Notices and policies

Most privacy duties end up as a document someone can ask to see: the privacy policy, a notice where data is collected, a retention schedule, the contract with each processor, the record of what you hold and why. A regulator’s first request is usually for these papers.

The templates here print as finished documents, and the checklists test a policy you already have against the items GDPR Art. 13 and the CCPA regulations list. Start with the data map: every other document draws on it.