GDPR Compliance Prompt Templates

DATA PROCESSING AGREEMENT

This Data Processing Agreement ('DPA') forms part of the Service Agreement between:

Data Controller: [Company Name], [German Address] ('Controller')
Data Processor: [Platform Name], [Address] ('Processor')

1. DEFINITIONS
'Personal Data', 'Processing', 'Data Subject', and other terms have the meanings given in the GDPR.

2. SCOPE AND PURPOSE
2.1 Controller engages Processor to process Personal Data for the purpose of providing email marketing services.
2.2 Processor shall process Personal Data only on Controller's documented instructions.

3. DATA PROCESSING DETAILS
- Data Subjects: Controller's customers who have opted into marketing communications
- Categories of Personal Data: Name, email address, purchase history, email engagement metrics
- Processing Operations: Storage, email transmission, segmentation analysis, reporting
- Duration: For the term of the Service Agreement plus data retention period

4. PROCESSOR OBLIGATIONS (Article 28)
4.1 Process Personal Data only on documented instructions from Controller
4.2 Ensure persons authorized to process have committed to confidentiality
4.3 Implement appropriate technical and organizational security measures
4.4 Assist Controller with data subject requests and GDPR compliance...

5. SUB-PROCESSORS
5.1 Controller authorizes the use of sub-processors listed in Annex B
5.2 Processor shall notify Controller of any intended changes...

MARKETING CONSENT

We'd like to send you updates about [Company Name] products, services, and events.

[ ] Yes, I want to receive marketing emails from [Company Name]

What we'll send:
- Product updates and new feature announcements
- Industry insights and best practices
- Event invitations and webinar announcements
- Occasional promotional offers

We'll use your name, email, company, and job title to personalize communications. Our marketing platform [Platform Name] processes this data on our behalf.

You can unsubscribe anytime using the link at the bottom of our emails, or through your account settings. Unsubscribing won't affect your access to our product.

This consent is optional. You can use [Product Name] without subscribing to marketing.

---

NOTES FOR IMPLEMENTATION:
- Checkbox must be unchecked by default
- This consent should be separate from terms acceptance
- Link to full privacy policy
- Record timestamp and IP address when consent is given
- Store consent records for audit purposes

RESPONSE TO DATA ACCESS REQUEST

[Date]

Dear [Customer Name],

Thank you for your request dated [Date] for access to your personal data under Article 15 of the General Data Protection Regulation (GDPR).

We have compiled all personal data we hold about you. Please find attached:

1. Account Information
- Name, email address, shipping addresses
- Account creation date and preferences

2. Order History
- Complete list of orders placed (dates, items, amounts)
- Shipping and billing information used

3. Customer Support Records
- Copies of support tickets and correspondence

4. Marketing Preferences
- Your current consent status and history
- Email engagement data

5. Website Activity
- Analytics data associated with your account
- Cookie consent preferences

The attached file is password-protected for security. The password has been sent to your verified email address in a separate message.

Additional Information:
- Purpose of processing: Order fulfillment, customer support, marketing (with consent)
- Categories of recipients: Payment processor, shipping carriers, marketing platform
- Retention period: Account data kept while account is active; order records kept for 7 years for tax purposes
- Your rights: You may request rectification, erasure, or portability of this data

If you have questions or would like to exercise additional rights, please contact [privacy email]...

RECORD OF PROCESSING ACTIVITIES - Article 30(1)

Processing Activity ID: HR-001
Last Updated: [Date]

1. CONTROLLER INFORMATION
Name: [Company Name]
Address: [Address]
DPO Contact: [DPO Name], [dpo@company.com]

2. PROCESSING ACTIVITY
Name: Employee Payroll Processing
Department: Human Resources

3. PURPOSE OF PROCESSING
- Calculate and distribute employee compensation
- Withhold and report taxes to relevant authorities
- Administer employee benefits
- Maintain employment records as required by law

Legal Basis: Contract (employment agreement), Legal obligation (tax reporting)

4. CATEGORIES OF DATA SUBJECTS
- Current employees
- Former employees (during retention period)

5. CATEGORIES OF PERSONAL DATA
- Identification: Name, address, date of birth, national ID/tax number
- Financial: Bank account details, salary information
- Employment: Job title, department, start date, work hours
- Benefits: Health insurance elections, retirement contributions

6. CATEGORIES OF RECIPIENTS
| Recipient | Purpose | Safeguards |
|-----------|---------|------------|
| [Payroll Provider] | Payroll processing | DPA, SCCs |
| Tax Authorities | Legal reporting | Legal obligation |
| Benefits Providers | Benefits administration | DPA |

7. INTERNATIONAL TRANSFERS
Payroll provider processes data in the United States. Transfer mechanism: Standard Contractual Clauses (2021).

8. RETENTION PERIODS
- Active employee records: Duration of employment
- Post-termination: 7 years (statutory requirement)
- Unsuccessful applicants: 6 months

9. SECURITY MEASURES
- Data encrypted at rest and in transit
- Access restricted to HR personnel on need-to-know basis
- Audit logging enabled for all access
- Annual security review of payroll systems