EU Regulation 2016/679 (GDPR) + CCPA/CPRA: any US organization processing personal data of EU residents OR California residents is subject to documented compliance obligations.

Documentation kit · GDPR, Regulation (EU) 2016/679

Your GDPR documentation, without starting from scratch.

Word and Excel templates to build your compliance dossier and present it in a regulator inquiry or a customer audit.

Records, legal bases, data subject rights, DPIAs, breaches
Processors, transfers outside the EEA, HR processing
118 editable files and an article-by-article mapping
US state privacy laws: interplay procedure and GDPR mapping matrix included

Buy the kit · $389

License per legal entityInstant download30-day money-back guarantee

118

Documents included

GDPR domains covered

Art. 5 to 89

Articles mapped

€20M

or 4% of global turnover: GDPR fine cap (Art. 83)

Who this kit is for

Designed for any organization that processes personal data.

Controllers and processors alike: a GDPR documentation base ready to adapt.

DPOs and privacy officers

Build, maintain and produce the GDPR dossier, in-house or outsourced.

DPOChief Privacy OfficerIn-house counsel

SMB and mid-market executives

Demonstrate compliance to customers, partners and supervisory authorities (Art. 24).

ControllerAccountability

CISOs and IT directors

Align security measures (Art. 32) with DPIAs, breach response and ISO 27001 controls.

Art. 32BreachesDPIA

Consultants and law firms

A documentation base to start client privacy engagements without a blank page.

Client engagementsFirm license on request

What is in the kit

118 documents organized by GDPR chapter.

The kit covers the 15 GDPR compliance domains and a US state privacy law layer. Each document is mapped to one or more articles of the Regulation.

Master document list · GDPR, Regulation (EU) 2016/679

Version 2.0, May 2026

118 documents · 92 Word · 26 Excel

Chapter II · Principles (Art. 5 to 11)

10 documents · Legal bases, consent and withdrawal, children, sensitive, biometric and criminal data, retention periods.

W
Legal Basis Qualification (Art. 6, 6 bases)
W
Consent Collection (Art. 7)
W
Consent Withdrawal (Art. 7.3)
W
Children's Data and Parental Consent (COPPA under 13, CCPA 13-16, GDPR Art. 8)
W
Sensitive Data Procedure (Art. 9, 10 Exceptions)
W
Criminal-Record Data Procedure (Art. 10)
W
Biometric Data Management Procedure (Art. 9, BIPA and state law)
W
Consent Form Template
X
Retention Periods Matrix
W
Note on Processing Not Requiring Identification (art. 11)

Chapter III · Rights of the data subject (Art. 12 to 22)

22 documents · Privacy notices, cookies, rights handling, response templates, identity checks, automated decisions.

W
Global Data Subject Rights Procedure (Art. 12, 1-Month + 2-Month Deadline)
W
Identity Verification (Art. 12.6) and Recipient Notification (Art. 19)
W
Automated Decision-Making and Profiling (Art. 22)
W
Human Intervention and Contestation
W
Cookie Management and Consent Banner Procedure (CMP)
W
Privacy Notice, Direct Collection (Art. 13)
W
Privacy Notice, Indirect Collection (Art. 14)
W
HR Privacy Notice, Applicants and Employees
W
Standardized Icons Template (Art. 12.7)
W
Right of Access Response Template (Art. 15)
W
Right to Rectification Response Template (Art. 16)
W
Right to Erasure Response Template (Art. 17)
W
Right to Restriction of Processing Response Template (Art. 18)
W
Right to Data Portability Response Template (Art. 20)
W
Right to Object Response Template (Art. 21)
W
Specific Information Notice to Data Subject (Art. 13.2.f, 14.2.g, 15.1.h)
W
Internal GDPR complaint template
W
Rights request response template, minor or legal representative
X
Matrix of Processing with Significant Legal Effect
X
Data Subject Rights Requests Register
W
Website Privacy Policy
W
Cookies and Trackers Policy

Chapter IV · General obligations (Art. 24 to 31)

27 documents · Records of processing, processors and joint controllers, privacy by design, archiving, manual, authority cooperation.

W
Records of Processing Activities Creation and Update
W
Data Processor Selection and Audit Procedure
W
Sub-Processing Procedure (Art. 28.2 and 28.4)
W
Annual Data Processor Audit Procedure
W
Privacy by Design and by Default Procedure (Art. 25)
W
Intermediate and Permanent Archiving Procedure
W
Purge and Anonymization Procedure
W
GDPR Document Control Procedure
W
GDPR Internal Audit Procedure (15 domains)
W
Procedure for Cooperation with the Supervisory Authority (Art. 31)
W
Procedure for Managing a Supervisory-Authority Investigation (on-site, documentary, online)
W
Continuous Update Procedure for GDPR Documentation (event-driven review)
W
Standard Processing Activity Record
W
Standard contractual clauses Art. 28, 10 obligations (DPA)
W
Joint controller agreement (Art. 26)
X
Processing Mapping by Purpose
X
GDPR Processor Assessment Grid
X
Privacy by Design Project Checklist
X
Global GDPR Compliance RACI Matrix
X
GDPR Training and Awareness Plan
X
Initial Compliance Roadmap
X
Controller Records of Processing Activities
X
Processor Records of Processing Activities
X
Data Processors Register
W
Note on the Under-250-Employees Derogation (art. 30.5)
W
GDPR Compliance Manual
W
Privacy by Design and by Default Policy (Art. 25)

Chapter IV · Security and breaches (Art. 32 to 34)

15 documents · Security and access policies, encryption, backups, measure testing, breach register, 72-hour notification.

W
Encryption and Pseudonymization (Art. 32.1.a)
W
Backup and Resilience Procedure (Art. 32.1.c)
W
Regular TOM Testing Procedure (Art. 32.1.d)
W
Personal Data Breach Management Procedure (Art. 33, 34)
W
Quarterly Access-Rights Review Procedure
W
Cyber Crisis Management Procedure (crisis unit, management, DPO, CISO, legal, communications)
W
72-Hour Breach Notification to Supervisory Authority (Art. 33.3)
W
Communication to Affected Individuals (Art. 34.2)
X
Risk to Rights Assessment Grid
X
Technical and Organizational Measures Matrix
X
Internal Personal Data Breach Register
W
Employee Acceptable Use Policy
W
Information Security Policy (ISP)
W
Access Management Policy
W
Logging and Audit-Trail Policy (logs 6-12 months)

Chapter IV · Impact assessment (Art. 35 and 36)

7 documents · DPIA procedure and template, trigger matrix, risk grid, prior consultation, review, DPIA register.

W
DPIA (Art. 35, 4 Mandatory Elements Section 7)
W
Prior Consultation with the Supervisory Authority (Art. 36)
W
DPIA Review (Art. 35.11)
W
Full DPIA Template (generic DPIA-NIST method)
X
Risk Assessment Grid
X
DPIA Trigger Matrix
X
Central Register of DPIAs and Reviews

Chapter IV · Governance and data protection officer (Art. 37 to 39)

8 documents · General policy, engagement letter, job description, independence, annual report, GDPR committee.

W
DPO Designation and Supervisory-Authority Notification (Art. 37.7)
W
DPO Job Description
W
DPO Annual Activity Report Template
W
GDPR committee meeting minutes template DPO-management
W
DPO Engagement Letter (art. 37)
W
DPO Independence Charter (art. 38.3)
W
Written Analysis of Absence of DPO Conflict of Interest (art. 38.6)
W
General Data Protection Policy

Chapter V · Transfers to third countries (Art. 44 to 49)

7 documents · Transfer qualification, 2021 SCCs, TIA, BCRs, foreign authority requests, EU representative.

W
International Data Transfer Qualification Procedure (Art. 44-49)
W
TIA (Transfer Impact Assessment) Procedure post-Schrems II
W
Foreign Authority Requests (Art. 48) and EU Representative (Art. 27) Procedure
W
Standard Contractual Clauses (SCCs) 2021, modules 1 to 4 (Art. 46.2.c)
X
International Data Transfer Mapping
X
International Data Transfers Register
W
BCR Policy (Art. 47, 14 elements) for International Groups

Chapter IX · Specific processing situations (Art. 88 and 89)

11 documents · HR processing, workplace monitoring, remote work, archiving, research, statistics.

W
HR Data Processing Procedure (Art. 88)
W
Workplace Monitoring Procedure
W
Remote Work and Collaboration Tools Procedure
W
Intra-Group Employee Data Transfer Procedure
W
Procedure for Processing for Archiving Purposes (Art. 89.1)
W
Procedure for Processing for Scientific Research Purposes
W
Procedure for Processing for Statistical Purposes
W
Pseudonymization for Compatible Purposes Procedure
X
Article 89.2 and 89.3 Derogations Matrix
X
Dedicated HR Register
W
Note on Collective Bargaining Agreements

US state privacy laws and sector rules

7 documents · GDPR and US state law interplay, SSNs, HIPAA and FCRA, CAN-SPAM and TCPA, video surveillance, AI, CISA-CIRCIA.

W
GDPR and US State Privacy Law Interplay Procedure
W
Procedure for Specific Formalities (SSN Handling under US Federal and State Law)
W
Procedure for Health Data and Criminal-Record Data Processing (HIPAA, FCRA)
W
Procedure for B2B and B2C Marketing (CAN-SPAM, TCPA, TSR)
W
Video Surveillance Procedure (state law and CCPA notice)
W
GDPR and AI Act Interplay Procedure (NIST AI RMF and FTC)
W
GDPR and CISA-CIRCIA Incident-Reporting Interplay Procedure

Audit and control

4 documents · GDPR audit grid, maturity self-assessment, compliance dashboard, GDPR and US state law mapping matrix.

X
GDPR Maturity Self-Assessment Grid
X
GDPR and US State Privacy Law Mapping Matrix
X
GDPR Compliance Dashboard
X
GDPR Audit Grid

Full master document list, implementation checklist and one complete procedure in the free sample.

Why this kit exists

GDPR cannot be drafted from a blank page.

99 articles, around 30 of which directly require documents, registers or written procedures.

Art. 28, 33, 35

Free templates are not enough

A simplified register or a standalone notice: nothing on DPIAs, breaches, processors, transfers or rights handling.

Art. 83

Fines can be heavy

Up to €20M or 4% of global annual turnover, whichever is higher. US state laws add their own penalties.

Vendor onboarding

Enterprise customers require a privacy dossier

Large buyers, federal contracts and healthcare partners ask for a dossier, a signed DPA (Art. 28), sometimes a DPIA.

$8,000 to $20,000

A consulting engagement is costly

10 to 30 days of a privacy firm or outsourced DPO. The kit provides that base, your budget goes to implementation and DPIAs.

Clause-by-clause mapping

Every GDPR requirement → one document in the kit.

Chapter by chapter, the articles of the Regulation and the documents provided. This is what a supervisory authority or an enterprise customer asks to see first.

Art. 5

Principles relating to processing: lawfulness, purpose, minimization, accuracy, storage limitation, security, accountability

General privacy policyCompliance manualRetention matrixMinimization procedure

Art. 6

Lawfulness of processing, 6 legal bases (consent, contract, legal obligation, vital interest, public interest, legitimate interest) + compatibility test (Art. 6.4)

Legal basis qualification procedureLegitimate interest balancing test (LIA)Compatibility test for further purposes

Art. 7

Conditions applicable to consent: proof, distinguishability, withdrawal as easy as collection

Consent procedureConsent formWithdrawal procedure

Art. 8

Children's consent for information society services (16 EU default; lower in some Member States)

Children consent procedure (GDPR Art. 8 + COPPA US alignment)Parental verification mechanism

Art. 9

Special categories (origin, opinions, health, biometric, genetic, sexual orientation), 10 derogations

Sensitive data procedureArt. 9.2 derogations matrixCCPA Sensitive PI handling procedure

Art. 10

Personal data relating to criminal convictions and offenses

Criminal data procedureAuthorization matrix under public authority

Art. 11

Processing not requiring identification, partial exemption from Art. 15-20

Note on processing without identification

Art. 12 to 14

Transparent information of data subjects, direct collection (Art. 13) and indirect (Art. 14) + rights exercise modalities (Art. 12, 1 month + 2 month extension)

Direct collection notice (Art. 13)Indirect collection notice (Art. 14)Privacy policyCookie policy + CCPA opt-outHR noticesStandardized icons template

Art. 15 to 21

Data subject rights: access (15), rectification (16), erasure / right to be forgotten (17), restriction (18), portability (20), objection (21)

Global rights handling procedureAccess response template (CCPA right to know aligned)Rectification response template (CCPA right to correct)Erasure response template (CCPA right to delete)Restriction response templatePortability response template (CCPA aligned)Objection response template (CCPA right to opt-out)Identity verification (Art. 12.6 / CCPA verifiable consumer request)Rights request register

Art. 19

Notification obligation to recipients of any rectification, erasure, or restriction

Recipient notification procedureRecipient register per processing

Art. 22

Automated individual decision-making and profiling producing legal effects or significantly affecting the person

Automated decision & profiling procedureMatrix of processing with legal effectHuman intervention & contestation procedureCPRA automated decision-making opt-out

Art. 24 to 25

Controller responsibility, Privacy by Design & by Default

Compliance manualPrivacy by Design procedurePbD project checklist

Art. 26

Joint controllership between controllers, written agreement defining respective obligations

Joint controllership agreementJoint controller qualification procedure

Art. 27

Designation of an EU representative by controllers or processors not established in the EU but targeting EU residents (Art. 3.2)

EU representative designation procedureStandard written mandate

Art. 28

Processor obligations and written processing contract, 10 mandatory clauses (§3 a to h)

Standard contractual clauses Art. 28 (DPA)Processor selection procedureEvaluation gridProcessor registerSub-processor procedure (Art. 28.2, 28.4)Annual audit procedureCCPA Service Provider Agreement template

Art. 30

Records of processing activities (controller 30.1 + processor 30.2), < 250 employees derogation under conditions

Controller RoPA (Art. 30.1)Processor RoPA (Art. 30.2)Standard processing record templateUpdate procedureNote on < 250 employees derogation

Art. 31

Cooperation with the supervisory authority, obligation to make registers available and assist the authority

Supervisory authority cooperation procedureInquiry response procedure (EU DPA, CPPA, state AG)

Art. 32

Security of processing: pseudonymization, encryption, confidentiality, integrity, availability, resilience + regular testing of TOMs

Information Security PolicyAccess management policyEncryption & pseudonymizationBackup & resilienceRegular TOM testing procedureTOM matrix (SOC 2 / ISO 27001 aligned)Acceptable use policy

Art. 33 to 34

Notification to supervisory authority within 72h (Art. 33) and communication to data subjects in case of high risk (Art. 34)

Breach management procedureInternal breach register (Art. 33.5)Supervisory authority notification 72hCommunication to data subjectsRisk assessment gridUS state-by-state breach notification matrix

Art. 35 to 36

Data Protection Impact Assessment (DPIA) mandatory in 3 cases (Art. 35.3) + prior consultation if high residual risk (Art. 36)

DPIA procedure (4 elements Art. 35.7)Triggering matrixComplete DPIA templateRisk assessment gridDPIA review procedure (Art. 35.11)Prior consultation procedureCPRA Risk Assessment template

Art. 37 to 39

DPO designation, function, and missions, 3 mandatory cases (Art. 37.1), independence (Art. 38.3), 5 minimum missions (Art. 39)

DPO/CPO appointment letterDesignation procedureJob description (5 missions Art. 39)Independence charter (Art. 38.3)Annual report

Art. 44 to 49

Transfers to third countries: adequacy decision (45), appropriate safeguards (46), derogations (49)

Transfer qualification procedureTransfers mappingStandard Contractual Clauses 2021 (Art. 46.2.c)TIA procedure post-Schrems IIEU-US Data Privacy Framework checklistDerogations procedure (Art. 49)Transfers register

Art. 47

Binding Corporate Rules (BCRs) for groups, 14 mandatory elements (§2 a to n)

BCR policyBCR approval procedure with lead authority

Art. 48

Transfers or disclosures not authorized by Union law, framework for foreign court/authority requests (CLOUD Act, FISA 702 type)

Foreign authority requests procedureApplicable international agreement assessment grid

Art. 88

Processing of data in employment relations, specific national provisions (collective agreements, works councils)

HR processing procedureHR register (candidates, employees, former employees)Workplace surveillance procedureRemote work procedureCCPA HR notice for California employees

Art. 89

Safeguards and derogations for processing for archiving in the public interest, scientific or historical research, or statistics

Archiving purposes procedureScientific research procedureStatistical purposes procedureDerogations matrix Art. 89.2 and 89.3HIPAA de-identification methodology (if PHI)

US state laws + sectoral

US compliance layer: CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), TX/OR/MT/FL/IA/IN/TN privacy acts, HIPAA (PHI), GLBA (financial), FERPA (education), COPPA (children)

CCPA/CPRA compliance procedureMulti-state US privacy matrixHIPAA / HITECH procedureGLBA compliance procedureMapping matrix GDPR ↔ CCPA ↔ US state laws

Not included

Deliverables specific to each processing and each organization, which must be produced case by case by your DPO/CPO, CISO, or compliance team

Filled-in RoPA (your processing activities)Complete DPIAs (per high-risk processing)Signed DPAs (per processor)Filled-in TIAs (per transfer)Authority-approved BCRs (dedicated procedure)Actual breach notificationsTechnical security audits (pentest, ISO 27001 certification)Customized team training

XThe kit also contains an Excel mapping matrix (GDPR and US state privacy law mapping), to complete with your own documents.

Technical compliance

The points an experienced GDPR auditor checks.

Twelve points DPOs, regulators and privacy auditors check first. The kit addresses them one by one.

Legal basis per processing

Documented processing by processing, balancing test for legitimate interest.

Art. 6

Children's consent

Documented parental verification. In the US, COPPA verifiable parental consent under 13.

Art. 8

Retention periods

Set per purpose: active database, intermediate archive, final archive.

Art. 5.1.e

Enforceable records of processing

One entry per processing activity, 7 fields for controllers, 4 for processors, dated updates.

Art. 30

DPIA: 3 mandatory cases

Profiling with legal effect, large-scale sensitive data, systematic monitoring of a public area.

Art. 35.3

Breach notification within 72 hours

Clock starts at awareness, formal evaluation before the notification decision.

Art. 33

Automated decisions and profiling

Documented human intervention, right to contest the decision.

Art. 22

Processor contracts

Art. 28.3 clauses: instructions, confidentiality, security, sub-processing, assistance, deletion, audit.

Art. 28

Transfers after Schrems II

Transfer impact assessment, supplementary measures, EU-US Data Privacy Framework.

Art. 44 to 49

Foreign authority requests

Disclosure only under an international agreement in force, otherwise documented refusal.

Art. 48

EU representative

Required for controllers and processors outside the EU that target EU residents, except derogations.

Art. 27

DPO independence

Reports to the highest level, sufficient resources, documented absence of conflict of interest.

Art. 38

Art. 3

GDPR: extraterritorial reach

GDPR applies beyond the European Union as soon as an organization targets EU residents or monitors their behavior (Art. 3.2).

European Union (27)United Kingdom (UK GDPR)Switzerland (revFADP)California (CCPA/CPRA)Virginia (VCDPA)Colorado (CPA)Brazil (LGPD)Canada (PIPEDA)Japan (APPI)South Korea (PIPA)

Privacy flash audit

Where do you stand today?

Answer the 15 article-by-article questions to get your GDPR + CCPA/CPRA maturity score. Instant result, free, no personal information required.

Question 1 / 15

Domain 1: Governance & DPO/CPO

/ 100

Buy the GDPR Package · $389

Deployment process

From order to compliance dossier, here is the route.

Day 1

Download

Full ZIP: 118 Word and Excel documents.

Weeks 1 to 4

Customization

Logo, org chart, processing inventory, processors, transfers, applicable laws.

Weeks 5 to 10

Implementation

Records filled in, DPIAs, processor contracts, breach drill, notices updated, teams trained.

Weeks 10 to 12

Internal audit

Privacy audit with the kit's grid, action plan, readiness for customer audits and inquiries.

Typical timeline: 10 to 12 weeks to a dossier ready for a customer audit or a regulator inquiry, depending on your internal resources.

Need a hand? Our consultants can tailor the kit to your site and support the rollout, on quote.

Request a quote

Risk-free

30-day guarantee, no questions asked.

You test the package. If you change your mind, we refund you.

You have 30 days to download the package, review its content, open the documents, and verify that the writing quality matches your expectations. If something is off, you write us an email, no justification needed, and the refund is processed within 5 business days. That simple.

Frequently asked questions

Answers to your most common questions.

Is the kit enough for a customer audit or a regulator inquiry?

No. It provides the documentation base. You still fill the records with your processing, sign the DPAs, run the DPIAs and keep your accountability evidence.

Are the documents editable?

Yes. 92 Word files and 26 Excel files, no locked PDFs. Neutral layout, ready for your logo and references.

Does the kit cover US privacy laws?

As a layer on top of GDPR: interplay procedure, GDPR and US state law mapping matrix, procedures on HIPAA, FCRA, CAN-SPAM, TCPA and biometric data. It does not replace a state-by-state legal analysis.

Does the license cover several entities?

It covers one legal entity, with unlimited internal use. Groups, subsidiaries or consulting firms: contact us for a suitable license.

When will I receive the files?

As soon as payment is confirmed: a link on the confirmation page and by email. Full ZIP, folders by document type.

What if the kit does not suit me?

You have 30 days to review it. Write to support@qse-academy.com explaining what does not meet your needs: the refund is issued to your original payment method, 4 to 5 business days after processing.

Take the next step

Your GDPR compliance dossier. Ready today.

118 Word and Excel documents, instant download after payment.

Buy the kit · $389

30-day money-back guaranteeInstant download12 months of updates

Your GDPR documentation, without starting from scratch.

DPOs and privacy officers

SMB and mid-market executives

CISOs and IT directors

Consultants and law firms

Master document list · GDPR, Regulation (EU) 2016/679

Chapter II · Principles (Art. 5 to 11)

Chapter III · Rights of the data subject (Art. 12 to 22)

Chapter IV · General obligations (Art. 24 to 31)

Chapter IV · Security and breaches (Art. 32 to 34)

Chapter IV · Impact assessment (Art. 35 and 36)

Chapter IV · Governance and data protection officer (Art. 37 to 39)

Chapter V · Transfers to third countries (Art. 44 to 49)

Chapter IX · Specific processing situations (Art. 88 and 89)

US state privacy laws and sector rules

Audit and control

Free templates are not enough

Fines can be heavy

Enterprise customers require a privacy dossier

A consulting engagement is costly

Legal basis per processing

Children's consent

Retention periods

Enforceable records of processing

DPIA: 3 mandatory cases

Breach notification within 72 hours

Automated decisions and profiling

Processor contracts

Transfers after Schrems II

Foreign authority requests

EU representative

DPO independence

GDPR: extraterritorial reach

Explore

Resources

Information

Contact

Your GDPR documentation, without starting from scratch.

Designed for any organization that processes personal data.

DPOs and privacy officers

SMB and mid-market executives

CISOs and IT directors

Consultants and law firms

What is in the kit

Master document list · GDPR, Regulation (EU) 2016/679

Chapter II · Principles (Art. 5 to 11)

Chapter III · Rights of the data subject (Art. 12 to 22)

Chapter IV · General obligations (Art. 24 to 31)

Chapter IV · Security and breaches (Art. 32 to 34)

Chapter IV · Impact assessment (Art. 35 and 36)

Chapter IV · Governance and data protection officer (Art. 37 to 39)

Chapter V · Transfers to third countries (Art. 44 to 49)

Chapter IX · Specific processing situations (Art. 88 and 89)

US state privacy laws and sector rules

Audit and control

GDPR cannot be drafted from a blank page.

Free templates are not enough

Fines can be heavy

Enterprise customers require a privacy dossier

A consulting engagement is costly

Clause-by-clause mapping

Technical compliance

Legal basis per processing

Children's consent

Retention periods

Enforceable records of processing

DPIA: 3 mandatory cases

Breach notification within 72 hours

Automated decisions and profiling

Processor contracts

Transfers after Schrems II

Foreign authority requests

EU representative

DPO independence

GDPR: extraterritorial reach

Where do you stand today?

From order to compliance dossier, here is the route.

Download

Customization

Implementation

Internal audit

What organizations using the kit say.

30-day guarantee, no questions asked.

You test the package. If you change your mind, we refund you.

Answers to your most common questions.

Your GDPR compliance dossier. Ready today.

Explore

Resources

Information

Contact