GDPR · Regulation (EU) 2016/679

GDPR Compliance Kit for small businesses.

The GDPR expects you to keep records and to prove compliance. This kit gives you the registers, deadlines and checklist to do it, without hiring a consultant.

Notion template Word · Excel · PDF

Price: €29.99
Formats: Notion template or Word, Excel & PDF
Languages: EN, DE, NL, ES, HR — country editions adapted to national law
Access: Instantly after purchase, one-time payment

GDPR

What's in the kit

Guide — what applies in your country, how to set everything up and what to check every week
Step-by-step compliance checklist with GDPR article references and an automatic progress score
Records of Processing (Art. 30) with legal bases and retention periods
Data Subject Request log with an automatic one-month deadline and days-left counter
Data Breach log with the automatic 72-hour reporting deadline
Processors & DPA tracker for every service provider and contract
Cookie & tracker audit that flags cookies set without consent
Example entries in every register, so you see exactly how to fill it in

The rules it covers

Records and accountability
Art. 5(2) and Art. 30 GDPR: you must be able to show what personal data you process, why and on which legal basis.
Requests and breaches
Data subject requests are answered within one month (Art. 12(3)); notifiable breaches go to the authority within 72 hours (Art. 33).
Processors and cookies
Service providers need a data processing agreement (Art. 28). Non-essential cookies need prior consent under the ePrivacy rules and national law.

Made for

Small and medium-sized businesses
Freelancers and agencies
Website and online shop owners
Data protection coordinators without a legal team

Two editions, same price

Choose how you want to work. Content and price are the same.

Notion template Word · Excel · PDF

Questions about this kit

Does a small business really need records of processing?

Almost always. The exemption for businesses under 250 employees in Art. 30(5) GDPR does not apply if processing is regular, which is the case for customer, staff or newsletter data. The kit's register is built for exactly that situation.

How fast do I have to answer a data subject request?

Within one month of receipt. In complex cases it can be extended by two further months, but you must tell the person within the first month. The request log calculates the deadline and the days left automatically.

When must I report a data breach?

Within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people. You must document every breach either way, and the breach log does that, with the deadline calculated for you.

Other kits

Templates

AI Compliance Toolkit EU AI Act + GDPR
AI Workplace Policy Pack EU AI Act + GDPR
EU Pay Transparency Kit Directive (EU) 2023/970
Vendor & AI Supplier Assessment Kit GDPR + EU AI Act

Need more than one kit?

This kit is part of the EU Compliance Bundle: all five kits for €69.99 instead of €149.95.

See the bundle All templates

The kits are organisational tools and a practical starting point. They do not constitute legal advice and do not guarantee compliance with the GDPR, the EU AI Act or any other law.