Can a U.S. company use this for EU data?

Yes. U.S. entities that process EU personal data should document compliance measures, lawful bases, and transfer mechanisms to meet GDPR accountability obligations; the mandate formalizes those decisions.

Is an electronic signature legally valid?

In the U.S. electronic signatures are generally valid under ESIGN and UETA; they are acceptable for the mandate when they demonstrate signer intent, attribution, and a retained reproducible record.

Do I need notarization or witnesses?

Not typically for an internal compliance mandate. If state law or specific contractual terms require notarization, follow state notary rules or use a RON solution where permitted.

How long must I keep the mandate?

Retain while the processing continues and then per applicable standards: at least 3 years for tax-related records and up to 6 years for HIPAA-covered records; adjust for legal holds.

What about cross-border transfers?

Document the legal transfer mechanism (e.g., standard contractual clauses, adequacy decision) and any technical safeguards used to protect EU personal data in transit or at rest.

Which teams must be alerted after approval?

Notify IT, security, procurement, vendor management, and business owners so contractual changes, access controls, and processing logs reflect the approved mandate.

Electronic Signature
Templates
Miscellaneous
GDPR Compliance Mandate

GDPR Compliance Mandate

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

GDPR COMPLIANCE MANDATE

Parties

Mandating Party (Data Controller) Mandating Party Address Primary Contact (Controller) Contact Email Mandated Party (Data Processor) Mandated Party Address Primary Contact (Processor) Contact Email

Recitals

WHEREAS, Mandating Party is the data controller responsible for determining the purposes and means of processing certain personal data and requires the provision of services to achieve and maintain compliance with applicable data protection law; and

WHEREAS, Mandated Party possesses the technical and organizational capacity to provide assessment, remediation and ongoing advisory services to assist the Mandating Party in meeting legal obligations relating to processing of personal data; and

WHEREAS, the parties desire to set forth the scope, obligations, fees and terms under which Mandated Party will perform GDPR compliance related services on behalf of Mandating Party.

Scope of Work

The Mandated Party shall provide services necessary to assess, document and remediate the Mandating Party’s processing activities, implement required technical and organizational measures, and assist with regulatory and data subject obligations as described below. Services include but are not limited to the following:

Categories of Personal Data to be Processed Processing Activities and Purposes

Payment Terms

Mandating Party shall pay Mandated Party the fees set forth below in consideration for the services rendered under this Mandate.

Total Fee Payment Schedule Late Payment

Term and Termination

This Mandate commences on and continues until unless earlier terminated in accordance with this section.

Either party may terminate this Mandate for convenience upon days' prior written notice to the other party. Either party may terminate immediately for material breach, including failure to comply with data protection obligations, where such breach is not remedied within a reasonable cure period not to exceed 30 days after notice.

Confidentiality and Data Protection

The Mandated Party shall:

Process personal data only on documented instructions from the Mandating Party and not for any other purpose;
Implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including measures for pseudonymization, encryption, restoration, and regular testing;
Ensure that personnel authorized to process personal data are subject to confidentiality obligations;
Assist the Mandating Party in responding to data subject requests and in meeting obligations regarding records, DPIAs and consultations with supervisory authorities where required by law;
At the choice of the Mandating Party, return or securely delete personal data upon termination, and provide certification of deletion where applicable.

Subprocessing

Mandated Party shall not engage any subprocessor without prior written authorization from Mandating Party. If authorized, the Mandated Party shall impose on the subprocessor equivalent data protection obligations, remain liable for the subprocessor's compliance, and notify the Mandating Party of any intended changes.

Subprocessor Authorization Mandated Party is authorized to appoint subprocessors under the terms above

International Transfers

Personal data shall not be transferred outside jurisdictions that provide an adequate level of protection unless the parties execute appropriate safeguards and document those measures.

Is transfer outside EEA expected? Yes

If yes, specify jurisdictions and safeguards

Security Incidents and Breach Notification

Mandated Party shall notify Mandating Party without undue delay and in any event within hours of becoming aware of a personal data breach. Notification shall include all relevant information to enable Mandating Party to comply with its legal obligations. Mandated Party shall cooperate in containment, assessment and remediation of the breach.

Liability

Each party's liability for breaches of this Mandate arising from negligence, willful misconduct, or intentional violation of data protection obligations shall not be excluded. The parties shall document and reasonably apportion liability in any ancillary fee schedule; nothing in this Mandate shall limit liability for death, personal injury, or damages arising from fraud or wilful misconduct.

Governing Law

This Mandate shall be governed by and construed in accordance with the laws of the jurisdiction specified by the Mandating Party at execution. The parties submit to the exclusive jurisdiction of the competent courts of that jurisdiction for disputes arising from or connected with this Mandate.

Governing Law Jurisdiction

Entire Agreement

This Mandate constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior agreements and understandings relating to data protection services, except to the extent otherwise expressly set out in a written amendment signed by both parties.

Miscellaneous Provisions

Any amendments must be in writing and signed by authorized representatives. Notices shall be given in writing to the contacts listed above. If any provision of this Mandate is held invalid, the remainder shall continue in full force and effect.

Mandating Party:

By:

Date:

Mandated Party:

By:

Date:

What the GDPR Compliance Mandate is and why it matters

The GDPR Compliance Mandate is a formal internal document that documents an organization’s commitments, roles, and procedures for processing personal data subject to the EU General Data Protection Regulation (GDPR). It sets out the scope of processing activities, lawful bases relied upon, technical and organizational measures, data subject rights handling, and cross‑border transfer mechanisms. For U.S.-based entities that process or receive EU personal data, the Mandate helps demonstrate accountability and consistency across teams and suppliers, and it can be stored and executed electronically under ESIGN and UETA-compliant workflows.

Why adopt a GDPR Compliance Mandate

A clear mandate centralizes responsibilities, documents lawful bases, and reduces legal and operational risk by aligning procedures with GDPR accountability principles, preserving evidence of decisions and vendor controls for audits or inquiries.

Who typically prepares and signs this mandate

This mandate is usually drafted and approved by cross‑functional stakeholders responsible for privacy and data handling.

Data Protection Officer or Privacy Lead — Oversees compliance program, risk assessments, and enforcement of data handling rules.
Legal Counsel or Compliance Officer — Reviews lawful bases, contract clauses, and regulatory risk language before approval.
IT / Security and Operations — Confirms technical controls, logging, and secure transfer methods described in the mandate.

Final approval often requires a senior executive signature to demonstrate organizational commitment and to trigger downstream operational changes.

Stepwise process to complete the GDPR Compliance Mandate

Follow these sequential actions to create, review, and finalize a usable mandate.

01

Map processing: Identify data types, flows, and systems affected.
02

Choose legal basis: Assign and document the GDPR lawful basis for each activity.
03

Assess controls: Record technical and organizational measures in place.
04

Approve and sign: Obtain authorized signatures and store audit trail.

How the mandate moves from draft to operational record

A clear routing model reduces friction: draft, review, sign, and archive with accessible records for audits and requests.

Draft: Author enters fields and supporting exhibits.
Review: Legal, privacy, and IT validate content.
eSign: Authorized signers execute the mandate electronically.
Archive: Store final document with audit trail and version history.

Online setup checklist for eCompletion

Configure the digital workflow to capture approvals, authentication, and a tamper‑evident audit trail.

Field	Configuration
Signing Order	Sequential routing with role-based signer assignments.
Authentication	Email plus optional SMS or two-factor for high-risk signers.
Retention Tag	Automatic metadata tag for retention and deletion policy.
Audit Trail	Capture timestamps, IPs, and signer events.

Technical and platform considerations for eSubmission

Ensure the chosen platform supports required authentication, secure storage, and integrations with your systems.

Authentication options: Email, SMS, or stronger MFA available
Data residency: EU‑aware storage and export controls
File formats: PDF and DOCX supported

Confirm integrations with your document management, HR, or ticketing systems to automate routing and long-term retention.

Essential information to include in the mandate

Processing categories: Types of personal data processed

Purposes: Legal or business reasons for processing

Data recipients: Internal teams and external processors

Retention: Duration and deletion policy

Transfers: Cross‑border mechanisms and safeguards

Contact point: Controller or DPO contact details

Common mistakes to avoid when preparing the mandate

Vague scope language that omits specific systems or data types, leaving downstream teams unsure of responsibilities.
Stating an unsupported lawful basis (for example, relying on consent when contractual necessity is required) without documented evidence.
Failing to list subprocessors or update processor clauses when vendors change, which weakens contractual enforcement.
Not capturing an audit trail for signature events or not preserving consent records in a searchable format.

Risks and regulatory consequences of an incomplete or incorrect mandate

Regulatory fines: Up to €20 million or 4% global turnover

Enforcement notices: Orders to suspend or cease processing

Contractual liability: Breach of vendor agreements

Data subject claims: Compensation for rights violations

Reputational harm: Loss of customer trust and market impact

Cross‑border blocks: Suspended transfers to the U.S. or third countries

Core sections every professional GDPR Compliance Mandate should include

A complete mandate contains descriptive, legal, technical, and operational elements so obligations are clear and defensible.

Processing Description

Detail categories of personal data, data subjects, processing activities, systems used, and any profiling or automated decision‑making involved; be specific to support lawful basis choices.

Lawful Basis and Purposes

State the GDPR lawful basis for each processing purpose, include brief justification and any consent mechanisms or contractual clauses relied upon for processing.

Data Subject Rights

Describe procedures to handle access, rectification, erasure, portability, restriction and objection requests, including expected timelines and responsible contacts.

Technical and Organizational Measures

List encryption, access controls, logging, incident response, employee training, and other controls demonstrating appropriate security for the processing activities described.

Processor and Subprocessor Clauses

Identify external processors, require written agreements, and specify subprocessors, audit rights, and liability allocation in line with GDPR requirements.

Cross‑Border Transfers

Document transfer mechanism used (SCCs, adequacy, Binding Corporate Rules), any supplementary measures, and monitoring procedures for third‑country recipients.

Practical examples of mandate use in common scenarios

Two short examples show typical drafting choices for different industries and why those choices matter operationally.

Case Study: Healthcare Clinic

A midsize clinic documented patient data flows and required BAA clauses for all processors

The mandate recorded retention of medical records and secured patient consent where appropriate
As a result, the clinic had documented controls and a single source of truth for patient data handling during internal reviews and regulator inquiries.

Case Study: Real Estate Broker

A broker mapped lead capture and transaction files, listing lawful bases for marketing versus contract administration

The mandate distinguished personal contact data from transaction documentation
This separation simplified responding to SARs and ensured vendor agreements explicitly covered beneficiary access and cross‑border transfers.

Frequently asked questions about the GDPR Compliance Mandate

Answers to common questions about scope, enforceability, signing methods, and retention to help avoid implementation pitfalls.

Need help? Contact support

Can a U.S. company use this for EU data?
Yes. U.S. entities that process EU personal data should document compliance measures, lawful bases, and transfer mechanisms to meet GDPR accountability obligations; the mandate formalizes those decisions.
Is an electronic signature legally valid?
In the U.S. electronic signatures are generally valid under ESIGN and UETA; they are acceptable for the mandate when they demonstrate signer intent, attribution, and a retained reproducible record.
Do I need notarization or witnesses?
Not typically for an internal compliance mandate. If state law or specific contractual terms require notarization, follow state notary rules or use a RON solution where permitted.
How long must I keep the mandate?
Retain while the processing continues and then per applicable standards: at least 3 years for tax-related records and up to 6 years for HIPAA-covered records; adjust for legal holds.
What about cross-border transfers?
Document the legal transfer mechanism (e.g., standard contractual clauses, adequacy decision) and any technical safeguards used to protect EU personal data in transit or at rest.
Which teams must be alerted after approval?
Notify IT, security, procurement, vendor management, and business owners so contractual changes, access controls, and processing logs reflect the approved mandate.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now