Maintaining GDPR Compliance Year-Round

Maintaining GDPR Compliance Year-Round: What to Review, and When

"Keep everything continuously monitored" is true and useless without a calendar attached. GDPR itself doesn't specify review frequencies — but the EDPB's guidance and how actual fines get calculated point to a pretty consistent rhythm. Here's what that rhythm actually looks like, broken down by how often each piece genuinely needs attention.

Immediately: Whenever Something Changes

Some updates can't wait for a scheduled review, because the gap itself is the risk:

• A new vendor or sub-processor gets added — update the RoPA and confirm a DPA is in place before they touch any data, not after

• A new product or feature launches that touches personal data — this should already have had a privacy review before launch, but the RoPA needs the update the moment it's live

• A processing activity stops — don't just stop using the data; update the record and actually delete what's no longer needed

This is the category most organizations get wrong, not because they don't know it matters, but because "update the RoPA" loses to shipping deadlines unless someone owns it as a real, blocking step.

Quarterly: RoPA and Vendor Review

Most practitioner guidance — including from organizations like the EDPB — points to quarterly as the right cadence for two things specifically:

Reviewing your RoPA with the actual business owners, not just compliance staff. The people running each process are the ones who'll know if something's drifted since the last review — a new integration, a changed data flow, a vendor that's quietly expanded what it has access to.

Reviewing vendor relationships and DPAs. Confirm vendors still hold the certifications you relied on when you signed them, check whether any sub-processor chains have changed, and catch anything that's drifted since the last check-in.

Skipping this and treating RoPA review as an annual exercise is a documented pattern in real enforcement actions. One case involved a healthcare provider fined over €200,000 where an out-of-date RoPA was cited alongside related transparency and security failures — the RoPA gap itself wasn't the biggest piece of the fine, but it made the rest of the case against the organization stronger.

Annually: The Full Review

At least once a year, do the deeper pass that a quarterly check won't catch:

• Walk through every product or feature launched or changed in the past year and confirm each one is actually reflected in your RoPA, with a lawful basis attached

• Check for processing that's quietly continued past its purpose — data collected for something that no longer exists, systems decommissioned but never actually wiped

• Review regulatory developments from the past year — new EDPB guidance, decisions from major supervisory authorities, anything that's shifted how a requirement gets interpreted

• Confirm cross-border transfer mechanisms are still valid — this one matters more than people expect, since a mechanism that was fine last year can become legally shaky without you doing anything wrong, just because the underlying legal landscape shifted

• Run full privacy training for the organization, not just new hires

Why Skipping the Schedule Costs More Than the Time It Saves

The pattern across actual enforcement cases isn't subtle: a missing or outdated RoPA repeatedly shows up as an aggravating factor, not the headline violation. Regulators have fined organizations specifically for having no record of processing activities at all — in one case, a fine partly because the organization couldn't show any documentation of how it processed data in the first place. In another, an incomplete RoPA was used as evidence of a broader pattern of weak compliance, increasing the total penalty beyond what the underlying issue alone would have cost.

The uncomfortable truth in most of these cases: a quarterly fifteen-minute check-in with the right business owner probably would have caught the gap before a regulator did.

Building This Into a Calendar, Not a Memory

The organizations that actually keep this current treat it the way they'd treat any other recurring business process — assigned owners, calendar reminders, and a real consequence if a quarter gets skipped. Relying on "someone will remember to update it" is the same as not having a schedule at all.

Where This Connects to Other Frameworks

A lot of this cadence overlaps with what ISO 27001 and SOC 2 already expect — periodic vendor review, ongoing risk reassessment, documented evidence that's actually current rather than stale. Building one shared review calendar across all three, instead of three separate ones running on different schedules, is usually less work than it sounds like.

FAQs

How often should a company review its GDPR compliance program? GDPR itself doesn't specify a required frequency, but practitioner guidance from bodies like the EDPB points to a consistent rhythm: certain changes require immediate updates, RoPA and vendor relationships need quarterly review, and a deeper full review should happen at least annually.

What GDPR compliance updates need to happen immediately rather than on a schedule? Some changes can't wait for a scheduled review: adding a new vendor or sub-processor (update the RoPA and confirm a DPA before they touch data), launching a new product or feature that touches personal data (update the RoPA the moment it goes live), and stopping a processing activity (update the record and delete data that's no longer needed).

How often should a Record of Processing Activities (RoPA) be reviewed? Most guidance, including from the EDPB, points to quarterly reviews of the RoPA — ideally with the actual business owners running each process, not just compliance staff, since they're most likely to notice drift like new integrations or expanded vendor access.

How often should vendor relationships and DPAs be reviewed under GDPR? Quarterly. This includes confirming vendors still hold the certifications relied on at signing, checking whether sub-processor chains have changed, and catching any drift in vendor data access since the last review.

What should a company review annually as part of GDPR compliance? An annual deep review should cover every product or feature launched or changed that year (confirming it's reflected in the RoPA with a lawful basis), processing that's continued past its original purpose, regulatory developments from the past year, validity of cross-border transfer mechanisms, and organization-wide privacy training.

Can an outdated RoPA actually lead to a GDPR fine? Yes. Regulators have cited outdated or missing RoPAs as an aggravating factor in real enforcement cases — including one healthcare provider fined over €200,000 where an outdated RoPA compounded transparency and security failures, and other cases where a missing RoPA alone was cited as a violation.

Why do cross-border data transfer mechanisms need annual review if nothing changed on our end? A transfer mechanism that was valid last year can become legally shaky due to shifts in the underlying legal landscape — such as new adequacy decisions, court rulings, or regulatory guidance — even if the company itself made no changes to its practices.

What's the risk of treating GDPR compliance reviews as a one-time or annual-only task? Treating compliance as a "set it and forget it" project allows gaps to accumulate quietly — stale RoPAs, expired vendor certifications, or processing that's outlived its original purpose. These gaps tend to surface during an investigation rather than being caught proactively, which regulators treat as an aggravating factor.

Who should be responsible for keeping GDPR documentation like the RoPA current? Effective programs assign real ownership and calendar-based reminders rather than relying on someone informally remembering to update records. Business process owners — not just compliance staff — are typically best positioned to catch changes like new integrations or expanded data flows.

Does the GDPR review cadence overlap with ISO 27001 or SOC 2 review schedules? Yes, substantially. Periodic vendor review, ongoing risk reassessment, and maintaining current documented evidence are expectations shared across ISO 27001 and SOC 2. Building one shared review calendar across all three frameworks is typically more efficient than running separate schedules for each.