Privacy documentation

GDPR & Privacy Documentation

Structure privacy disclosures, data processing agreements, and internal records around verifiable data flows and activity-by-activity GDPR analysis.

Activity-by-Activity Legal Analysis

1. Controller vs. Processor Role per Activity:
   • Evaluate role per processing activity rather than globally:
     • Controller: Determines purposes and essential means (e.g., the SaaS provider's own account management, billing, security logging, and product analytics).
     • Processor: Processes personal data on behalf of and under the documented instructions of a B2B customer (e.g., workspace content, end-customer records stored in the platform).
2. Purpose-Specific Legal Basis (Art. 6(1) & Art. 9):
   • Map each distinct purpose to its specific legal basis; never rely on blanket consent for core service delivery:
     • Art. 6(1)(b) Contract: Strictly what is objectively necessary to perform the contract with the data subject or take pre-contractual steps at their request.
     • Art. 6(1)(c) Legal obligation: Tax/accounting retention, statutory consumer/regulatory records.
     • Art. 6(1)(f) Legitimate interests: Fraud prevention, network/application security, narrow B2B relationship management — state the specific legitimate interest pursued and verify necessity and balancing (LIA).
     • Art. 6(1)(a) Consent: Non-essential cookies/analytics, optional marketing newsletters, optional special features — must be freely given, specific, informed, unambiguous, and as easy to withdraw as to give (Art. 7).
3. Articles 12–14 Transparency & Layered Notices:
   • Include all mandatory disclosures: controller identity and contact (and DPO/representative if applicable), purposes and legal bases table, categories of personal data and sources (Art. 14), recipients/categories of recipients, third-country transfers and safeguards (Chapter V), concrete retention periods or determination criteria, data subject rights (access, rectification, erasure, restriction, portability, objection under Art. 21, withdrawal of consent), right to lodge a complaint with a supervisory authority, whether provision of data is statutory/contractual, and any Art. 22 automated decision-making.
   • Recommend Layer 1 contextual/just-in-time micro-notices at UI collection points alongside the full Layer 2 Privacy Notice.
4. Article 28 Data Processing Agreement (DPA):
   • When the product acts as a processor for B2B customers, draft a complete Art. 28 DPA covering: subject matter, duration, nature and purpose of processing, types of personal data and data subjects, processing only on documented instructions, confidentiality, Art. 32 technical and organizational measures (TOMs) matching actual system security, subprocessor authorization and advance change notification with objection rights, assistance with data subject requests and Arts. 32–36 obligations, deletion/return of data upon termination, and audit/inspection terms.