Start by clicking on "Fill out the template"
Answer a few questions and your document is created automatically.
Your document is ready! You will receive it in Word and PDF formats. You will be able to modify it.
Further, please note that prior to completing the document, users should consider the lawful bases for their processing of personal information. The lawful bases for processing are set out in Article 6 of the GDPR. At least one of these must apply whenever an entity processes personal data:
(a) Consent: the individual has given clear consent to process their personal data for a specific purpose.
(b) Contract: the processing is necessary for a contract with the individual, or because they have asked the relevant entity to take specific steps before entering into a contract.
(c) Legal obligation: the processing is necessary for an entity to comply with the law (not including contractual obligations).
(d) Vital interests: the processing is necessary to protect someone's life.
(e) Public task: the processing is necessary for the relevant entity to perform a task in the public interest or for their official functions, and the task or function has a clear basis in law.
(f) Legitimate interests: the processing is necessary for an entity's legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual's personal data which overrides those legitimate interests. (This cannot apply if the entity is a public authority processing data to perform their official tasks.)
Further information can be found on the ICO website's page on the lawful basis for processing.
How to use the document
If the website deals with "sensitive personal information" it will also be necessary for the website to display a separate notice (e.g. a popup box with checkbox) for the user when collecting such information which will:
Sensitive personal information includes information relating to ethnicity, political opinions, religious beliefs, trade union membership, physical or mental health or condition, sexual life or criminal record.
If user details are used for marketing purposes either by the website operators, by group companies, or by 3rd parties with whom the website operators share such information, users should be given an opportunity to opt-in and thereafter opt-out of any such marketing messages when such details are collected.
If personal information will be transferred to non-EEA countries by the website or its operators, entities will need to consider the safeguards surrounding such transfers and may need to use an EU commission approved model contract or EU commission approved corporate binding rules.
If the website relies upon consent as a lawful basis for processing any personal information, such consent must also be expressly collected and recorded by the website (e.g. through a checkbox), in circumstances where the user is fully informed about the nature of their consent. Indeed, the user should also confirm that they are old enough to provide any such consent.
Further information, guidance and a code of practice can be found on the Information Commissioner's Office website.
Any applicable law
General Data Protection Regulation
Equality Act 2010
How to modify the template
You fill out a form. The document is created before your eyes as you respond to the questions.
At the end, you receive it in Word and PDF formats. You can modify it and reuse it.