Do U.S. companies need a GDPR notice?

Yes if they process or offer goods or services to individuals in the EU/EEA or monitor their behavior there. The notice must describe processing, legal bases, transfer mechanisms, retention, and data subject rights and be easily accessible.

What must the notice include under GDPR?

At minimum: purposes and lawful bases; categories of personal data; recipients; international transfer mechanisms; retention periods; data subject rights; how to exercise rights; complaint supervisory authority contact; and, where relevant, automated decision-making information.

How must I provide the notice to data subjects?

Provide the notice at or before the time personal data are collected from the data subject. If data are obtained indirectly, provide the notice within a reasonable period and no later than one month after collection.

Are special category data treated differently?

Yes. Processing special categories (sensitive) requires a specific lawful basis and often additional safeguards. The notice must explicitly state when sensitive data are processed and explain the legal basis, purpose, and any additional protections applied.

How do international transfers work?

Explain whether data are transferred outside the EEA and identify the transfer mechanism used, such as adequacy decisions, Standard Contractual Clauses (SCCs), Binding Corporate Rules, or derogations. Describe safeguards and where residents can access additional information.

When should I update the notice?

Update the notice whenever processing activities, purposes, legal bases, retention, or transfer practices change. Significant changes should be communicated promptly; minor clarifications may be reflected in the next scheduled privacy update, but documentation of the change is recommended.

Privacy Notice GDPR

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Privacy Notice — GDPR

This Privacy Notice (the Notice) explains how the Data Controller collects, uses, discloses, retains and protects personal data of data subjects in accordance with the General Data Protection Regulation (GDPR). The Controller is accountable for the lawful processing activities described below and remains responsible for ensuring compliance with data protection obligations.

Controller Identification

Controller Legal Name:

Trading or Operating Name (if different) Controller Address Primary Contact for Data Protection Inquiries Data Protection Officer (if applicable)

Purpose and Scope of Processing

The Controller processes personal data for the specific, explicit and legitimate purposes described below. Processing will be limited to what is necessary in relation to each stated purpose.

Scope of Processing

Lawful Basis for Processing

The Controller relies on one or more lawful bases depending on the processing activity. Select all applicable lawful bases and provide any required supporting detail.

Consent (data subject has given clear consent for processing for a specific purpose)

Contract (processing necessary for performance of a contract)

Legal obligation (processing necessary to comply with a legal obligation)

Legitimate interests (processing necessary for legitimate interests pursued by the Controller)

If relying on consent or legitimate interests, describe scope and withdrawal method

Categories of Personal Data

The Controller may collect the following categories of personal data in the course of the stated processing activities.

Recipients and International Transfers

Personal data may be disclosed to third parties where necessary for the purposes set out above. Disclosures are limited to recipients who have an appropriate legal basis and adequate safeguards.

Categories of Recipients

Transfers outside the European Economic Area (EEA)

If transfers occur, identify safeguards and mechanism

Data Retention

Personal data will be retained only for as long as necessary to fulfil the stated purposes and to satisfy legal, regulatory or accounting requirements.

Retention Period or Criteria

Data Subject Rights and How to Exercise Them

Individuals whose personal data is processed under this Notice have rights under the GDPR. The Controller will respond to requests to exercise these rights in accordance with applicable timeframes and procedures.

Right of access

Right to rectification

Right to erasure ('right to be forgotten'), subject to limitations

Right to restriction of processing

Right to data portability

Right to object to certain processing including direct marketing

Right to withdraw consent at any time (where processing is based on consent)

How to Exercise Rights / Contact for Requests

Automated Decision-Making and Profiling

The Controller will disclose whether any processing involves automated decision-making, including profiling, and the logic, significance and envisaged consequences of such processing for the data subject.

Automated decision-making or profiling is used in some processes

If yes, describe logic and consequences

Security of Personal Data

The Controller implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Security Measures

Consequences of Not Providing Data

Where the provision of personal data is a contractual or statutory requirement, failure to provide the requested information may prevent the Controller from entering into the contract or fulfilling legal obligations. In such cases the Controller will explain the consequences of refusal at the point of collection.

Changes to this Notice

The Controller may update this Notice from time to time to reflect changes in processing activities or legal requirements. Material changes will be communicated in a timely manner.

Notice Effective Date:

Governing Law

This Notice and any disputes arising from it shall be governed by the law identified below. The choice of law is without prejudice to mandatory protections afforded to data subjects under applicable local data protection laws.

Entire Notice

This Notice constitutes the entire written statement of the Controller’s data handling practices in respect of the processing activities described herein. To the extent permitted by law, no other verbal or written representations shall override this Notice as to the subject matter herein.

Complaints

Data subjects have the right to lodge a complaint with a competent supervisory authority where they believe their data protection rights have been infringed. The Controller will also seek to resolve concerns raised directly.

Contact for Complaints and Inquiries

Representative Name:

By:

Date:

What a Privacy Notice GDPR is and when it applies

Privacy Notice GDPR explains how an organization collects, uses, discloses, and protects personal data of individuals covered by the EU General Data Protection Regulation (GDPR). For U.S.-based entities that process or offer goods and services to EU/EEA residents, this notice describes processing purposes, lawful bases, categories of personal data, recipients, international transfers, retention periods, data subject rights (access, rectification, erasure, restriction, portability, objection), and supervisory authority contact information. It should be concise, transparent, and provided at or before the point of data collection.

Why a clear GDPR privacy notice matters for U.S. organizations

A clear Privacy Notice GDPR builds trust with EU data subjects, reduces regulatory risk, and documents compliance choices. It clarifies rights and safeguards, supports lawful bases for processing, and provides a public record that supervisory authorities may inspect.

Core elements every professional Privacy Notice GDPR should include

Essential elements that should appear in a professional Privacy Notice GDPR to meet transparency, accountability, and demonstrable compliance expectations across processing activities.

Purposes

Clearly state each processing purpose with sufficient specificity so data subjects understand why data are collected and how those purposes align with services or contractual needs.

Lawful basis

Identify the legal basis for every processing activity, such as consent, contract necessity, legal obligation, vital interests, public task, or legitimate interests with documented balancing tests.

Data categories

Describe categories of personal data collected, including any special categories, and provide examples to make the description meaningful to data subjects and indicate sources and whether data are provided by the data subject or third parties.

Transfers

Explain international transfers, the mechanism relied upon (SCCs, adequacy, BCRs), and additional safeguards such as encryption or contractual restrictions and where to find full transfer documentation or DPO contact for queries.

Rights

List each data subject right, describe how to exercise it, specify any identification required, and state expected response timelines and escalation options including supervisory authority contact details.

Contact

Provide controller contact details, DPO information when applicable, and a clear complaint route including supervisory authority contact and any internal escalation points and timelines for response.

Step-by-step: prepare and publish a compliant Privacy Notice GDPR

Follow these sequential steps to prepare and distribute a compliant Privacy Notice GDPR for affected data subjects.

01

Identify scope: Determine which processing and which individuals are covered.
02

Draft notice content: Include purposes, lawful bases, retention, and rights.
03

Review legal bases: Match each purpose to a lawful basis and record rationale.
04

Publish and distribute: Provide at point of collection and online where relevant.

Configure an online workflow for notice delivery and consent capture

Configure an online workflow to present the Privacy Notice GDPR, capture consent, and store evidence of receipt and preference settings.

Field	Configuration
Notice placement	Web form, app banner, or contract
Consent capture	Explicit opt-in checkbox with timestamp
Record retention	Store immutable PDF and audit trail
Access controls	Restrict editing to privacy team
Notifications	Notify users of material changes

Technical considerations for e-delivery, storage, and authentication

Technical considerations for e-delivery, secure storage, and signer authentication when issuing and recording a Privacy Notice GDPR for impacted individuals.

File formats: PDF, DOCX, HTML supported
Integrations: Works with Salesforce and Google Workspace
Authentication: Email, SMS code, or stronger KBA

Typical delivery channels and filing destinations

Routing and filing options for a Privacy Notice GDPR depend on the collection channel, data flows, and recipient jurisdictions.

Point-of-collection: Display notice at web forms and physical intake.
Privacy policy page: Publish a comprehensive notice on the website.
Contract annex: Embed notice language in contractual documents.
Email disclosure: Send notice when collecting data via email.

Timing, statutory windows, and performance expectations

Key timing requirements and statutory response windows associated with GDPR notices and related subject requests.

When to provide the notice:

At or before collection; if indirect, within one month.

SAR response timeframe:

Respond to subject access requests within 30 days

Breach notification:

Notify supervisory authority within 72 hours of awareness

Notice updates:

Publish changes promptly; communicate material changes to subjects

Retention review interval:

Review retention policies at least annually

Vendor pricing and feature snapshot for notice delivery and e-signature workflows

Comparison of typical vendor pricing and basic features relevant to delivering a Privacy Notice GDPR and managing e-signature workflows.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Verify with vendor	Verify with vendor	Verify with vendor

Security controls and technical safeguards to reference

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest

Access Controls: Role-based access and audit logs

Authentication: Multi-factor authentication for administrators

Data Transfers: SCCs, adequacy, or BCRs used

Retention: Policies aligned to legal requirements

Incident Response: Breach notification and remedial controls

Regulatory and operational risks from an incorrect or missing notice

Regulatory fines: Up to four percent of annual worldwide turnover

Corrective orders: Mandatory processing changes or bans

Private claims: Compensation claims by data subjects

Reputational harm: Loss of customer trust and brand damage

Operational disruption: Required audits and remediation

Cross-border risks: Blocking notices and transfer restrictions

Common preparation mistakes to avoid

Using broad or vague purposes such as 'business purposes' without mapping to a lawful basis, which hampers accountability and increases regulator scrutiny.
Failing to disclose international transfers or the legal mechanism (SCCs, adequacy) used, leaving subjects unable to assess cross-border data protections.
Not updating the notice after changing processing activities, leading to noncompliance and exposing the organization to complaints or enforcement.
Providing the notice too late — after data collection — which violates the timing requirements and undermines consent validity where consent is relied upon.

Practical checks to keep your notice accurate and defensible

Practical tips to ensure your Privacy Notice GDPR is accurate, accessible, and defensible during audits or subject requests.

Use plain language and clear structure

Write the notice using plain language at a reading level accessible to your audience. Structure sections with headings for purposes, rights, transfers, and contact details. Avoid legalese and provide translations where you target non-English speakers.

Document lawful-basis rationale

Keep an internal record explaining why each lawful basis applies. For legitimate interests, include a documented balancing test; for consent, retain proof of specific, informed consent and timestamps and the context of collection.

Maintain auditable records

Keep immutable copies of each notice version, distribution logs, consent records, and change history. Store timestamps, IP addresses, and recipient identifiers to evidence disclosure timing and who received which version.

Coordinate cross-functional reviews

Have privacy, legal, product, and security teams review notices regularly. Include DPO or counsel sign-off for high-risk processing and document approval dates to show governance and decision-making accountability and record meeting minutes.

Practical examples of notices in use

Real-world examples show how organizations implement Privacy Notice GDPR practices alongside eSignature and digital delivery workflows.

Martin Properties (Real Estate)

Martin Properties uses online notices and in-application disclosures to notify tenants and applicants about data processing during leasing and property management.

Integrated notice at point-of-application and consent capture.
This approach reduced questions from applicants, created an auditable trail of who received which notice, and accelerated processing while preserving tenant privacy and meeting cross-border transfer disclosures for centralized management systems.

Fertility Centers of Illinois (Healthcare)

Fertility Centers of Illinois integrates a GDPR notice with patient intake forms and documents data sharing with laboratories and international partners.

Consent recorded alongside medical forms.
By combining clear notices, explicit consent for sensitive health data, and secure transfer mechanisms, the organization documents lawful bases and simplifies responding to subject access requests while maintaining HIPAA-required safeguards.

Frequently asked questions about the Privacy Notice GDPR

Answers to common questions about preparing, delivering, and updating a Privacy Notice GDPR for U.S.-based organizations processing EU personal data.

Need help? Contact support

Do U.S. companies need a GDPR notice?
Yes if they process or offer goods or services to individuals in the EU/EEA or monitor their behavior there. The notice must describe processing, legal bases, transfer mechanisms, retention, and data subject rights and be easily accessible.
What must the notice include under GDPR?
At minimum: purposes and lawful bases; categories of personal data; recipients; international transfer mechanisms; retention periods; data subject rights; how to exercise rights; complaint supervisory authority contact; and, where relevant, automated decision-making information.
How must I provide the notice to data subjects?
Provide the notice at or before the time personal data are collected from the data subject. If data are obtained indirectly, provide the notice within a reasonable period and no later than one month after collection.
Are special category data treated differently?
Yes. Processing special categories (sensitive) requires a specific lawful basis and often additional safeguards. The notice must explicitly state when sensitive data are processed and explain the legal basis, purpose, and any additional protections applied.
How do international transfers work?
Explain whether data are transferred outside the EEA and identify the transfer mechanism used, such as adequacy decisions, Standard Contractual Clauses (SCCs), Binding Corporate Rules, or derogations. Describe safeguards and where residents can access additional information.
When should I update the notice?
Update the notice whenever processing activities, purposes, legal bases, retention, or transfer practices change. Significant changes should be communicated promptly; minor clarifications may be reflected in the next scheduled privacy update, but documentation of the change is recommended.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now