Gdpr Privacy Notice Eu Oliver Schmidt Prietz

Pan-EU GDPR Privacy Notice Generator

Generate jurisdiction-aware, GDPR-compliant privacy notices as professional .docx documents.

Workflow Overview

1. SCOPE    → Notice type, jurisdiction(s), template choice
2. INTAKE   → Type-driven collection: controller info, data inventory, legal bases
3. DRAFT    → Generate notice from template + type profile + collected info
4. VERIFY   → Art. 13/14 compliance check + type-specific checks + AI Act check
5. DELIVER  → .docx output via docx skill

Step 1: Scope, Notice Type & Template Selection

Determine Notice Type (FIRST QUESTION)

Before anything else, determine what type of privacy notice is needed. Load references/NOTICE_TYPES.md and ask:

"What type of privacy notice do you need?"

The selected type determines:

• Which sections to include/skip in the final document
• Which data categories to probe during intake
• Which legal bases are most likely
• Which type-specific intake questions to ask
• Which retention defaults apply

Refer to references/NOTICE_TYPES.md for the full section map, data profile, legal bases, intake questions, and retention defaults for each type.

Determine Jurisdiction

Ask which countries/markets the service targets. Load the appropriate reference:

For multi-jurisdiction services, load all relevant files and note where requirements differ (e.g., children's age thresholds, DPO thresholds, retention rules).

Template Selection

Ask the user:

"I will draft the privacy notice as a professional .docx document. Do you have an existing template or privacy notice I should use as a base? If not, I will use one of our pre-built templates."

references/templates.md includes: 13-section structure, Art. 21 objection box (visually highlighted), purposes/retention table, cookie table, AI/automated decision-making section, children's data section, proper header/footer with page numbers, A4 formatting, TOC, and full translations for DE, FR, and EN. Select the language matching the target jurisdiction.

If user provides a template: faithfully preserve its structure and validated wording. Only replace placeholders and adapt to the specific case. Do NOT rewrite validated legal language.

Multi-Language Decision Tree

If the service targets multiple jurisdictions or language groups, determine the language approach:

Template handling for bilingual documents:

• Use the primary-language template as the structural base
• Ensure both language versions contain all mandatory disclosures (a translation gap = a compliance gap)
• Mark the governing language version explicitly (e.g., "In case of discrepancies, the [German/French] version shall prevail.")

Multi-language verification checklist (add to Step 4 if applicable):

• All mandatory Art. 13/14 disclosures present in each language version
• Governing version clearly identified
• Legal terminology correctly translated (not machine-translated without review)
• Supervisory authority information correct for each jurisdiction
• Jurisdiction-specific requirements addressed in the relevant language version

Platform Sub-Type (Website/App type only)

If the notice type is Website / App, further classify the platform to anticipate data categories. See references/NOTICE_TYPES.md → "Website / App" → "Sub-Types & Data Profiles" for details.

Step 2: Information Intake

Collect ALL information before drafting. Use the type profile from references/NOTICE_TYPES.md to guide the intake — each type pre-defines likely data categories, legal bases, and type-specific questions.

Ask in logical groups, not all at once. Start with Group A (always), then use the type profile to determine which categories to probe and which type-specific questions to ask.

Group A — Controller Identity

• Company name, legal form, registration number
• Registered address
• Legal representative (name + title)
• Contact email + phone
• DPO appointed? → Contact details (use functional email)

Group B — Data Inventory

For each collection point (forms, account creation, purchase, cookies, app usage):

• What data is collected?
• Is it mandatory or optional?
• What is the source (direct from user, third party, automated)?

Categories to probe:

• Identity: name, email, phone, address, date of birth, photo
• Account: credentials, preferences, settings, activity history
• Technical: IP, device ID, browser fingerprint, logs
• Browsing: pages visited, clicks, session duration, referrer
• Transaction: orders, payment method (via provider), invoices
• Communication: messages, support tickets, comments
• Special categories (Art. 9): health, biometric, political, religious, sexual orientation, ethnic origin, trade union, genetic — If any Art. 9 data is identified: consult EU_COMMON.md → "Special Category Data (Art. 9)" for the full intake protocol. Determine the Art. 9(2) exception for each category, confirm the dual legal basis (Art. 6 + Art. 9(2)), and document additional safeguards. Common triggers by notice type: Employee (church tax, disability, sick leave, union dues), Applicant (disability, health, religion), B2C (health data for pharmacy/insurance/fitness).
• AI-related: inputs to AI systems, AI-generated outputs, automated scores/decisions

Group C — Purposes & Legal Bases

For each processing activity, determine the legal basis. Reference EU_COMMON.md for guidance.

Present as a table for the user to confirm:

Group D — Recipients & Transfers

• Hosting provider + location
• Payment processor
• Analytics tools
• Email/marketing tools
• CRM / support tools
• AI/ML service providers (e.g., OpenAI, Google AI, Anthropic)
• Any other processors
• Transfers outside EU/EEA → which countries, which mechanism (adequacy, SCCs, DPF, BCRs)

DPA / Art. 28 Cross-Reference — For each processor identified:

• Verify a Data Processing Agreement (Art. 28 GDPR) is in place. If not, flag as a compliance gap requiring remediation before the notice is finalized.
• What to disclose in the notice: processor name (or category), purpose, location, transfer mechanism. Do NOT include DPA terms, sub-processor lists, or TOMs in the privacy notice — these belong in the Art. 28 agreement.
• What NOT to disclose: specific technical/organizational measures (Art. 32), sub-processor chains, pricing, SLA details.
• If the user confirms no DPA exists for a processor: note this in the summary and recommend immediate remediation. The privacy notice should still name the processor/category but add a note that the controller is in the process of formalizing the agreement.
• Joint controllership (Art. 26): if applicable, the arrangement's essence must be disclosed in the notice, including respective responsibilities and the contact point for data subjects.

Group E — Cookies & Tracking

• Cookie categories used (essential, analytics, marketing, social)
• Specific tools (Google Analytics, Meta Pixel, Matomo, HubSpot, etc.)
• CMP solution (Usercentrics, Cookiebot, Axeptio, Didomi, Borlabs, etc.)
• Server-side tracking? Fingerprinting?
• Cookie lifespans

Group F — AI & Automated Processing

If the service uses AI/ML:

• What AI systems are used and for what purpose?
• Are decisions solely automated or human-in-the-loop?
• Do decisions produce legal or similarly significant effects (Art. 22)?
• Is user data used for model training?
• AI Act classification: prohibited / high-risk / limited-risk / minimal-risk?

Group G — DPIA Indicators (Art. 35 GDPR)

Check whether a Data Protection Impact Assessment may be required. If 2 or more of the following indicators apply, inform the user and recommend a DPIA as a separate deliverable:

1. Systematic evaluation/scoring of individuals (profiling, credit scoring, performance reviews)
2. Automated decision-making with legal or similarly significant effects (Art. 22)
3. Systematic monitoring of a publicly accessible area (CCTV, Wi-Fi tracking)
4. Special category data or criminal offence data processed at scale (Art. 9/10)
5. Large-scale processing of personal data (high volume, broad geographic scope, many data subjects)
6. Matching or combining datasets from different sources in ways data subjects would not reasonably expect
7. Vulnerable data subjects (employees, children, patients, elderly)
8. Innovative use of technology (biometrics, AI/ML, IoT, blockchain for personal data)

If 2+ indicators are flagged:

• Inform the user: "Based on the processing activities described, a Data Protection Impact Assessment (DPIA) under Art. 35 GDPR appears to be required."
• Explain the notice implications: the privacy notice should reference that a DPIA has been conducted (without disclosing the DPIA content itself)
• Recommend: "A DPIA is a separate compliance exercise and should be conducted before the processing begins. This privacy notice skill can draft the notice, but the DPIA should be prepared as a standalone document."
• Check national mandatory DPIA lists (DE: DSK-Liste; FR: CNIL list of processing operations requiring DPIA)

Summary Before Drafting

After collection, produce a structured summary for user confirmation:

NOTICE TYPE: [Website / Applicant / Employee / B2B / B2C / Combined]
CONTROLLER: [Name, form, address]
JURISDICTION(S): [Countries]
PLATFORM: [Type / Sub-type if website]
DPO: [Yes/No + contact]
DATA CATEGORIES: [List by collection point]
PURPOSES + BASES: [Table]
PROCESSORS: [List with locations]
TRANSFERS: [Countries + mechanisms]
COOKIES: [Categories + tools + CMP — if applicable per type]
AI PROCESSING: [Yes/No + details]
RETENTION: [Key periods — cross-check with type defaults]
SPECIFICS: [Anything unusual]
SECTIONS TO INCLUDE: [Based on type section map]
SECTIONS TO SKIP: [Based on type section map]

Confirm with user before proceeding to draft.

Step 3: Draft the Notice

Section Selection by Type

Use the section map from references/NOTICE_TYPES.md for the selected notice type. Only include sections marked ✅ or ⚠️ (if applicable). Skip sections marked ❌. This avoids irrelevant content (e.g., cookie tables in an applicant notice).

For combined notices covering multiple audiences, see references/NOTICE_TYPES.md → "Combined Notices" for structural options (single comprehensive, separate, or layered).

Standard Structure (full — adapt per type)

PRIVACY NOTICE / DATENSCHUTZERKLÄRUNG / POLITIQUE DE CONFIDENTIALITÉ
[Company Name]
Last updated: [DATE]

1. WHO WE ARE (Controller identity + DPO)
2. WHAT DATA WE COLLECT (by category, with source + mandatory/optional)
3. WHY WE PROCESS YOUR DATA (purposes + legal bases table, incl. retention per purpose)
4. WHO RECEIVES YOUR DATA (recipients + processors)
5. INTERNATIONAL TRANSFERS (countries + safeguards)
6. HOW LONG WE KEEP YOUR DATA (retention table — can be merged with section 3)
7. YOUR RIGHTS (all applicable rights + exercise procedure)
8. COOKIES & TRACKING (categories + management + CMP reference)
9. AI & AUTOMATED DECISIONS (if applicable — Art. 22 + AI Act)
10. DATA SECURITY (general measures, no sensitive technical details)
11. CHILDREN'S DATA (if applicable — age threshold + mechanism)
12. CHANGES TO THIS NOTICE (notification method)
13. CONTACT (email + postal + form link)