GDPR ERP Data Migration Checklist (Free)

0%

0 of 35 items complete

11 critical items still open - these are the highest-risk gaps.

Download checklist:

Discovery and inventory

List every table and field in the legacy ERP that holds personal data (employees, contacts, sole traders, drivers).CRITICALInclude free text, notes, attachments and document stores in the inventory.Record data sources outside the ERP that feed it, such as spreadsheets, email and shop floor terminals.Identify special category data, for example health or union membership in HR modules.CRITICALUpdate the record of processing activities for the new system.Confirm which legal entities are controllers and which parties are processors.

Legal basis and contracts

Document the legal basis for each processing purpose in the new ERP.CRITICALSign a data processing agreement with the vendor, hosting provider and implementation partner.CRITICALCheck the list of sub-processors and their locations.Assess any transfer of personal data outside the EEA and document safeguards.CRITICALCheck whether a data protection impact assessment is required and complete it if so.Confirm works council or employee representative consultation where national law requires it.

Data minimisation and retention

Decide which records are migrated and which are archived or deleted.CRITICALApply retention periods before the extract, not after go-live.Keep statutory retention for accounting and tax records separate from marketing data.Remove duplicate and dormant contacts without a business purpose.Define deletion and anonymisation routines in the new system.Document how erasure requests will work with archived and backup data.

Security during migration

Encrypt extract files at rest and in transit.CRITICALRestrict who can access staging databases and migration spreadsheets.CRITICALLog all access to migration data and review the logs.Delete temporary extracts and staging copies after sign-off.Use separate credentials for migration tools and rotate them after go-live.Keep migration work on approved devices and locations.

Test and training environments

Anonymise or pseudonymise personal data in test and training systems.CRITICALBlock outbound email and EDI from non-production systems.Apply the same role model in test as in production when real data is used.Refresh test data under a controlled, documented process.Remove consultant access when the project phase ends.

Go-live and operation

Verify role and authorization design follows least privilege.CRITICALConfirm audit logging is switched on for sensitive fields.Test the process for subject access, rectification and erasure requests.Retire the legacy system or restrict it to read-only with a defined end date.CRITICALInform employees and data subjects where privacy notices change.Schedule a post go-live privacy review within the first quarter.

Count completed items per group. Any unchecked critical item is a blocker for cutover until it is closed or formally accepted by the data protection officer. This checklist supports your own compliance work and is not legal advice.

Personal data discovery in legacy ERP

Optional: discuss a private, on-prem scan of your legacy ERP and document stores to locate personal data.

Optional. The tool and every export work without this. No spam.

How to use the checklist

Assign each group to an owner: the project manager, the data protection officer, IT security and the vendor contact. Work through the items before the first full data load, not just before go-live. Critical items are those that, if skipped, usually create a reportable incident or a regulator finding. Export the finished list as PDF to attach to your project documentation and your record of processing activities.

Why migration is a privacy risk

Migrations create copies: extracts, staging databases, mapping spreadsheets and test systems. Each copy is a new place where personal data lives, often with weaker access control than production. Consultants may also need access from outside the company or the EEA. Under GDPR, you remain responsible as controller, so the contracts, the transfer assessment and the cleanup of temporary copies are as important as the field mapping itself.

Retention and minimisation

Do not migrate everything by default. Decide per object what the business and the law require. German and other national rules require accounting records to be kept for years, but marketing contacts without activity usually have no basis for retention. Deleting or archiving before the extract reduces the data you must protect and shortens the cutover.

Define retention per data object, not per system.
Archive instead of migrating closed history that is rarely used.
Mask personal fields in test environments.
Document exceptions with a reason and an owner.

Common mistakes

Frequent failures are production data copied into a test system, migration spreadsheets sent by email, test systems that still send real emails to customers, and legacy systems left online with no owner. Another is forgetting free text and attachments, which often hold personal data in unstructured form.

Frequently Asked Questions

Do we need a DPIA for an ERP migration?

Not always. It depends on the scale, the type of data and whether the new system introduces high-risk processing such as extensive employee monitoring. Your data protection officer should screen the project and document the decision either way.

Can consultants use production data in testing?

It is better to avoid it. Use anonymised or pseudonymised data in test systems. If real data is unavoidable, apply production level access control, a processing agreement and a deletion date, and keep outbound communication disabled.

What about backups of the old ERP?

Backups still contain personal data. Define how long they are kept, who may restore them and how erasure requests are handled for archived data. Document this in your retention policy so it can be explained to a regulator.

Does this checklist replace legal advice?

No. It supports project planning. National law, works council rules and sector requirements differ, so confirm the final approach with your data protection officer or legal counsel.

Netray can scan a read-only copy of your legacy ERP and documents on your own infrastructure to help locate personal data before you migrate, with no data leaving your environment.

Talk to an Expert Explore More Free Tools

Related Tools

ERP Migration & Selection

More Compliance & Contracts tools

See all

GDPR Checklist for ERP Data Migration and Implementation in Europe