GDPR compliance checklist

General Data Protection Regulation (EU) sets out what you must tell people about the personal data you handle. This page lists the disclosure requirements the generator checks, and which document covers each one.

Disclosure requirements

Each requirement maps to a clause the generator can produce for you.

• Who is responsible for your dataCovered by: Privacy Policy
• Why we process your dataCovered by: Privacy Policy
• Our legal basis for processingCovered by: Privacy Policy
• Personal data we collectCovered by: Privacy Policy
• Who we share your data withCovered by: Privacy Policy
• International transfersCovered by: Privacy Policy
• How long we keep your dataCovered by: Privacy Policy
• Additional rights under the GDPR and similar lawsCovered by: Privacy Policy
• Withdrawing consentCovered by: Privacy Policy
• Complaining to a supervisory authorityCovered by: Privacy Policy
• Children's privacyCovered by: Privacy Policy
• Automated decision-makingCovered by: Privacy Policy
• Data Protection OfficerCovered by: Privacy Policy
• How we protect your dataCovered by: Privacy Policy
• Your consentCovered by: Cookie Policy

Documents you will need

What a document cannot do for you

These obligations need action, not wording.

• Keep a record of processing activities (Article 30). A short spreadsheet listing each processing purpose, the data involved and who it is shared with is usually enough for a small company.
• Sign a data processing agreement with every processor you named. Most large providers publish a standard DPA you can accept online.
• Be ready to report a personal data breach to your supervisory authority within 72 hours. Decide now who makes that call.