Is an e-signed GDPR declaration legally valid?

Yes. In the United States, electronic signatures that meet the ESIGN Act (15 U.S.C. ch. 96) and state UETA requirements are legally valid. For cross-border compliance, ensure the signature method meets the receiving EU authority's evidentiary expectations.

When should I use a notarized version?

Notarization is only necessary when a receiving party, local law, or a related filing requires it. For deeds, some states mandate notary and witnesses; otherwise, a tamper-evident e-signed PDF with audit trail is typically sufficient.

How long must I retain the signed declaration?

Retain for the active processing term plus an additional period aligned with federal and industry rules: at least three years for general financial records and six years for HIPAA-related records (45 CFR §164.530(j)).

Can a U.S. company be fined under GDPR?

Yes. U.S. entities that process EU personal data and fall under GDPR jurisdiction can face administrative fines and enforcement by EU supervisory authorities, including significant penalties for serious infringements.

What if a signer lacks authority?

If a signatory lacks authority, the declaration may be unenforceable. Confirm signatory authority in the signature block and maintain organizational delegation or resolution documents where necessary.

How do I respond to a data subject access request?

Document the request, verify the requestor's identity, locate relevant records including the declaration, and respond within the 30-day GDPR deadline unless a valid extension is applied.

Electronic Signature
Templates
Legal
Legal GDPR Declaration Form

Legal GDPR Declaration Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

LEGAL GDPR DECLARATION FORM

This GDPR Declaration Form (the Declaration) is entered into by and between Data Controller: with registered address: and Data Processor: with registered address: effective as of: .

RECITALS

WHEREAS: The Controller determines the purposes and means of the processing of Personal Data in connection with the Controller's business activities and the Processor provides certain processing services to the Controller.

WHEREAS: The parties wish to document their respective obligations under applicable data protection law, including but not limited to the General Data Protection Regulation (GDPR), with respect to the Processing of Personal Data by the Processor on behalf of the Controller.

WHEREAS: The parties intend by this Declaration to ensure that Personal Data is processed in a manner consistent with data protection principles, to protect the rights of data subjects and to set forth the terms and conditions governing such processing.

NOW THEREFORE, in consideration of the mutual covenants herein, the parties agree as follows:

1. DEFINITIONS

For purposes of this Declaration, the following terms shall have the meanings set forth below: "Personal Data" means any information relating to an identified or identifiable natural person; "Processing" means any operation performed on Personal Data; "Data Subject" means the individual to whom Personal Data relates.

2. SUBJECT-MATTER, DURATION AND NATURE OF PROCESSING

The Processor shall process Personal Data only on documented instructions from the Controller. The subject-matter and duration of the processing, the nature and purpose of the processing, and the types of Personal Data and categories of Data Subjects are set out below and in any Statement of Work or annex.

Describe processing activities (purpose and nature) Categories of Personal Data processed Categories of Data Subjects

3. LAWFUL BASIS AND INSTRUCTIONS

The Processor warrants that it will process Personal Data only pursuant to the Controller's documented instructions and in accordance with the lawful basis for processing indicated by the Controller. The parties confirm the lawful basis for processing as indicated below:

Consent Contractual necessity Legal obligation Legitimate interest

4. SUB-PROCESSING AND RECIPIENTS

The Processor shall not engage another processor without prior written authorization from the Controller. A current list of authorised recipients or sub-processors is to be maintained and provided to the Controller on request.

Identified recipients / sub-processors (if any)

5. INTERNATIONAL TRANSFERS

Transfers of Personal Data to countries outside the European Economic Area (or other applicable territories) shall only occur where appropriate safeguards are in place or another permitted transfer mechanism applies.

International transfers required: Yes No

If transfers occur, describe safeguards

6. SECURITY MEASURES

The Processor shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including measures to protect against unauthorised or unlawful processing and accidental loss, destruction or damage.

Technical and organisational measures (describe)

7. DATA SUBJECT RIGHTS AND ASSISTANCE

The Processor shall promptly notify the Controller of any request from a Data Subject and shall assist the Controller, taking into account the nature of Processing, by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to Data Subject requests.

Controller contact for Data Subject requests Processor contact for assistance

8. BREACH NOTIFICATION

The Processor shall notify the Controller without undue delay upon becoming aware of a Personal Data breach. Such notification shall include, where possible, details sufficient to enable the Controller to meet any obligations to report the breach to supervisory authorities and to communicate with affected Data Subjects.

Breach notification timeframe (hours)

9. AUDIT RIGHTS AND RECORDS

The Processor shall make available to the Controller all information necessary to demonstrate compliance with applicable data protection laws and shall allow for and contribute to audits, including inspections, by the Controller or an auditor mandated by the Controller subject to reasonable notice and confidentiality requirements.

Audit rights requested: Yes No

10. RETENTION AND DELETION

The Processor shall retain Personal Data only for the duration necessary to fulfil the Controller's instructions and shall, at the choice of the Controller, delete or return all Personal Data after the end of the provision of services, unless legislation requires storage of Personal Data.

Retention period or deletion criteria

11. LIABILITY AND INDEMNITY

Each party shall be liable for breaches of this Declaration in accordance with applicable law. The Processor shall be liable for breaches resulting from its processing activities and shall indemnify the Controller for losses arising from Processor's failure to comply with its obligations hereunder to the extent permitted by applicable law.

12. MISCELLANEOUS

Governing Law: This Declaration shall be governed by and construed in accordance with the law specified by the Controller:

Entire Agreement: This Declaration constitutes the entire agreement between the parties with respect to the processing of Personal Data and supersedes any prior agreements or understandings on that subject.

Severability: If any provision of this Declaration is found to be invalid, illegal or unenforceable, the remainder of the Declaration shall remain in full force and effect and the parties shall negotiate in good faith to replace the invalid provision with a valid provision achieving the parties' original intent.

Notices: All notices under this Declaration shall be in writing and delivered to the addresses set forth below or to any other address notified in accordance with this clause.

Notices to Controller (name and address) Notices to Processor (name and address)

Amendments: Any amendment or modification to this Declaration must be in writing and signed by authorised representatives of both parties.

Waiver: No failure or delay by either party in exercising any right will operate as a waiver of that right.

Counterparts: This Declaration may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one agreement.

DATA PROTECTION OFFICER / CONTACTS

Controller Data Protection Officer or contact Processor Data Protection Officer or contact

Controller — Print Name:

By:

Date:

Processor — Print Name:

By:

Date:

What the Legal GDPR Declaration Form Is and When It Applies

A Legal GDPR Declaration Form documents how an organization collects, processes, stores, and transfers personal data that falls under the EU General Data Protection Regulation (GDPR). For U.S. businesses processing EU personal data, the form records the data controller/processor roles, lawful basis for processing, categories of personal data, retention limits, safeguards for international transfers, and rights available to data subjects. When signed and retained as an official record, the form supports audits, breach response, and responses to data subject access requests, and it can be executed electronically under U.S. e-signature law when ESIGN/UETA requirements are satisfied.

Why a GDPR Declaration Helps Your Compliance Program

A clear, signed declaration provides documented evidence of lawful processing, data transfer safeguards, and retention decisions. It centralizes required disclosures for audits and demonstrates steps taken to honor data subject rights, reducing risk in cross-border operations and simplifying regulatory review while aligning with ESIGN and UETA for e-signed records.

Who Typically Prepares and Signs a GDPR Declaration

Organizations and individuals who need to declare GDPR-related processing use this form to create an auditable record.

Data protection officers and compliance teams preparing official records and internal audit trails.
Legal counsel and contracts teams documenting processing purposes, legal basis, and transfer mechanisms.
Vendors and subcontractors confirming processing details and agreeing to required safeguards.

The document suits any U.S. entity handling EU personal data, whether for HR, marketing, customer service, or cross-border commerce.

Step-by-Step: Filling and Finalizing the Declaration

Use this concise workflow to prepare, approve, and retain the completed declaration.

01

Prepare Form: Complete all required fields and attach supporting exhibits.
02

Legal Review: Have counsel confirm lawful basis and transfer mechanisms.
03

Obtain Signatures: Collect authorized signatures using a compliant e-signature method.
04

Archive Record: Store signed copy with audit trail in secure, access-controlled archive.

Recommended Digital Workflow Settings for eSubmission

Configure your e-sign and document management workflow to capture required evidence and meet retention and access needs.

Field	Configuration
Authentication	Email link plus audit trail; add SMS code for higher assurance
Retention	Archive signed PDF/A with AES-256 encryption
Consent Checkbox	Require explicit consent checkbox with ESIGN disclosure
Audit Trail	Capture IP, timestamp, signer identity, and certificate

Where to Send and File the Completed Declaration

Know the primary routing destinations and storage steps for the executed declaration.

Send to DPO: Provide a signed copy to your data protection officer and legal team.
Attach to Contract: Link the declaration to related vendor or customer agreements.
Provide to Data Subject: Share a copy on request or as required by law.
Store Securely: Retain in encrypted records with restricted access and logging.

Technology and Format Requirements for Electronic Completion

Choose platforms and file formats that preserve the signature audit trail and support secure archival.

Integrations: Salesforce, NetSuite, Google Workspace, Microsoft 365
File Formats: PDF/A, DOCX, and signed PDF certificate export
Authentication: Email link, SMS code, or advanced signer verification

Ensure the chosen platform supports tamper-evident signed PDFs, audit logs, and the retention profile required by your compliance program.

Essential Sections Every Professional GDPR Declaration Should Include

A complete declaration groups processing facts, legal reasoning, safeguards, and attestations so auditors and regulators can quickly verify compliance.

Declaration Statement

A clear attestation that the party is a controller or processor, including a concise statement of responsibilities and the scope of the declaration for specific data sets.

Processing Details

Purpose, frequency, and specific processing activities described in operational terms so the declaration maps to actual data flows and systems.

Legal Basis

Document the chosen lawful basis for each processing activity and summarize supporting facts showing why that basis is appropriate and proportionate.

International Transfers

Specify transfer mechanisms such as Standard Contractual Clauses, adequacy decisions, or binding corporate rules and list recipient jurisdictions and safeguards.

Data Subject Rights

Describe the process to receive and respond to access, rectification, erasure, portability, and objection requests, including contact points and timelines.

Security Measures

Summarize technical and organizational measures, encryption standards, access controls, and incident response steps that protect the data described.

Formats, Supporting Documents, and What to Keep With the Declaration

Include related exhibits and signed records that auditors and regulators expect to see alongside the declaration.

Signed Declaration PDF

Store a tamper-evident signed PDF/A that includes the full audit trail, signer identities, timestamps, and signature certificate.

Processing Matrix

Attach a processing inventory or matrix that maps systems, data categories, and retention schedules to the declaration's statements.

Transfer Contracts

Include copies of Standard Contractual Clauses, data processing agreements, or adequacy assessments referenced in the declaration.

Consent Records

Where consent is the basis, retain records showing when, how, and with what disclosure consent was obtained.

Security and Compliance Facts to Record in the Form

Encryption in transit: TLS 1.2/1.3

Encryption at rest: AES-256

Certifications: SOC 2 Type II, ISO 27001

Privacy frameworks: GDPR compliance; EU-U.S. Data Privacy Framework

HIPAA availability: BAA available where required

Audit trail: IP, timestamp, action log

Key Risks and Potential Penalties to Reflect in Risk Assessments

GDPR fines: Up to €20 million or 4% global turnover

Regulatory action: Investigations and corrective orders

Data subject claims: Individual lawsuits or administrative complaints

Contract liability: Indemnities to partners or customers

Reputational harm: Loss of customer trust and business

Operational costs: Incident response and remediation expenses

Common Preparation Errors to Avoid

Using vague lawful-basis language such as 'business purposes' without explaining specific processing activities, undermining the declaration's evidentiary value and increasing compliance risk.
Failing to document international transfer safeguards or relying on implied safeguards, which can trigger enforcement actions when EU personal data moves outside adequacy zones.
Collecting signatures from individuals without verified authority for the entity, causing contracts and declarations to be unenforceable or disputed in audits.
Not retaining an immutable audit trail that links each signature to an identity, timestamp, and IP address, which weakens proof of consent or attestation.

Key Deadlines and Timeframes to Observe

Track statutory response times and retention triggers to avoid penalties and to ensure records meet regulatory expectations.

Data Subject Requests:

Respond within 30 days under GDPR; extensions allowed in complex cases

Record Retention Minimum:

Keep related financial records at least 3 years per IRS guidance

HIPAA Retention:

Retain healthcare records six years (45 CFR §164.530(j))

Audit Availability:

Keep signed declaration accessible and exportable for regulator review

Signature Timelines:

Ensure signatures are dated in MM/DD/YYYY format and retained with audit trail

Milestone Timeline for Completing a Declaration

Follow these numbered stages to ensure timely review, signature, and archival of the declaration.

01

Draft and Verify

Compile facts, identify lawful bases, and attach exhibits for review.

02

Legal and Privacy Review

Obtain counsel sign-off and finalize transfer mechanisms and safeguards.

03

Signatures Collected

Capture authorized signatures via compliant e-signature with audit trail.

04

Archive and Monitor

Store signed record securely and monitor for changes or DSARs.

eSignature Pricing and Feature Comparison for Executing the Declaration

Compare baseline plans and key capabilities across vendors; signNow is listed first per comparison conventions used here.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently Asked Questions and Troubleshooting

Answers to common questions about legal effect, signatures, retention, and cross-border considerations when using a GDPR declaration.

Need help? Contact support

Is an e-signed GDPR declaration legally valid?
Yes. In the United States, electronic signatures that meet the ESIGN Act (15 U.S.C. ch. 96) and state UETA requirements are legally valid. For cross-border compliance, ensure the signature method meets the receiving EU authority's evidentiary expectations.
When should I use a notarized version?
Notarization is only necessary when a receiving party, local law, or a related filing requires it. For deeds, some states mandate notary and witnesses; otherwise, a tamper-evident e-signed PDF with audit trail is typically sufficient.
How long must I retain the signed declaration?
Retain for the active processing term plus an additional period aligned with federal and industry rules: at least three years for general financial records and six years for HIPAA-related records (45 CFR §164.530(j)).
Can a U.S. company be fined under GDPR?
Yes. U.S. entities that process EU personal data and fall under GDPR jurisdiction can face administrative fines and enforcement by EU supervisory authorities, including significant penalties for serious infringements.
What if a signer lacks authority?
If a signatory lacks authority, the declaration may be unenforceable. Confirm signatory authority in the signature block and maintain organizational delegation or resolution documents where necessary.
How do I respond to a data subject access request?
Document the request, verify the requestor's identity, locate relevant records including the declaration, and respond within the 30-day GDPR deadline unless a valid extension is applied.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now