Your privacy system set up and maintained
A client sends you a data processing agreement and asks for your signature. Twelve pages, full of references to statutory articles, and you don't want to keep the customer waiting. In the knowledge base, each clause explains what usually belongs in such an agreement, what to watch out for, and what you need to document yourself after signing.
Free, no account needed, with the source in the law for every answer.
What entrepreneurs say about this
"We're too small, this is for large companies"
Understandable, because that's how it's written about. Yet the GDPR applies to everyone who processes personal data — including a freelancer with a customer database. What differs is not whether it applies, but how much work it is.
What applies to my business →"We have a privacy notice, so that's taken care of"
That notice is really needed, and it's good that you have it. But it's just one of the obligations. The others — a register of what you process, agreements with your suppliers, and a procedure for if something goes wrong — are precisely the things an auditor will ask about.
What else is required →"Nothing has ever happened with us"
That's probably true, and we're not going to scare you with penalty amounts. In practice, the question rarely comes from the regulator: it comes from a customer asking for proof, or from a laptop left on the train.
Should I report this? →What you'll find in the knowledge base
One question per topic, answered in plain language, with the article underneath that the answer comes from. No summary of the entire regulation and no step-by-step guide that doesn't quite fit your situation.
Each topic shows the date of the last review. If anything changes at the Data Protection Authority or at the European supervisors, the topic changes too — and you'll see that in the date.
Why you can check us
Below each topic is where it comes from: the article from the General Data Protection Regulation itself, and where applicable the explanation from the Dutch Data Protection Authority or the guidelines from the European supervisory authorities (EDPB). We follow those sources and update a topic as soon as something changes — with the date of the last check, so you can see how current it is.
The texts are written with AI based on those sources, go through a technical review that checks every statement against its source, and are approved by a human before publication. That's stated not because it's required, but so you can verify how a text came about. See how we work.
What this is not: we do not provide legal advice and do not assess your situation. The check on a data processing agreement shows what deviates from what is customary — never whether you should sign. The decision tree for a data breach guides you through the questions the law asks; you decide whether to report. We are not a certification mark and not a Data Protection Officer. For an assessment of your own situation, consult a lawyer or the Dutch Data Protection Authority.
Latest articles
Can I handle a data breach myself?
Assessing and handling a data breach can largely be done yourself, provided you follow the GDPR steps and document what you have done
Read more →Data subject requests: what is changing this year?
The rights of customers and employees to access or deletion have been established in the GDPR for years, but the way companies are implementing them
Read more →What is the most common mistake when using AI tools in the workplace?
The most common mistake is that employees paste personal data into an AI tool without the company knowing which tool it is, wh
Read more →Start with the question you have now
Look up your situation and read in plain language what is expected of you.
Go to the knowledge base