How to Prepare for GDPR

Here is a practical starting checklist for management companies and payroll providers preparing for GDPR — or maintaining ongoing compliance.

1. Map your personal data

Know what personal data you hold, where it lives (including inside MMV), how it flows in and out, and who has access. A data inventory is the foundation of every other step.

2. Establish a lawful basis

For each category of processing, identify the lawful basis under GDPR — most commonly contract, legal obligation, or legitimate interest. Consent should be used sparingly and only where genuinely free and specific.

3. Update your privacy notices

Data subjects must be told, at the point of collection, what data you're collecting, why, how long you'll keep it, and what their rights are. See our Privacy Notice template.

4. Sign the DPA with MMV

The Data Processing Addendum is signed by every paying Customer as part of their agreement with MMV. If you have questions, contact your MMV account manager.

5. Have a breach response plan

Know how you would respond within 72 hours if you learned of a personal-data breach — who leads, who is notified, and how.

6. Train staff

Everyone who handles personal data — captains, pursers, payroll staff — should have basic training in GDPR obligations and your organization's data-handling procedures.

7. Review annually

Data flows change. New systems get added. Review your GDPR posture at least once a year.