Regulation (EU) 2016/679 reaches every company that processes personal data; which of its 108 catalogued duties turn on depends on your role and on a few answers about the data, and the breach clock of 72 hours runs from the moment you become aware.
Answer above to read the determination for your case; the full tool takes your answers with it.
Continue in the free determinationThe full determination answers every question, and keeps the reading as a dated record for €29.
At a glance
The clocks it starts
Eight tools, free, no account
- Free checkWhich GDPR duties apply to you, in writingNine questions; the duties read from the Regulation with the provision each rests on, the 108 catalogue rows in six Official Journal languages, the ISO 27701 reading, the clocks; copy or download.
- Document writerThe record of processing, writtenThe 7 fields of a controller's record and the 4 of a processor's, verbatim from Article 30, one activity at a time; the document to copy or download.
- Document writerThe processor contract, term by termThe 8 terms of Article 28(3) every processor contract carries, verbatim, with a status per term and the DORA clause each sits beside when the customer is a bank; the checklist to copy or download.
- Document writerThe impact assessment: due or not, and writtenThe 3 cases of Article 35(3) as questions, the 4 elements of Article 35(7) as the assessment itself, the Article 36 consultation; the document to copy or download.
- ClockThe breach clock: 72 hours from awarenessThe moment you became aware in, the Article 33 deadline out, the processor's notice, the Article 34 communication, and the notification written to Article 33(3).
- ClockThe request clock: 1 month from receiptThe day of receipt in, the deadline out by the period rule, the 2 further months and the refusal kept to the first month, and an access request answered with the 8 contents of Article 15(1).
- Free checkWhich transfer mechanism: adequacy, clauses, or noneThe destination and the two roles in; no transfer, one of the 17 adequacy decisions, or the standard contractual clauses' module out, with the 6 safeguards and 7 derogations as the Official Journal words them.
- Document writerThe privacy notice, written from Articles 13 and 14Where the data come from decides the article; the 12 pieces at collection or the 13 for data obtained elsewhere as the Official Journal words them, an answer under each, the notice written.
Every free template on one page
The instrument and the standard
Regulation (EU) 2016/679, applying since 25 May 2018: 108 duties catalogued
One row per statute reference for a controller or a processor, the Official Journal text in six languages. Article 83 sets the ceilings: €10,000,000 or 2% of worldwide annual turnover for the duties of Articles 25 to 39, €20,000,000 or 4% for the principles, the lawful bases, the data subjects' rights and the transfers.
ISO/IEC 27701:2025, the privacy information management standard
The ISO references in the catalogue are StandardOS's reading of ISO/IEC 27701:2025, the current edition: Table A.1 for a controller, Table A.2 for a processor and Table A.3 for both. The Regulation names no standard and no certificate is a presumption of conformity with it.
Read next
- ArticleThe GDPR for a software company: controller of your own data, processor for your customers', and the five duties that turn on size and data
- ArticleThe GDPR record of processing for a software company: the seven fields of Article 30(1), the four of Article 30(2), why the 250-person exemption never applies, and a page that writes it
- ArticleThe GDPR processor contract for a SaaS company: the eight terms of Article 28(3) every customer addendum carries, the duty most of them forget, and what sits beside them under DORA
- ArticleThe GDPR 72-hour breach clock for a software company: when awareness starts it, what the notification contains, the processor's own clock, and the NIS2, CRA and DORA clocks beside it
- ArticleThe GDPR impact assessment for a software company: the three cases of Article 35(3), the nine criteria behind them, the four elements of Article 35(7), and a page that writes it
- ArticleISO/IEC 27701:2025 for a software company: the standalone privacy standard, its 78 controls, what an ISO 27001 system already covers, and the GDPR articles each control evidences
- ArticleWhich GDPR supervisory authority is yours: the main establishment, the lead authority of Article 56, the local cases, and the 30 authorities of the Board
- ArticleThe GDPR representative of Article 27 for a software company outside the EU: who must appoint one, the three conditions of the exemption, and where the name goes
- ArticleThe GDPR data subject request for a software company: the month of Article 12(3), the eight contents of an access answer, the two further months, and a page that computes the deadline
- ArticleGDPR international transfers for a software company: the 17 adequacy decisions, the four SCC modules, what a US, UK or Indian sub-processor needs, and a page that picks the mechanism
- ArticleThe GDPR privacy notice for a software company: the twelve pieces of Article 13, the thirteen of Article 14, the moment each is given, and a page that writes it
- ArticleThe Data Act for a SaaS company: the switching duties since 12 September 2025, the nine contract terms, the end of switching charges, and what a data holder owes
- ArticleNIS2 or CRA: which incident clock runs for a software company, next to the GDPR's 72 hours
- ArticleDORA for a software vendor: the contract clauses a bank customer sends, and the processor terms they sit beside
What it asks of you
108 requirements in 4 groups
Obligations
41- 5(1)(a) Process personal data lawfully, fairly and transparently
- 5(1)(b) Collect data for stated purposes and stick to them
- 5(1)(c) Process only the data the purpose needs
and 38 more
Duties
27- 7(1) Be able to show the person consented
- 8(2) Make reasonable efforts to verify a parent's consent
- 12(4) Explain within a month why you are not acting
and 24 more
Clauses
38- 7(4) Do not tie a contract to unneeded consent
- 9(2) Record which exception allows each special category
- 9(3) Keep health data under professional secrecy
and 35 more
Deadlines
2- 12(3) Answer a data subject's request within a month
- 33(1) Notify a breach to the authority within 72 hours
The GDPR record and its duties, in one place
The record of processing, the GDPR's duties with their evidence and the breach and request clocks, in one workspace.
Dates and counts are read from the Regulation and the catalogue, never typed on this page. This is not legal advice, and the Regulation is the text to read: Regulation (EU) 2016/679
Related:ArticlesFree tools