GDPR template · GDPR articles
Data Protection Policy
Comprehensive GDPR data protection policy. Written for your company, citing the controls below.
- Sections
- 6
- Controls cited
- 7
- Formats
- PDF, Word
- Shelf
- 10 GDPRdocuments in all
No card needed to start.
- Cites
- Art. 5, Art. 6, Art. 25 and 4 more
- Formats
- PDF and Word
Sections
Each written around your company: your tools, your roles, your review dates.
- Purpose and Scope
- Data Protection Principles
- Lawful Bases
- Data Subject Rights
- International Transfers
- Breach Notification
Controls it cites
The GDPR controls first, then the matching controls in other frameworks.
- Art. 5Principles of ProcessingGDPR
- Art. 6Lawfulness of ProcessingGDPR
- Art. 25Data Protection by Design and DefaultGDPR
- Art. 32Security of ProcessingGDPR
- Art. 44International TransfersGDPR
- SOC 2 P4.1Privacy: CollectionSOC 2
- ISO A.5.34Privacy and Protection of PIIISO 27001
Recent changes
Updates from official sources that name this policy. All policy updates
16 Oct 2026 · European Data Protection Board
Norwegian DPA fines Xandr EUR 8.6 million for unlawful processing of personal dataUpdate the data protection policy to clarify that the company must have a legal basis under Article 6(1) GDPR for processing personal data in real-time bidding contexts.
13 Oct 2026 · European Data Protection Board
EDPB issues statement on smart glasses and GDPR complianceUpdate the data protection policy to include guidance on identifying controllers for smart glasses processing, legal basis selection, and data protection by design and by default measures.
9 Oct 2026 · European Data Protection Board
Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of health dataReview the Data Protection Policy to ensure it requires a legal basis for processing health data and provides adequate information to data subjects.
- GDPR5 sections
Privacy Notice
CitesArt. 12 Art. 13 Art. 15 +3 +4PDF · WordCites Art. 12, Transparent Communication (GDPR); Art. 13, Information at Collection (GDPR); Art. 15, Right of Access (GDPR), and 3 more. - GDPR5 sections
DSAR Procedure
CitesArt. 15 Art. 17 Art. 20 +4 +5PDF · WordCites Art. 15, Right of Access (GDPR); Art. 17, Right to Erasure (GDPR); Art. 20, Right to Data Portability (GDPR), and 4 more. - GDPR5 sections
Records of Processing Activities
CitesArt. 30PDF · WordCites GDPR Article 30, named in the template description. - GDPR6 sections
Data Protection Impact Assessment
CitesArt. 35PDF · WordCites GDPR Article 35, named in the template description. - GDPR5 sections
International Data Transfer Policy
CitesArt. 44–49PDF · WordCites GDPR Article 44–49, named in the template description. - GDPR5 sections
Data Retention and Erasure Policy
CitesArt. 5(1)(e) Art. 17PDF · WordCites GDPR Article 5(1)(e), named in the template description; GDPR Article 17, named in the template description.
GDPR on its own
- Documents
- 10
- Plan
- Growth
- Price
- $199 a month or $1,990 a year
Growth also covers HIPAA, so GDPR + HIPAA stays at $199 a month. Two frameworks besides HIPAA need Scale.
Your first policy is free. No card needed to start.