strongly recommended

🟢 Nice-to-Have · Good, but not mandatory

How to use the list.

Step 1 · Before setup begins

Step 2 · During implementation

Step 3 · Before going live

Step 4 · Quarterly

Get the full checklist as a PDF.

15 checkpoints before going live.

🔴 Must-Have · Mandatory before going into production

🟡 Should-Have · Strongly recommended

🟢 Nice-to-Have · Good, but not mandatory

How to use the list.

Step 1 · Before setup begins

Step 2 · During implementation

Step 3 · Before going live

Step 4 · Quarterly

Get the full checklist as a PDF.

More tools in the toolkit

Process Audit Template

ROI Calculator

Agent Roadmap Template

Briefing Questionnaire