# Creating GDPR Remediation Roadmap -- Workflow Reference

## Initiation Workflow

1. Identify the trigger: new compliance programme, periodic review, organisational change, or regulatory development.
2. Define the scope: which GDPR articles, processing activities, and business units are in scope.
3. Assign the assessment lead (typically the DPO or a senior privacy analyst).
4. Establish the timeline and milestones.
5. Notify relevant stakeholders.

## Execution Workflow

1. Gather documentation: policies, procedures, records, contracts, and technical documentation.
2. Conduct interviews with processing owners and key stakeholders.
3. Map current state against each requirement in scope.
4. Classify each requirement as: Compliant, Partially Compliant, Non-Compliant, or Not Applicable.
5. Document evidence for each classification.
6. Produce findings report with prioritised recommendations.

## Review and Approval Workflow

1. DPO reviews findings for accuracy and completeness.
2. Processing owners review findings relevant to their areas.
3. Data Protection Steering Committee reviews and approves the assessment.
4. Remediation actions assigned to owners with deadlines.

## Follow-Up Workflow

1. Track remediation actions through the findings register.
2. Conduct follow-up reviews at defined intervals based on severity.
3. Update compliance status upon remediation completion.
4. Feed findings into the annual DPO report and risk register.
5. Schedule the next periodic review.