Templates & operational documents

A Word privacy notice you can adapt for a website or service. It lists typical GDPR notice topics so you can fill in your own processing. Counsel should confirm lawful bases, recipients, and retention before you publish it.

An Excel register of processing activities (ROPA-style). Add your systems, purposes, and retention periods. It does not inventory your estate for you.

A Word checklist of GDPR program tasks, from records of processing to incident handling. Use it to see what is still blank. Completing the list is not a certification and does not by itself prevent a fine.

A Word data-protection policy covering roles, principles, and handling of personal data. Map it to your DPO or privacy lead. It is not a substitute for a DPIA or a processing contract.

A Word information-security policy that you align with your controls and GDPR security duties. Name your tools and owners. It does not implement those controls.

A Word form for people who ask you to erase their data. Log the request and the decision. Erasure still depends on whether a legal exception applies.

A PowerPoint quiz on healthcare privacy habits, with answer notes for the facilitator. Use it after a session. It is a training aid, not a HIPAA or GDPR audit.

A Word checklist to help you decide whether a DPIA is likely required. Answer the questions for the processing in front of you. A “yes” is a prompt to assess, not a completed DPIA.

A Word guide for healthcare staff posting on social media. It flags patient confidentiality and typical GDPR issues. Local professional rules still apply.

A Word form asking to use someone’s name or image on social channels. State the accounts and the duration. Platform terms and employment rules still sit with you.