A small company can organise GDPR basics in 12 weeks: map data and roles in weeks one to three, fix lawful bases and notices in four to six, handle processors and security in seven to nine, build rights and breach processes in ten and eleven, and review in twelve. The calendar is a template, not a legal deadline.
What does this calendar assume?
You are a company with a few systems and no dedicated privacy team. GDPR has applied since 2018, so if you process personal data of people in the EU you already owe these duties. Nothing here is legal advice, and no source sets a standard time to comply. Adjust the pace to your size and ask a lawyer about gray areas, such as transfers outside the EU.
Weeks 1 to 3: know what you hold
Name an owner. Interview each team and list the personal data they handle, why, where it is stored, who receives it and how long you keep it. Include HR, marketing, support, analytics and backups. Decide for each activity whether you act as controller or processor. This list becomes the record of processing activities that Article 30 requires, though entities with fewer than 250 employees have a partial exemption unless processing is risky, regular or involves special categories. Owner: privacy lead.
Weeks 4 to 6: lawful basis and transparency
For every activity, choose and record a lawful basis from Article 6. Where you rely on consent, check it meets Article 7 conditions, including that withdrawal is as easy as giving it. Rewrite your privacy notice to match the data map, covering what Articles 13 and 14 list: who you are, purposes, bases, recipients, retention, rights and transfers. Review forms and tools to collect only what is necessary. Owner: privacy lead with marketing and product.
Weeks 7 to 9: processors, security and risk
List every processor and sign Article 28 agreements. Check each processor's own subprocessors and security. Review your technical and organisational measures against Article 32: access control, encryption where suitable, backups, vulnerability management and testing. For high risk processing, such as large scale monitoring or sensitive data, complete a data protection impact assessment under Article 35. Decide whether you need a data protection officer under Article 37. Owner: security lead and procurement.
Weeks 10 and 11: rights and breaches
Write a procedure for access, correction, erasure and other requests. Article 12(3) requires a response without undue delay and within one month of receipt, with a possible extension of two further months in some cases. Run a test request through every system. Write a breach procedure: Article 33 requires notifying the supervisory authority without undue delay and where feasible within 72 hours of becoming aware, unless the breach is unlikely to result in risk, and Article 33(5) requires you to document every breach. Run a drill. Owner: privacy lead and incident lead.
Week 12: review and plan upkeep
Check that every document is dated and owned. Hold a short management review. Set a yearly cycle: refresh the data map, review processors, retest rights and breach drills, and train staff. Owner: sponsor.
What evidence should you have at the end?
The data map and processing record, lawful basis register, privacy notice with version history, consent records where used, processor agreements and list, security measure descriptions, any impact assessments, rights request log, breach register and drill notes, training records.
Try the framework mapping demo full screen.
What to do
- Appoint an owner and a sponsor.
- Build the data map and roles in three weeks.
- Record lawful bases and fix notices.
- Sign processor agreements and review security.
- Run impact assessments where needed and decide on a DPO.
- Test rights requests and breach drills.
- Review, date every document and set the yearly cycle.
Quick check
How fast must I answer a data subject request?
Without undue delay and within one month of receipt, per Article 12(3). The period can be extended by two further months in some cases, and you must tell the person.
How fast must I report a breach?
Where feasible within 72 hours of becoming aware, to the supervisory authority, unless the breach is unlikely to result in a risk to people. Article 33 sets the detail.
How Safeguard helps automate this
The slow part of this calendar is keeping security evidence current after week twelve. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between reviews. Technical evidence for Article 32 style measures comes from your real code and dependencies, using scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps prepare and keep evidence ready. Regulators decide compliance. Book a call for a demo.
Sources
Last reviewed: 18 October 2026.
