Data protection is simpler than it sounds once you know what personal data you hold. Start with the guidance, fill in one register, write the privacy notice from it, and use the rest of the toolkit as and when you need it.

Logo Update Service

Download the files with your company name and logo already added!
Document Preparation available with all document toolkits.

Need Help Implementing?

If you'd rather have it done for you, our Personal Data Register and Privacy Notice Preparation service prepares the register and privacy notice with you, and our remote support services can help with the rest of your data protection arrangements.

ISO Update Service

To keep up to date with any changes to the ISO standards or alphaZ documents updates we have a free email update service.

How to Download

To get access to this toolkit please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files. The toolkit is downloaded as a single archive folder (.zip).

GDPR / Data Protection Toolkit

Registers, Forms, Policies, Procedure and Guidance for Documenting How You Collect and Process Personal Data

This toolkit includes the document templates needed to review and document the personal data your organisation collects and processes, and to prepare the privacy notices that tell people about it. It gives you a personal data register to act as your record of processing activities (RoPA), a data protection procedure, public policies and privacy notices, forms for requests, breaches, impact assessments and processing agreements, audit checklists, and staff guidance.

The arrangements needed vary a great deal from one organisation to another. Where very little personal data is processed, a register and a single privacy notice may be all that is needed. Organisations that process special category or criminal offence data, or a lot of personal data, will use more of the toolkit.

AI Runs Through the Whole Toolkit

AI tools are part of everyday office work - writing and email assistants, meeting note-takers, website chatbots, and AI features built into HR, CRM and accounts software. Where they touch personal data, the organisation is still responsible for it. The toolkit covers this throughout:

• The personal data registers record AI use against the data: which tools and providers, and where AI is not permitted
• Retention covers every copy, including those held by AI service providers
• The procedure sets out how AI tools are approved before personal data is used with them, and what meaningful human review of an automated decision involves
• The impact assessment prompts for AI and for software that scores, ranks or filters people
• The processing agreement covers sub-processors including AI service providers
• The privacy notices tell people that AI is used, and how
• The compliance and audit checklists include AI use and automated decisions

Who Should Use this Toolkit

• Organisations reviewing and updating their personal data records and privacy notices
• New companies setting up data protection documentation from the start
• Organisations introducing AI tools that handle personal data
• Consultants reviewing personal data and privacy with clients

Using the GDPR Toolkit

The toolkit includes the GDPR Toolkit Guidance, which takes you through four steps: review the documents, review the personal data you hold (including AI tools), select and prepare the documents you need, and share and communicate the privacy notices.

Choosing a register. Several documents can hold the record of processing, and only one needs to be kept up to date - the F-IMS24 Personal Data Register by data category (the usual starting point), the F-IMS30 Record of Processing Activities Register by processing activity, or the ER21 Personal Data Register in Excel where special category data is processed. The F-Q99 Record of Processing Form describes a single complex activity in full, and the P-26 Privacy Policy can carry the record as an appendix for organisations that prefer one combined document.

Optional policies. The PP-1-16 Data Protection Policy Procedure contains the retention, breach and subject access request content in full, so the P-91, P-92 and P-93 policies are optional - use them where a standalone, shareable policy on one of those subjects is wanted.

Files included with this Toolkit

Sample Data for Subscribers

Completed examples of certain registers and forms are available with an alphaZ subscription, including a worked example of the F-IMS24 personal data register with AI written into every row, and a completed F-Q99 record of processing based on recruitment.