GDPR documentation

The scope depends on the specific processes. It may include records of processing activities, privacy notices, processor agreements, internal policies, staff instructions and other documents depending on how data are processed.

A template can be a starting point, but the documentation must reflect what the company actually does. If it describes different processes, suppliers or purposes of processing, it may not be usable.

Whenever there is a significant change in processes, systems, suppliers, purposes of processing or other circumstances that change how personal data are handled.

If the website processes personal data or uses tools that require a legal and information set-up, these processes must be reflected in the documentation and in communication towards users.

First, the actual processes and data flows are mapped, then the required scope of documents is determined, the individual documents are drafted and aligned with the company's practice.