GDPR Form Compliance Checker

Pre-checked boxes or implied consent are not valid under GDPR. Users must take a clear affirmative action.

Vague phrases like "I agree to terms" are insufficient. Users must understand what they're consenting to.

Users should be able to consent to some purposes but not others, giving them control over their data.

Withdrawing consent must be as easy as giving it. Users need to know how to opt out.

You can only collect personal data that is adequate, relevant, and limited to what is necessary.

Users have the right to know why you're collecting their data before they provide it.

Users should understand which fields they must fill out and which are optional.

Special categories of data (race, religion, health) require additional protections and legitimate reasons.

Users must be able to easily access information about how their data will be processed.

Your privacy policy must be complete and cover all aspects of data processing.

Legal jargon makes it hard for users to understand their rights and your obligations.

Users must be informed when you change how you process their personal data.

Users must know they can access, correct, delete, or port their personal data.

Users need to know how to contact you to exercise their data protection rights.

GDPR requires responding to rights requests within one month, with possible 2-month extension.

Users have the right to file complaints with data protection authorities if they're unhappy.

Personal data must be protected during transmission to prevent interception.

Data must be protected against unauthorized access, accidental loss, or destruction.

You cannot keep personal data longer than necessary for the purposes you collected it.

You must notify authorities within 72 hours of discovering a breach that poses risks.