GDPR Quick Check

In a few short questions, we assess where your organization stands on GDPR compliance and show you what to focus on now. The questions are built around recurring points in the practice of the Hungarian data protection authority (NAIH) — no legal expertise is needed to complete it.

Legal note: This is a preliminary, informational self-test, not a complete legal opinion. It provides guidance based on the answers given; actual compliance can only be established with knowledge of the specific data processing activities.

1. Do you have an up-to-date, complete privacy notice?

Reference: GDPR Articles 13–14

Yes, up to date and covers all data processingWe have one, but it's outdated or incompleteNo

2. Do you keep a record of processing activities (RoPA)?

Reference: GDPR Article 30

Yes, an up-to-date recordPartially / not up to dateNo

3. Is the legal basis clarified for every processing activity, and where you rely on consent, is it voluntary, specific and revocable?

Reference: GDPR Articles 6–7

Yes, clarified for every processing activityMostly, but there are some uncertain pointsNot clarified / we mostly rely on consent

4. Do you send marketing messages to purchased or third-party-acquired mailing lists?

Reference: GDPR Article 6 · NAIH practice

No, only to our own, consent-based listsWe don't send direct marketingYes, including purchased / third-party listsI'm not sure where the addresses come from

5. Do you carry out employee monitoring (e.g. camera, GPS, email/device monitoring), and what is it based on?

Reference: GDPR Article 6 · NAIH practice

We don't use any such monitoringYes, with a written legitimate interest assessment and noticeYes, based on employee consentYes, but without a documented legal basis

6. Where you rely on legitimate interest, do you have a written legitimate interest assessment (LIA)?

Reference: GDPR Article 6(1)(f) · NAIH practice

Yes, for every relevant processing activityPartiallyNo, there is no written assessmentWe don't rely on legitimate interest

7. Do you have a process for handling data subject requests (access, erasure) within one month?

Reference: GDPR Articles 12, 15–22

Yes, a documented process with deadline trackingWe handle them, but without a formal processNo process in place

8. Do you have a written data breach response procedure (with the capability to notify within 72 hours)?

Reference: GDPR Articles 33–34 · NAIH practice

Yes, a written procedure and incident logWe have an idea, but it's not documentedNo

Contact

If you'd like, we'll send you the result and get in touch with you.

NameE-mailOrganization

Consent

By providing your email address, you consent to Lawit contacting you with the results and related information. Data processing: [PRIVACY POLICY LINK].

Yes, I consent

An e-mail address and consent are required to submit.