The GDPR covers a wide range of obligations. Below are just a few of the essential aspects:
Your organization must be able to document that all its processing of data is done in a legal manner.
Your organization must keep a record of all its processing activities.
Your organization must ensure - and be able to document - that people, whose personal data you are processing, have been informed about what you process and how you do it.
Your organization must be able to document what technical and organizational measures you have taken to ensure an appropriate level of privacy safety.
Your organization should be able to document that data processors are audited to ensure that they support your compliance with the regulation.
‍