First-time GDPR programmes usually go wrong in the same places: no record of what personal data exists, a lawful basis nobody wrote down, processors without Article 28 contracts, data subject requests that miss the one month deadline, and breach plans that cannot meet 72 hours. Each is fixable with a short document and a named owner.
Mistake 1: starting with the cookie banner
Cookie banners are visible, so teams begin there. The legal foundation sits elsewhere. Article 30 requires controllers to keep a record of processing activities containing purposes, categories of data subjects and personal data, recipients, third country transfers, retention time limits where possible and a general description of security measures. Processors keep a record too. Build that record first, because every other task reads from it.
Mistake 2: "legitimate interest" as a blanket answer
Article 6 lists the lawful bases, and you need one for each processing purpose before you start. Picking legitimate interest everywhere without a documented balancing assessment is a common failure. Where you rely on consent, it must be demonstrable, so keep records of who consented, when and to what.
Mistake 3: signing up vendors without a processor contract
Article 28(3) requires processing by a processor to be governed by a binding contract setting out subject matter, duration, nature and purpose, type of personal data, categories of data subjects and obligations. It must require processing only on documented instructions. Article 28(2) restricts engaging sub-processors without written authorisation. First timers use a dozen SaaS tools and have contracts for two. List every vendor that touches personal data and check for a data processing agreement.
Mistake 4: treating rights requests as an inbox task
Under Article 12(3), you must provide information on action taken on an Article 15 to 22 request without undue delay and in any event within one month of receipt. Requests arrive in support tickets, social messages and sales emails. Without a single intake route and identity checks, the clock runs while the request sits in the wrong queue. Define a channel, an owner, a template and a log.
Mistake 5: no breach drill
Article 33 requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to individuals. A late notice must be accompanied by reasons for the delay. Processors must tell the controller without undue delay. Decide in advance who declares a breach, who contacts the regulator and what the notice contains: nature of the breach, categories and approximate numbers affected, contact point, likely consequences and measures taken.
Mistake 6: skipping the DPIA until launch week
Article 35 requires an impact assessment before processing that is likely to result in high risk, for example large scale processing of special categories of data or systematic and extensive profiling with significant effects. Do it during design, when changes are cheap.
Mistake 7: assuming a small company needs no thought on a DPO
Article 37 sets out when a data protection officer is mandatory: public authorities, core activities involving large scale regular and systematic monitoring, or large scale processing of special categories. If none applies you may still appoint one voluntarily. Document your reasoning either way.
What to do
- Run a data mapping exercise by team and system, then write the Article 30 record.
- For each purpose, record the lawful basis and the reasoning.
- List all processors and sub-processors and put an Article 28 contract in place for each.
- Publish a privacy notice that matches the record. Check it against Articles 13 and 14.
- Create the rights request workflow and a response log with the one month rule visible.
- Write and rehearse a breach procedure with a 72 hour timeline.
- Add a screening question to project intake that triggers a DPIA assessment.
- Record your DPO decision.
- For transfers outside the EEA, document the mechanism you rely on and check current guidance.
Quick check
Does GDPR apply to my company if I am outside the EU?
It can, if you offer goods or services to people in the EU or monitor their behaviour. Check Article 3 for your situation.
Is one month the same as 30 days?
The text says within one month of receipt. Treat the shorter reading as your internal target to avoid disputes.
How Safeguard helps automate this
Most of these mistakes come from missing records. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between reviews, which saves your team time for other work. For the security of processing duties, technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies and other findings; it is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard does not make you GDPR compliant; supervisory authorities and your own legal advisers decide that. Book a call.
Sources
- Regulation (EU) 2016/679 (GDPR), EUR-Lex: Articles 12, 28, 30, 33, 35, 37.
Last reviewed: 18 October 2026.
