By country

GDPR Policy Generator EU

EU GDPR, the ePrivacy Directive as implemented locally, and the one-stop-shop - with the right lead authority named.

Generate your GDPR policy Read the GDPR policy guide

The GDPR document set that matters is internal: the Article 30 record, the lawful basis register, the DPIA log, the breach register and the processor agreements. A supervisory authority opening a file asks for those, in that order.

EU compliance is not one regime but one regulation applied by twenty-seven authorities, plus national laws that fill the gaps GDPR deliberately left. The cookie rules in particular are national: the ePrivacy Directive is implemented by the TDDDG in Germany, by the Loi Informatique et Libertés and CNIL guidelines in France, by Article 22.2 LSSI in Spain and by the Telecommunicatiewet in the Netherlands.

If you are established in more than one member state, the one-stop-shop mechanism gives you a lead supervisory authority based on your main establishment. That authority is the one to name. If you are established nowhere in the EU but target EU users, there is no lead authority - every national regulator can act, and Article 27 requires you to appoint an EU representative.

The regulatory surface has widened well beyond GDPR. The Digital Services Act imposes notice-and-action and transparency duties on anyone hosting user content, the AI Act layers transparency obligations onto systems that interact with people, and the Data Act adds switching and access rights for connected products and cloud services.

What a GDPR policy in the EU has to cover

Article 30 records for both controller and processor roles where you act as each
DPIAs for the processing on your authority’s mandatory list
Article 28 terms with every processor, plus the sub-processor list and change-notification commitment
Transfer impact assessments per destination, referencing local surveillance law
A 72-hour breach notification procedure with a decision test for when individuals must be told

How the EU actually moves personal data

Cross-border customer data inside the EEA

Intra-EEA movement is not a "transfer" and needs no Chapter V mechanism, but it does need the recipient categories disclosed and, where a group company is involved, a controller-to-controller or Article 26 joint-controller arrangement.

Transfers to the United States

Certified importers can be covered by the EU-US Data Privacy Framework; everyone else needs the 2021 SCCs plus a transfer impact assessment that engages with US surveillance law rather than asserting adequacy.

Consent signals under the TCF

If you sell programmatic advertising you are likely inside the IAB Transparency and Consent Framework, which brings its own vendor list, purpose taxonomy and string format that the policy has to reflect.

Special category data by accident

Health-adjacent apps, dietary preferences, trade union membership in payroll and political affiliation in CRM records all trigger Article 9 and need a condition from Article 9(2), not just a basis from Article 6.

Employee monitoring and works councils

In Germany, Austria and the Netherlands, monitoring tools frequently require works council agreement before deployment, independently of the GDPR basis.

Third parties the draft will ask you about

Stripe · Adyen · Mollie · Klarna · Google Analytics 4 · Matomo · Brevo · AWS eu-central-1 · OVHcloud · Hetzner

The rules that apply

GDPR (Regulation 2016/679)

Articles 13 and 14 for the notice, Article 6 for the basis, Article 30 for the internal record, and Chapter V for transfers out of the EEA.

ePrivacy Directive, as implemented nationally

Consent for storing or accessing information on a device. The rule is European, the implementation and the enforcement thresholds are national.

One-stop-shop and Article 27

A lead authority if you have an EU establishment; an appointed EU representative and exposure to every authority if you do not.

Consumer Rights Directive and the Omnibus Directive

Fourteen-day withdrawal on distance sales, plus disclosure duties on ranking, reviews and personalised pricing.

Digital Services Act

Published terms, a notice-and-action mechanism, statement-of-reasons for moderation decisions and an internal complaints route for anyone hosting third-party content.

What the generated GDPR policy contains

Article 13 and 14 transparency notice
The full disclosure set, split by whether the data came from the person or from somewhere else.
Lawful basis register
Every processing activity mapped to one of the six bases, with the legitimate interests assessment written down where you rely on that basis.
Records of processing (Article 30)
The internal register a supervisory authority can ask for at any time, covering purposes, categories, recipients, transfers and retention.
Data subject rights procedure
How a request arrives, how identity is verified, who handles it, and the one-month clock with its two-month extension.
International transfer mechanism
Adequacy, SCCs with a transfer impact assessment, or the UK IDTA/addendum - named per destination, not asserted in general.
Breach detection and 72-hour notification
The internal escalation path, the assessment test, and the template for notifying the regulator and, where required, the individuals.
Processor and sub-processor controls
Article 28 terms, the sub-processor list, and the change-notification commitment your customers will ask for.

Getting an EU-facing policy right

Establish whether you have a main establishment
It determines whether you get a lead authority or face all twenty-seven. Where central decisions about processing are actually taken is the test, not where the company is registered.
Appoint an Article 27 representative if you are outside the EU
Required for most non-EU businesses targeting EU users. The representative’s name and address go in the privacy policy.
Set the age of digital consent per market
It ranges from 13 to 16 across member states. If you serve minors, the age gate has to be country-aware.
Document transfer impact assessments
One per destination country and vendor, referencing the actual legal environment, kept on file for the regulator rather than summarised in the notice.
Map DSA duties if you host user content
Notice-and-action, statements of reasons and an internal complaint system are separate obligations from anything in GDPR.

Where this usually goes wrong

Naming "the EU supervisory authority" instead of a real one

There is no such body. Users must be told they can complain to their own national authority, and if you have a lead authority you should name it.

Assuming the Data Privacy Framework covers every US vendor

It covers only organisations that have actively self-certified and remain on the list. Most smaller US SaaS vendors have not, which leaves you on SCCs plus a transfer impact assessment.

A cookie banner that pre-ticks or infers consent

The Planet49 ruling settled this: pre-ticked boxes are not consent, and continued scrolling is not consent. Several national regulators treat it as an automatic finding.

Ignoring national add-ons

Germany requires an Impressum, France requires mentions légales, and several member states set their own age of digital consent between 13 and 16. A pure GDPR document misses all of it.

Legitimate interests for advertising without an assessment

The EDPB and the courts have narrowed this repeatedly. Behavioural advertising on legitimate interests, with no documented balancing test, is the pattern that produced the largest recent fines.

Frequently asked questions

Does GDPR apply to my business if I am not in the EU?

Yes, if you offer goods or services to people in the EU or monitor their behaviour. Article 3(2) turns on where the person is. Accepting euros, shipping to EU addresses or running EU-targeted ads are the facts regulators look at.

Which supervisory authority do I name?

If you have an EU main establishment, your lead authority. If not, tell users they may complain to the authority in their own member state, and name your Article 27 representative.

Is one policy enough for all 27 member states?

For GDPR, generally yes. For cookies, marketing, minors and consumer terms it needs national variations, because those are governed by national implementations rather than the regulation itself.

Do I need an EU representative?

If you are established outside the EU and Article 3(2) catches you, yes - unless your processing is occasional, low-risk and excludes special category data. Most e-commerce and SaaS businesses do not fit that exemption.

Does GDPR apply to a business outside the EU?

Yes, where you offer goods or services to people in the EU or monitor their behaviour. Article 3(2) is about where the person is, not where you are - and Article 27 may also require you to appoint an EU representative.

What is the difference between EU GDPR and UK GDPR?

The text is nearly identical, but they are separate laws with separate regulators, separate fine ceilings in different currencies, and separate transfer regimes. A business serving both needs both named, not "GDPR" as shorthand.

Do I need a Data Protection Officer?

Only where your core activities involve large-scale regular monitoring or large-scale special-category data, or you are a public authority. Many businesses do not need one - but if you do not have one, say who is accountable instead.

Is a GDPR policy the same as a privacy policy?

No. The privacy policy is the outward-facing notice. The GDPR policy set is the internal machinery - lawful basis register, ROPA, rights procedure, breach plan - that lets you answer a regulator when they ask how the notice is honoured.