make your free gdpr documents
what we'll cover
what are gdpr documents?
in the uk, the main data protection laws are the uk general data protection regulations (gdpr) and the data protection act 2018. all uk organisations (eg businesses and charities) need to take care when processing staff or customer personal data and must be aware of their data protection responsibilities and obligations. creating gdpr-compliant documents helps organisations to comply with their legal obligations.
these documents are gdpr compliant.
when should i use a gdpr document?
use these gdpr documents:
-
if you are a business (or other organisation) operating in the uk
-
if you process (eg store or handle) personal data (eg staff members’ or customers’ names and addresses)
-
to comply with your data protection obligations under the uk’s data protection laws
sample gdpr documents
the terms in your document will update based on the information you provide
about gdpr documents
learn more about making your gdpr document
-
how to make a gdpr document
making a gdpr document online is simple. just answer a few questions and 2022世界杯32强抽签时间 will build your document for you. when you have all of the details prepared in advance, making your document is a quick and easy process.
what information you need to make your gdpr document will depend on the document in question. however, the types of questions you may be asked include:
party details
-
what are your organisation’s details (eg its legal structure, name and address)?
-
who has overall responsibility for data protection compliance in your organisation? is it the data protection officer (dpo) or another person?
data protection
-
what types of personal data are being processed and why?
-
who are the data subjects (ie the people to which the data relates)?
data transfers
-
will personal data be transferred outside of the uk and the european economic area (eea)?
data retention
-
where is information on how data is stored securely set out (eg in a data retention policy)?
-
-
common terms in a gdpr document
gdpr documents are designed to help organisations comply with their data protection obligations under the law. while the terms of gdpr documents vary depending on the document in question, examples of provisions include:
data protection principles
this section sets out the data protection principles under the uk gdpr and how the organisation complies with them.
data retention
this section details for how long an organisation stores personal data before deleting it.
international transfers of personal data
this section discusses international data transfers (ie transfers of personal data to organisations based outside of the uk). it details when, if at all, such international transfers can be made.
rights of data subjects
this section sets out the rights that data subjects have in relation to their personal data. data subjects have various rights, which include the rights to:
-
make subject access requests (using a data subject access request (dsar))
-
have their personal data deleted after making a data erasure request
if you want your gdpr document to include further or more detailed provisions, you can edit your document. however, if you do this, you may want a lawyer to review or change the gdpr document for you to ensure it complies with all relevant laws and meets your specific needs. ask a lawyer for assistance.
-
-
legal tips for making a gdpr document
ensure that you have a legal basis for processing all personal data
under data protection law anyone who processes personal data must have a legal basis for doing so. data protection laws set out specific legal grounds that permit the processing of personal data. examples include the processing being in the public interest, the processing being necessary for compliance with a legal obligation (eg workplace health and safety obligations), or the data subject consenting to the processing.
before you process any personal data, you must make sure that you can rely on a legal basis for processing.
ensure your organisation is entirely gdpr-compliant
the laws on data protection are complex and, as an organisation, it is fundamental that you comply with all applicable aspects of data protection requirements. while making all necessary gdpr documents is an important step towards ensuring data protection compliance, you should consider seeking specialist advice on how to implement data protection practices for your situation. failure to comply with your data protection obligations can result in steep fines and further penalties. consider following our how to make a business gdpr-compliant checklist and making use of our gdpr compliance service.
understand when to seek advice from a lawyer
ask a lawyer for advice if:
-
you do not know which document(s) you need
-
these gdpr documents do not cover what you need
-
you require advice on data protection
-
gdpr documents faqs
-
what is included in a gdpr document?
these gdpr document templates cover a variety of different types of information, including:
-
the organisation’s details
-
the types of personal data covered
-
how personal data is processed
-
how transfers of data outside of the uk or european economic area (eea) are made
-
the rights of data subjects (ie private individuals) in relation to their personal data
-
-
which gdpr document do i need?
which gdpr-compliance documents you will need depends on your specific situation. however, generally speaking, you should use:
-
a privacy policy - if you run a website, to inform website visitors about how you protect their personal data
-
a data protection and security policy - to set out your detailed internal policies and procedures for processing staff and client personal data
-
an employee privacy notice - to inform staff about how you collect, use, retain and disclose personal information in an easily understandable way
-
a consultant privacy notice - to inform consultants about how you collect, store, retain and disclose their personal data
-
a data processing agreement (dpa) - to supplement a master services agreement by setting out the specifics of how personal data will be processed
-
a data protection impact assessment (dpia) - to identify and minimise the data protection risks of a project, where the processing of personal data is likely to result in a high risk to the rights and freedoms of individuals
-
an appropriate policy document (apd) - where required under a dpia to outline compliance measures and data retention policies used when processing special category or criminal offence personal data
-
a legitimate interest assessment (lia) - to identify whether you can process personal data on the ground of legitimate interest
-
a data retention policy - to tell staff how long they should store personal data for and what they should do once it’s no longer needed
for more information, read data protection for businesses.
-
-
what are personal data and data processing?
data processing is any use of personal data other than for personal reasons, like gathering and storing staff or customer personal data for use in your organisation.
personal data is any data about individuals who can personally be identified from that data. examples include names, addresses and birthdates.
there is also a further 'special category' of 'sensitive personal data', which is awarded greater protection. examples include information about sexual life, genetics, and physical or mental health.
criminal offence data (ie personal data relating to criminal convictions, criminal offences, and related security measures) is treated separately from personal data and special category personal data. it is also subject to stringent controls.
-
what are my data protection obligations?
uk businesses that process personal data need to protect that information.
in order to meet their data protection obligations, organisations must comply with the data protection principles. this means that personal data must be:
-
processed in a fair, lawful and transparent manner (eg justified by a lawful basis such as consent, performance of a contract, or legitimate interest)
-
collected only for specified, explicit and legitimate purposes
-
adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed
-
accurate and kept up to date
-
kept in a form that enables identification of the person to whom it belongs (known as the ‘data subject’) for no longer than necessary
-
processed in a way that ensures it is appropriately secure
-
not transferred outside the uk without adequate protection
failure to comply with your data protection obligations can result in a fine of up to 4% of an organisation’s total global annual turnover or of £17.5 million, whichever is higher.
for more information, read complying with the gdrr and follow our how to make a business gdpr-compliant checklist. if you require an evaluation of your data protection practices, consider making use of our data protection health check.
-
our quality guarantee
we guarantee our service is safe and secure, and that properly signed 2022世界杯32强抽签时间 documents are legally enforceable under uk laws.
need help? no problem!
ask a question for free or get affordable legal advice from our lawyer.