GDPR in 2026: an updated compliance checklist
This GDPR checklist for 2026 shows SMEs what to review, which evidence proves it and what is changing. It focuses on Spain. Eight years after it started to apply, the GDPR is far from settled. Spain’s regulator is breaking complaint records, and 2026 brings new procedural rules, a reform under negotiation and fresh guidance.
In 30 seconds: the GDPR checklist for 2026 rests on the same pillars. That is: records of processing, lawful basis, transparency, processor contracts, security, DPIAs, 72-hour breach notification and one-month replies to requests. However, you now need evidence for each. In addition, Procedural Regulation (EU) 2025/2518 is already in force and will apply from 2 April 2027. By contrast, the Digital Omnibus changes to cookies and breach reporting are still only a proposal.
GDPR checklist 2026 by area
| Area | What to check | Evidence |
|---|---|---|
| Governance and DPO | Whether you must appoint a DPO (Article 37 GDPR; in Spain, also Article 34 LOPDGDD) and who owns privacy | Assessment of the obligation and appointment notified to the regulator, or a written internal assignment |
| Records of processing (RoPA) | Each activity with purpose, categories, recipients, retention and measures (Article 30) | Dated RoPA reviewed in the last 12 months |
| Lawful basis | One Article 6 basis per purpose; provable consent; documented legitimate interest balancing | Lawful basis in the RoPA, consent logs, balancing tests |
| Transparency | Complete privacy notices (Articles 13 and 14), layered where useful | Dated published versions |
| Processors and DPAs | A contract with every supplier processing data on your behalf (Article 28(3)) and control of sub-processors | Signed agreements and supplier inventory |
| Security (Article 32) | Access control, encryption, backups with tested restores, regular testing | Risk assessment, restore tests, access reviews |
| DPIA (Article 35) | Processing on the regulator’s lists or high risk (profiling, large-scale sensitive data) | Documented DPIAs or a reasoned note on why none is needed |
| Breaches (Articles 33-34) | Notify the authority within 72 hours and inform individuals when the risk is high | Procedure, internal breach register (Article 33(5)), exercises |
| Data subject rights | Reply within one month, extendable by two more (Article 12(3)) | Request log with dates |
| International transfers | Suppliers sending data outside the EEA and under which safeguard (adequacy, DPF, SCCs) | Transfer map, verified DPF certification, SCCs |
| Cookies (ePrivacy/LSSI) | Prior consent for non-essential cookies (Article 22(2) of Spain’s LSSI); rejecting as easy as accepting | Banner screenshots, consent records |
| AI and GDPR | AI tools processing personal data: lawful basis, transparency, automated decisions (Article 22) | Inventory of AI uses, acceptable use policy, DPIAs |
| Training | Staff know which data they may use and how to report a breach | Training plan and attendance records |
How to use the GDPR checklist: evidence and RoPA
This GDPR checklist has one rule: can you produce the evidence in the third column within a day? If not, that item does not count as met for accountability purposes (Article 5(2) GDPR).
In addition, beware of the record-keeping exemption for organisations with fewer than 250 employees (Article 30(5)). However, it does not apply if processing is not occasional, involves risk or includes special category data. As a result, in practice almost every SME needs a RoPA.
What has changed and what is changing in your GDPR checklist (2025-2026)
These are the changes your GDPR checklist needs to reflect.
Procedural rules for cross-border cases (adopted)
Regulation (EU) 2025/2518 of 26 November 2025 lays down additional procedural rules for enforcing the GDPR. Specifically, it covers cases where several authorities take part. It appeared in the Official Journal on 12 December 2025 and entered into force on 1 January 2026. It will then apply from 2 April 2027 to complaints and investigations started from that date. If you only process data in Spain, you will barely notice it. However, if you operate in other Member States, it affects you.
Digital Omnibus: cookies and breaches (proposal only)
On 19 November 2025 the Commission proposed the Digital Omnibus (COM(2025) 837), which would amend the GDPR and the ePrivacy Directive. First, it would move cookie rules into the GDPR with automated browser consent signals. It would also limit notification to the authority to high-risk breaches and extend the deadline from 72 to 96 hours. In addition, it would create a single reporting entry point run by ENISA. However, as of 14 October 2026 the procedure file 2025/0360(COD) still shows “awaiting committee decision” in the European Parliament. There is also no text agreed with the Council. Until it appears in the Official Journal, the 72-hour deadline and current cookie rules therefore apply. We explain the process in how to report a breach within 72 hours.
Transfers to the US: the DPF still stands
On 3 September 2025 the General Court dismissed the action against the EU-US Data Privacy Framework adequacy decision. The case is T-553/23, Latombe v Commission. An appeal is now pending before the Court of Justice (Case C-703/25 P), with no ruling as of the review date. You can therefore keep using DPF-certified suppliers. However, add a check of each certification to your GDPR checklist and keep standard contractual clauses ready as a fallback.
AEPD guidance on cookies and AI
The cookie guide of the AEPD, Spain’s data protection authority, is available in Spanish (May 2024 version). It requires rejecting to sit at the same level as accepting, enforceable since January 2024. On AI, the AEPD keeps its guide on GDPR compliance for AI-based processing. In addition, in February 2026 it published guidance on agentic AI.
Mistakes the AEPD fines most often: what your GDPR checklist must cover
According to the AEPD’s 2025 annual report, the authority received 30,931 complaints in 2025, 64% more than in 2024. The areas with the most sanctioning and warning proceedings were video surveillance, internet services and data breaches. Public administrations, retail, transport and hospitality, and healthcare also stand out. In addition, breach-related proceedings rose from 30 to 77 and accounted for €19.8 million, 40% of all fines. That is why your GDPR checklist should cover these recurring mistakes:
- CCTV without an information sign, or footage kept beyond one month without a reason (Article 22 LOPDGDD).
- Weak security that ends in a breach: no multi-factor authentication, untested backups, ransomware.
- Breaches not notified, or notified late and without an internal register.
- Cookies set before consent or without a clear reject option.
- Data subject requests left unanswered on time, especially access and erasure.
- Ignoring AEPD information requests, which the authority treats as a very serious infringement.
Almost all share a root cause: the control exists on paper, but nobody can show it works. Therefore, it pays to automate the collection of compliance evidence.
How the GDPR fits with NIS2 and the AI Act
If you are in scope of NIS2, one incident can start two clocks. On the one hand, NIS2’s: early warning within 24 hours, notification within 72 hours and a final report within one month. On the other, the GDPR’s: 72 hours to the data protection authority if the breach affects personal data. In addition, Article 35 of NIS2 requires cybersecurity authorities to inform the data protection authority. They must do so when they detect a personal data breach. Meanwhile, Spain still has no transposing law: the 2025 draft bill never reached Parliament and, after Parliament was dissolved on 6 October 2026, it is on hold until the next government. We track it in NIS2 in Spain: transposition still pending.
Under the AI Act, AI literacy (Article 4) and the prohibited practices have applied since 2 February 2025. Article 50 transparency has applied since 2 August 2026. Following Regulation (EU) 2026/1744, Annex III high-risk systems move to 2 December 2027. However, the GDPR does not wait, and your GDPR checklist must already cover AI. For example, using AI with personal data requires a lawful basis, transparency and, where the risk is high, a DPIA. See the timeline in the EU AI Act key dates.
The efficient approach is a GDPR checklist sharing one set of controls (risk, suppliers, incidents, training) with reusable evidence. We describe it in the control map for complying with multiple regulations.
GDPR checklist: frequently asked questions
Does your SME need a data protection officer?
Only if an Article 37 GDPR case applies: large-scale systematic monitoring, large-scale sensitive data or a public body. In Spain, you also need one if Article 34 LOPDGDD lists your activity. That article covers schools, insurers, financial institutions, healthcare providers and private security firms, among others. If no obligation applies, assign the role to someone internally and record it in writing.
How long do you have to answer a subject access request?
One month from receipt. You can extend it by two further months if the request is complex or you receive many. However, you must explain the extension and the reasons within the first month (Article 12(3) GDPR).
Has the EU adopted the Digital Omnibus GDPR reform?
No. As of October 2026, the part that amends the GDPR and the ePrivacy Directive is still under negotiation. The European Parliament and the Council have not yet agreed on it. In fact, the EU has only adopted the AI part (Regulation (EU) 2026/1744). Meanwhile, your GDPR checklist should keep the 72-hour deadline and current cookie rules.
Can you keep using US suppliers?
Yes. The EU-US Data Privacy Framework remains valid after the General Court’s September 2025 judgment. However, an appeal is pending before the Court of Justice. Therefore, check that the supplier holds a DPF certification. If not, use standard contractual clauses with a transfer impact assessment.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps with your GDPR checklist
Atalaya GRC turns this GDPR checklist into living controls. Each area has its control, owner and evidence, and the same control also counts towards NIS2, ENS or the AI Act. In addition, the third-party register brings together processor agreements and transfers. Incident management runs the 72-hour clock and the notifications. Finally, the regulatory clock flags request deadlines and changes such as the Digital Omnibus. See the GDPR page on Atalaya GRC or request a demo.
