In 2025, the Spanish DPA imposed fines worth 27 million euros, and a large share of them targeted SMEs. Your web application processes personal data every day: forms, cookies, emails, payments. Non-compliance with the GDPR already carries real consequences for businesses of every size.
This technical checklist covers the 8 verification points every web application must pass to comply with the GDPR. It complements our GDPR security audit with concrete actions you can implement starting today.
Why 73% of SMEs Fail GDPR Compliance
The GDPR is not just a legal document: it is a technical framework that directly affects how you build and operate your web application. Most SMEs fail because they underestimate the technical component:
- Fines of up to 20M EUR or 4% of annual global turnover for serious infringements
- A disproportionate share of DPA sanctions target SMEs that lack specialised technical advice
- Irreversible reputational damage: 60% of customers leave a company after a data breach
- Temporary operational shutdown: the DPA can order data processing suspension while the infringement is resolved
EU Hosting and Data Residency
The first point on your GDPR checklist is ensuring that personal data does not leave the European Economic Area without adequate safeguards:
- Servers physically located in the EU (Frankfurt, Amsterdam, Paris or Madrid as primary options)
- Data Processing Agreements (DPA) signed with all cloud infrastructure providers
- Verification that the provider's sub-processors also comply with EU data residency
- Encryption in transit (TLS 1.3) and at rest (AES-256) for the entire database
- International transfer registry documented and accessible for audit
Consent and Processing Audit
Every piece of personal data you collect needs a legal basis. Consent is the most common, but also the hardest to implement correctly:
- Cookie banner with granular consent (not pre-selected) and a reject option equally accessible as accept
- Immutable consent log with timestamp, accepted policy version and user IP
- Double opt-in for marketing communications with a working unsubscribe link in every email
- Quarterly audit of all legal bases for processing documented in the record of activities
- Data Protection Impact Assessment (DPIA) for any processing involving automated profiling or sensitive data
Security by Design
Article 25 of the GDPR requires data protection by design. This translates into concrete technical measures in your web application:
- Minimisation principle: collect only the data strictly necessary for each feature
- Pseudonymisation of personal data in development and testing environments (never use real data in staging)
- Role-based access control (RBAC) with least privilege principle for every user and service
- Encryption of sensitive fields at the application level (not just at the database level)
- Personal data access logs with limited retention and tamper protection
- HTTP security headers configured: Content-Security-Policy, X-Frame-Options, Strict-Transport-Security
- Annual penetration testing and automated vulnerability scanning in the CI/CD pipeline
Data Subject Rights
Your application must facilitate the exercise of data subject rights (access, rectification, erasure, restriction, portability, objection):
- Self-service portal where users can view, download and rectify their personal data
- Data export endpoint in structured format (JSON/CSV) for the right to portability
- Complete deletion mechanism that erases data from the main database, backups and third-party systems
- Maximum 30-day response period implemented with automatic alerts to the responsible team
- Log of all data subject rights requests with full traceability
- Identity verification of the requester before delivering or modifying personal data
Legacy Systems Audit
Legacy applications are the biggest hidden GDPR risk. Old systems that process personal data without current safeguards:
- Complete inventory of all systems that store or process personal data (including Excel and SharePoint)
- Data flow map between systems to identify undocumented transfers
- Vulnerability assessment of obsolete frameworks and libraries (versions without security support)
- Migration plan prioritised by risk level for systems that cannot comply with the GDPR
- Temporary compensating controls (additional encryption, access restriction) during migration
- Documentation of residual risk analysis accepted and approved by management
Incident Response Plan
The GDPR requires notifying data breaches to the DPA within a maximum of 72 hours. Without a tested plan, that deadline is impossible to meet:
- Documented procedure for detection, containment, eradication and recovery from data breaches
- Designated response team with clear roles and updated contact details (including out of hours)
- DPA and data subject notification templates prepared and reviewed by the DPO
- Real-time monitoring system that detects anomalous access or data exfiltration
- Biannual incident simulations to verify the team can respond in under 72 hours
- Log of previous incidents with post-mortem analysis and corrective actions implemented
Action Plan: Next 30 Days
You don't need to implement everything at once. Here is a realistic plan for the next 30 days:
- Week 1: Personal data inventory and flow mapping. Identify what data you collect, where it is stored and who has access.
- Week 2: Consent and cookie audit. Verify your banner complies, review consent records and update the privacy policy.
- Week 3: Technical security review. Configure HTTP headers, verify encryption, implement RBAC and review access logs.
- Week 4: Incident response plan and training. Document the procedure, assign roles and run a simulation with the team.
FAQ: GDPR Security for Web Applications
How much does a GDPR non-compliance fine cost?
Minor infringements can reach up to 40,000 EUR, serious ones up to 300,000 EUR, and very serious ones up to 20 million euros or 4% of annual global turnover, whichever is greater. The Spanish DPA has imposed multi-million euro fines on companies of all sizes.
Does my SME need a DPO?
A Data Protection Officer is mandatory if you process personal data on a large scale, handle sensitive data (health, biometric, ideology) or carry out systematic monitoring of individuals. Even if not mandatory, appointing a DPO is good practice that demonstrates commitment to compliance.
How do I know if my web app complies with the GDPR?
Conduct a technical audit following the 8 verification points described in this article: data residency, consent, security by design, data subject rights, legacy systems, incident response, EU hosting and action plan. If you fail more than 2 points, you need professional assistance.
What do I do if I suffer a data breach?
You must notify the DPA within a maximum of 72 hours from when you become aware of the breach. Document the scope of the incident (what data has been affected and how many data subjects), apply immediate containment measures and notify affected individuals if the breach poses a high risk to their rights and freedoms.
Conclusion
GDPR compliance is not a project with an end date: it is an ongoing process that requires periodic technical review. The 8 points in this checklist cover the critical areas that the DPA evaluates in its inspections. Most SMEs fail not out of bad intent, but due to a lack of technical knowledge. A 30-day plan like the one outlined here lets you address the most urgent gaps and measurably reduce your exposure to sanctions.
If you need professional help implementing these measures, check out our cybersecurity and data protection services .
