How to Draft Your GDPR Documents: Record of Processing Activities, Privacy Policy and Legal Notice

Do you handle personal data, but find your GDPR obligations unclear?
The rules are numerous, the requirements strict, and the slightest oversight can be costly. How can you tell whether your practices really comply with the regulation?

Every day, you process personal data: customers, employees, partners. A simple Excel file or an online form is enough to fall within the scope of the GDPR. Understanding this legal framework takes time, but compliance cannot wait.

This guide gives you the essential basics to put your practices on a sound legal footing. What are your obligations? Which documents should you draft? Which rights must you respect? No unnecessary jargon, just practical, actionable explanations.

First steps towards GDPR compliance

Understanding the basics of the GDPR

The GDPR (Regulation 2016/679) is a European regulation that governs the processing of personal data within the European Union. It lays down a series of legal requirements that controllers and processors must meet. These include transparency towards data subjects, data security and stronger rights for individuals.

The first step towards GDPR compliance is to understand the key concepts such as “personal data”, “data processing” and “consent”. Personal data covers any information relating to an identified or identifiable natural person. Data processing includes any operation performed on such data, for example its collection, storage or destruction.

Assessing your processing: the record of processing activities

Start by identifying and assessing all the data processing carried out within your organisation. This involves analysing data flows, the stakeholders and the objectives pursued. On the basis of this analysis, you will draw up what is known as a record of processing activities, a document required by Article 30 of the GDPR. Organisations with fewer than 250 employees are exempt only for processing that is occasional, does not present a risk to individuals and does not involve sensitive data (Article 30(5)).

The record of processing activities must contain precise information such as:

• The name and contact details of the controller and, where applicable, of the data protection officer (DPO)
• The purposes of the processing
• A description of the categories of data subjects and of the categories of personal data
• The categories of recipients, including in third countries, and, where applicable, transfers outside the European Union
• Where possible, the envisaged time limits for erasure of the different categories of data
• A general description of the technical and organisational security measures

Drafting the privacy policy

Transparency with users

The privacy policy is a fundamental document that must be drafted with care. It informs people about how their data is collected, used, disclosed and protected. Under Article 12 of the GDPR, this information must be concise, transparent, intelligible and easily accessible. You can read this article for more information on bringing your privacy policy into compliance.

It must include several key elements, such as:

• The identity and contact details of the controller
• The purposes of the processing and the legal basis
• The categories of personal data processed
• The recipients or categories of recipients of the data
• Transfers of data to third countries or international organisations
• The data retention period
• The rights of data subjects
• The right to lodge a complaint with the CNIL (French data protection authority)

Enabling data subjects to exercise their rights

The GDPR grants individuals certain specific rights over their personal data, including the right of access, the right to rectification, the right to erasure (“right to be forgotten”), the right to restriction of processing and the right to data portability. The aim is to strengthen individuals’ control over their personal information.

A good starting point for drafting is therefore to include clear and detailed procedures enabling users to exercise their rights. These procedures should state how a request can be made, what the response times will be and what information the data subject must provide to validate their request.

Publishing the legal notice (mentions légales)

The legal notice is mandatory

Under Article 1-1 of French Law No. 2004-575 of 21 June 2004 on confidence in the digital economy (loi pour la confiance dans l’économie numérique, LCEN), persons whose activity is to publish an online public communication service must make available to the public a legal notice. It ensures transparency and increases user trust. The legal notice must include information about the website host and about the publishing entity.

The law requires it to be published in an open standard. In practice, it is accessible from every page of the website and is usually found in the footer or in a dedicated section called “Mentions légales” (legal notice).

What to include in the legal notice

Here are some items commonly included in the legal notice:

• Name or company name
• Postal and email address
• Telephone number
• Publication director
• Contact details of the website host
• Registration number with the Trade and Companies Register (RCS)
• Intra-EU VAT number

FAQ on drafting GDPR documents