GDPR documentation – records of processing, policies and privacy notices
Documentation prepared for the specific organisation and its processes, so that it can be used to demonstrate GDPR compliance.
Documents we prepare
- Record of processing activities and record of categories of processing (Article 30 GDPR).
- Data protection policy and internal procedures.
- Privacy notices for clients, employees, candidates and business partners (Articles 13 and 14 GDPR).
- Authorisations to process data and confidentiality undertakings.
- Data protection impact assessment (DPIA) where processing is likely to result in a high risk (Article 35 GDPR).
- Procedures for data subject rights and personal data breaches.
Documentation that works
Documentation must reflect actual processes. Generic templates that ignore the organisation's systems, retention periods and recipients do not demonstrate compliance in an inspection.
Frequently asked questions
Who must keep a record of processing activities?
As a rule, every controller and processor. The exemption for organisations with fewer than 250 employees is narrow – it does not apply where processing is not occasional, is likely to result in a risk to individuals or covers special categories of data. In practice most companies keep the record.
Let us discuss your matter
The first conversation is used to define the scope of the matter and the fee.