Maintaining GDPR Compliance Year-Round

Maintaining GDPR Compliance Year-Round: What to Review, and When

"Keep everything continuously monitored" is true and useless without a calendar attached. GDPR itself doesn't specify review frequencies — but the EDPB's guidance and how actual fines get calculated point to a pretty consistent rhythm. Here's what that rhythm actually looks like, broken down by how often each piece genuinely needs attention.

Immediately: Whenever Something Changes

Some updates can't wait for a scheduled review, because the gap itself is the risk:

• A new vendor or sub-processor gets added — update the RoPA and confirm a DPA is in place before they touch any data, not after

• A new product or feature launches that touches personal data — this should already have had a privacy review before launch, but the RoPA needs the update the moment it's live

• A processing activity stops — don't just stop using the data; update the record and actually delete what's no longer needed

This is the category most organizations get wrong, not because they don't know it matters, but because "update the RoPA" loses to shipping deadlines unless someone owns it as a real, blocking step.

Quarterly: RoPA and Vendor Review

Most practitioner guidance — including from organizations like the EDPB — points to quarterly as the right cadence for two things specifically:

Reviewing your RoPA with the actual business owners, not just compliance staff. The people running each process are the ones who'll know if something's drifted since the last review — a new integration, a changed data flow, a vendor that's quietly expanded what it has access to.

Reviewing vendor relationships and DPAs. Confirm vendors still hold the certifications you relied on when you signed them, check whether any sub-processor chains have changed, and catch anything that's drifted since the last check-in.

Skipping this and treating RoPA review as an annual exercise is a documented pattern in real enforcement actions. One case involved a healthcare provider fined over €200,000 where an out-of-date RoPA was cited alongside related transparency and security failures — the RoPA gap itself wasn't the biggest piece of the fine, but it made the rest of the case against the organization stronger.

Annually: The Full Review

At least once a year, do the deeper pass that a quarterly check won't catch:

• Walk through every product or feature launched or changed in the past year and confirm each one is actually reflected in your RoPA, with a lawful basis attached

• Check for processing that's quietly continued past its purpose — data collected for something that no longer exists, systems decommissioned but never actually wiped

• Review regulatory developments from the past year — new EDPB guidance, decisions from major supervisory authorities, anything that's shifted how a requirement gets interpreted

• Confirm cross-border transfer mechanisms are still valid — this one matters more than people expect, since a mechanism that was fine last year can become legally shaky without you doing anything wrong, just because the underlying legal landscape shifted

• Run full privacy training for the organization, not just new hires

Why Skipping the Schedule Costs More Than the Time It Saves

The pattern across actual enforcement cases isn't subtle: a missing or outdated RoPA repeatedly shows up as an aggravating factor, not the headline violation. Regulators have fined organizations specifically for having no record of processing activities at all — in one case, a fine partly because the organization couldn't show any documentation of how it processed data in the first place. In another, an incomplete RoPA was used as evidence of a broader pattern of weak compliance, increasing the total penalty beyond what the underlying issue alone would have cost.

The uncomfortable truth in most of these cases: a quarterly fifteen-minute check-in with the right business owner probably would have caught the gap before a regulator did.

Building This Into a Calendar, Not a Memory

The organizations that actually keep this current treat it the way they'd treat any other recurring business process — assigned owners, calendar reminders, and a real consequence if a quarter gets skipped. Relying on "someone will remember to update it" is the same as not having a schedule at all.

Where This Connects to Other Frameworks

A lot of this cadence overlaps with what ISO 27001 and SOC 2 already expect — periodic vendor review, ongoing risk reassessment, documented evidence that's actually current rather than stale. Building one shared review calendar across all three, instead of three separate ones running on different schedules, is usually less work than it sounds like.