# GDPR Checklist for ERP Data Migration and Implementation in Europe

> Source: https://netray.co/tools/gdpr-erp-data-migration-checklist
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

A practical checklist for handling personal data safely when you migrate to or implement a new ERP in the EU.

## Category

compliance-legal

## Region

European Union

## Audience

- ERP project manager
- Data protection officer
- IT manager

## Tool

**Kind:** checklist

**Groups:**

#### Discovery and inventory

**Items:**

**Text:** List every table and field in the legacy ERP that holds personal data (employees, contacts, sole traders, drivers).

**Critical:** true

Include free text, notes, attachments and document stores in the inventory.

Record data sources outside the ERP that feed it, such as spreadsheets, email and shop floor terminals.

**Text:** Identify special category data, for example health or union membership in HR modules.

**Critical:** true

Update the record of processing activities for the new system.

Confirm which legal entities are controllers and which parties are processors.

#### Legal basis and contracts

**Items:**

**Text:** Document the legal basis for each processing purpose in the new ERP.

**Critical:** true

**Text:** Sign a data processing agreement with the vendor, hosting provider and implementation partner.

**Critical:** true

Check the list of sub-processors and their locations.

**Text:** Assess any transfer of personal data outside the EEA and document safeguards.

**Critical:** true

Check whether a data protection impact assessment is required and complete it if so.

Confirm works council or employee representative consultation where national law requires it.

#### Data minimisation and retention

**Items:**

**Text:** Decide which records are migrated and which are archived or deleted.

**Critical:** true

Apply retention periods before the extract, not after go-live.

Keep statutory retention for accounting and tax records separate from marketing data.

Remove duplicate and dormant contacts without a business purpose.

Define deletion and anonymisation routines in the new system.

Document how erasure requests will work with archived and backup data.

#### Security during migration

**Items:**

**Text:** Encrypt extract files at rest and in transit.

**Critical:** true

**Text:** Restrict who can access staging databases and migration spreadsheets.

**Critical:** true

Log all access to migration data and review the logs.

Delete temporary extracts and staging copies after sign-off.

Use separate credentials for migration tools and rotate them after go-live.

Keep migration work on approved devices and locations.

#### Test and training environments

**Items:**

**Text:** Anonymise or pseudonymise personal data in test and training systems.

**Critical:** true

Block outbound email and EDI from non-production systems.

Apply the same role model in test as in production when real data is used.

Refresh test data under a controlled, documented process.

Remove consultant access when the project phase ends.

#### Go-live and operation

**Items:**

**Text:** Verify role and authorization design follows least privilege.

**Critical:** true

Confirm audit logging is switched on for sensitive fields.

Test the process for subject access, rectification and erasure requests.

**Text:** Retire the legacy system or restrict it to read-only with a defined end date.

**Critical:** true

Inform employees and data subjects where privacy notices change.

Schedule a post go-live privacy review within the first quarter.

**Scoring Note:** Count completed items per group. Any unchecked critical item is a blocker for cutover until it is closed or formally accepted by the data protection officer. This checklist supports your own compliance work and is not legal advice.

## Content

**Intro:** An ERP migration copies customer, supplier, employee and contact data into a new system, often through spreadsheets and temporary databases. That is exactly where personal data leaks or unintended retention happen. This checklist covers the privacy steps European manufacturers should plan into the project.

**Sections:**

#### How to use the checklist

**Body:** Assign each group to an owner: the project manager, the data protection officer, IT security and the vendor contact. Work through the items before the first full data load, not just before go-live. Critical items are those that, if skipped, usually create a reportable incident or a regulator finding. Export the finished list as PDF to attach to your project documentation and your record of processing activities.

#### Why migration is a privacy risk

**Body:** Migrations create copies: extracts, staging databases, mapping spreadsheets and test systems. Each copy is a new place where personal data lives, often with weaker access control than production. Consultants may also need access from outside the company or the EEA. Under GDPR, you remain responsible as controller, so the contracts, the transfer assessment and the cleanup of temporary copies are as important as the field mapping itself.

#### Retention and minimisation

**Body:** Do not migrate everything by default. Decide per object what the business and the law require. German and other national rules require accounting records to be kept for years, but marketing contacts without activity usually have no basis for retention. Deleting or archiving before the extract reduces the data you must protect and shortens the cutover.

**Bullets:**

- Define retention per data object, not per system.
- Archive instead of migrating closed history that is rarely used.
- Mask personal fields in test environments.
- Document exceptions with a reason and an owner.

#### Common mistakes

**Body:** Frequent failures are production data copied into a test system, migration spreadsheets sent by email, test systems that still send real emails to customers, and legacy systems left online with no owner. Another is forgetting free text and attachments, which often hold personal data in unstructured form.

**Cta:** Netray can scan a read-only copy of your legacy ERP and documents on your own infrastructure to help locate personal data before you migrate, with no data leaving your environment.

**Faq:**

#### Do we need a DPIA for an ERP migration?

**Answer:** Not always. It depends on the scale, the type of data and whether the new system introduces high-risk processing such as extensive employee monitoring. Your data protection officer should screen the project and document the decision either way.

#### Can consultants use production data in testing?

**Answer:** It is better to avoid it. Use anonymised or pseudonymised data in test systems. If real data is unavoidable, apply production level access control, a processing agreement and a deletion date, and keep outbound communication disabled.

#### What about backups of the old ERP?

**Answer:** Backups still contain personal data. Define how long they are kept, who may restore them and how erasure requests are handled for archived data. Document this in your retention policy so it can be explained to a regulator.

#### Does this checklist replace legal advice?

**Answer:** No. It supports project planning. National law, works council rules and sector requirements differ, so confirm the final approach with your data protection officer or legal counsel.

## Search terms

gdpr erp migration checklist, gdpr erp implementation, personal data in erp, erp test data anonymization, gdpr retention erp, data protection erp project, dpia erp, erp data cutover privacy

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json