# GDPR Privacy Policy & Compliance Document Generator

Comprehensive, tailored GDPR compliance documentation for UK and EU businesses. Privacy policies, cookie policies, DPIAs, ROPA, DSAR responses, breach notifications, and more -- generated in minutes, not weeks.

## What It Does

Describe your business and what you need. Get back implementation-ready GDPR compliance documents tailored to your sector, data processing activities, and risk profile.

**14 document types:**

- **Privacy Policy** (website) -- UK GDPR + PECR compliant, with processing purpose tables
- **Privacy Notices** -- separate versions for employees, customers, and suppliers
- **Cookie Policy** -- with cookie audit table and consent mechanism guidance
- **Data Processing Agreement** -- controller-processor, Art 28 compliant
- **Data Processing Addendum** -- for SaaS and cloud provider contracts
- **Records of Processing Activities (ROPA)** -- Art 30 register with all required fields
- **Data Protection Impact Assessment (DPIA)** -- full risk assessment template
- **Legitimate Interest Assessment (LIA)** -- ICO three-part test
- **Consent Forms** -- granular, freely given, withdrawable, with record-keeping
- **DSAR Response Templates** -- 30-day deadline compliant, with exemption guidance
- **Data Breach Notification** -- ICO 72-hour report and data subject notification
- **Data Retention Schedule** -- by category with legal justifications
- **Data Protection Policy** -- internal staff guidance with breach and DSAR procedures
- **International Data Transfer documentation** -- UK adequacy decisions, IDTA, SCCs

## Why This Exists

Every UK and EU business processing personal data needs GDPR documentation. The reality:

- Solicitors charge GBP 500-2,000 for a privacy policy alone. A full compliance pack runs into thousands.
- Free online generators (Termly, iubenda, PrivacyPolicies.com) produce generic, surface-level policies that miss sector-specific requirements and rarely cover the full document set.
- Most small businesses have a privacy policy copied from another website and nothing else -- no ROPA, no DPIAs, no breach response plan, no staff training policy.
- The ICO can fine up to GBP 17.5 million or 4% of global turnover. Even smaller enforcement actions (reprimands, enforcement notices) are disruptive and public.

This skill generates the full set of GDPR compliance documents, customised to the business, citing actual legislation (DPA 2018, UK GDPR articles, PECR regulations, ICO guidance), with industry-specific presets for common business types.

## Quick Start

```
/gdpr-compliance e-commerce privacy policy
```

Generates a full website privacy policy tailored to an e-commerce business, with the correct lawful bases, cookie references, and retention periods.

```
/gdpr-compliance SaaS company — full compliance pack
```

Generates the complete set of GDPR documents for a SaaS business, including DPA for enterprise customers, sub-processor documentation, and international transfer assessments.

```
/gdpr-compliance recruitment agency DPIA for AI screening tool
```

Generates a Data Protection Impact Assessment for automated candidate screening, flagging the Art 22 automated decision-making requirements and ICO expectations.

## Who It's For

- UK and EU businesses of any size that process personal data
- Freelancers and sole traders who need a privacy policy for their website
- Startups building their compliance framework from scratch
- SMEs that cannot justify GBP 5,000+ for a solicitor's compliance pack
- Data protection officers looking for a structured starting point
- Consultants preparing GDPR documentation for clients

## Industry Presets

Specify your business type and the documents are pre-populated with sector-relevant processing activities, data categories, and regulatory considerations:

- **E-commerce** -- payment processing, marketing soft opt-in, fraud detection, delivery data
- **SaaS / Technology** -- sub-processor management, DPAs for customers, international transfers
- **Healthcare** -- special category data, Caldicott Principles, strict retention rules
- **Education** -- children's data, parental consent, EdTech platform DPAs
- **Recruitment / HR** -- CV retention, DBS checks, AI screening DPIAs, employee monitoring
- **Financial Services** -- AML obligations, credit profiling, FCA overlay
- **Hospitality** -- CCTV, guest records, dietary data, WiFi login data

## Legal References

All documents cite and comply with:

- UK GDPR (retained EU GDPR as amended by the Data Protection Act 2018)
- Data Protection Act 2018 (DPA 2018)
- Privacy and Electronic Communications Regulations 2003 (PECR)
- ICO guidance documents and codes of practice
- Relevant UK legislation (Limitation Act 1980, Companies Act 2006, Money Laundering Regulations 2017, etc.)

## Pricing

Available on Agent37. Free single-document generation, full compliance packs with Pro access.

---

*This generates GDPR compliance document templates based on UK GDPR, the Data Protection Act 2018, and ICO guidance. Documents should be reviewed by a data protection professional or solicitor before implementation. This is not legal advice.*