Is your toolchain GDPR-proof?

1Do you have a data processing agreement (DPA) with every tool vendor?

As soon as a provider processes personal data on your behalf – customer names inside tasks are enough – Article 28 GDPR requires a contract covering it. Without one, the legal basis for the entire processing is missing.

2Do you know which country the data actually sits in?

Where a company is registered says nothing about where its servers are. What matters is where data is processed and backed up – backups included.

3Is it clear whether data is transferred to third countries such as the US?

With US vendors, the transfer needs a solid legal basis. This isn't a formality — it's the first thing supervisory authorities look at.

4Do you have an up-to-date list of sub-processors?

Almost every SaaS tool relies on further services for hosting, email delivery or error logging. That chain belongs in your documentation, and you have to be told when it changes.

5Is every tool you use listed in your record of processing activities?

Article 30 GDPR requires a record of processing activities. In practice, the tools missing from it are exactly the ones individual teams picked up on the side.

6Is it defined how long data is kept and when it gets deleted?

Without a deletion policy, customer data from finished projects piles up indefinitely. That contradicts the storage limitation principle and makes any breach worse.

7Can you actually fulfil access and deletion requests for a single person?

Data subject rights apply whether or not your tool has a matching feature. If you can't locate data reliably, every request becomes manual work — against a deadline.

8Is it defined who may access what — and is access logged?

Freelancers, former staff, interns: accounts often outlive the collaboration. Roles and an audit log are the difference between an incident and a provable incident.

9Are client credentials stored encrypted — and not in a spreadsheet or chat?

For agencies this is the most delicate point: whoever manages access to client systems is also liable for keeping it safe. A spreadsheet in a shared folder meets none of the requirements.

10Is the channel your customers use to report issues legally sound?

A widget, portal or form on your website collects personal data. It needs a mention in your privacy policy — and the data collected is subject to the same rules as everything else.