GDPR Readiness Pro — Find Compliance Gaps & Build an Action

## GDPR Readiness Pro: worked example **Scope:** this fictional brief, using only supplied information. A fictional EU web shop stores orders indefinitely, uses an email provider and has no processing inventory. It wants a gap plan, not a legal compliance declaration. ### Deliverable | Workstream | Finding / decision | Recommended action | |---|---|---| | Processing map | Order and email workflows known; details missing | Document data categories, subjects, purposes, systems, roles, recipients and proposed lawful-basis rationale for qualified review. | | Retention | Indefinite storage lacks stated justification | Separate mandatory records from optional marketing data; set purpose-specific retention candidates and approval owners. | | Vendor and rights | Provider terms and request workflow unavailable | Obtain vendor agreements/transfer details and define identity-verified rights-request intake, routing and evidence logs. | ### Decision and next steps Assign a privacy owner, inventory processing and prioritize high-risk gaps. Verify requirements with qualified counsel; do not label the shop GDPR compliant from this preliminary plan. ### Evidence boundaries Conclusions apply to the supplied scenario. Missing facts remain unverified; recommendations are not completed actions. Validate source data and approvals before implementation. Track results against the objective and adjust only when new evidence supports change.