GDPR compliance generates a significant amount of documentation — privacy policies, breach notification letters, impact assessment reports, consent forms, and more. Creating these documents from scratch is time-consuming and error-prone. GDPR4All's Document Generator solves this by providing nine document templates that pull data directly from your compliance records, producing professionally structured documents that you can review, customise, and approve.
Document Templates
GDPR4All includes nine document types, each designed for a specific compliance purpose:
Privacy Policy
A comprehensive privacy policy covering how your organisation collects, uses, stores, and shares personal data. The generated document draws on your ROPA entries to describe processing activities, lawful bases, data categories, retention periods, and data subject rights. This is typically published on your website and shared with customers.
Breach Notification
A formal notification letter to the supervisory authority or affected individuals following a data breach. The template pulls details from a specific breach record — what happened, what data was affected, how many individuals were impacted, and what measures have been taken. This ensures consistency between your internal breach record and external communications.
DPIA Report
A structured report summarising a Data Protection Impact Assessment. The template includes the assessment scope, processing description, risk items with their scores and mitigation measures, the overall risk level, and the approval decision. This document is suitable for sharing with the supervisory authority if consultation under Article 36 is required.
Consent Form
A template for obtaining consent from data subjects. It includes clear descriptions of the purpose, the data to be collected, the rights of the individual, and instructions for withdrawing consent. You can generate this for a specific consent purpose and tailor the language to your audience.
Data Subject Response
A formal response to a Data Subject Request (DSR). The template is linked to a specific DSR record and includes the type of request, what information or actions were provided, and the relevant legal references. Using a generated template ensures your responses are thorough and consistent.
Employee Privacy Notice
A privacy notice specifically designed for your employees, explaining how the organisation processes their personal data in the context of employment — recruitment, payroll, performance management, health and safety, and other HR activities. This document is typically provided to employees at the start of employment and updated as processing activities change.
Cookie Policy
A detailed cookie policy for your website, explaining what cookies and similar technologies are used, their purposes, and how visitors can manage their preferences. The generated document covers strictly necessary cookies, analytics cookies, marketing cookies, and third-party cookies.
Vendor DPA (Data Processing Agreement)
A Data Processing Agreement between your organisation and a third-party vendor that processes personal data on your behalf. The template is linked to a specific Vendor DPA record in the Vendor Management module and includes the subject matter of processing, the types of data involved, the duration, the obligations of the processor, and the technical and organisational measures in place. This is a critical document under Article 28.
Custom
A free-form document for any compliance-related purpose not covered by the other templates. Start with a blank document and use the markdown editor to create whatever you need — internal policies, procedure manuals, training materials, or anything else.
Generating Documents from Compliance Data
The real power of the Document Generator lies in its ability to pull data directly from your other compliance modules. When you create a new document:
- Select the document type — choose from the nine templates listed above.
- Select the source record — for most document types, you will be prompted to select the specific compliance record to generate from. For example, when generating a Breach Notification, you select which breach incident to use as the source. When generating a Vendor DPA, you select which vendor agreement to base it on.
- Generate — GDPR4All populates the document template with data from the selected source record. The generator pulls in names, dates, descriptions, risk levels, processing activities, and other relevant fields automatically.
- Review and customise — the generated content appears in the markdown editor, where you can make any adjustments needed.
Some document types are tenant-wide — they apply to your entire organisation rather than a specific record. Privacy Policies, Employee Privacy Notices, and Cookie Policies fall into this category. For these types, no source record selection is needed; the generator pulls from your overall organisation profile and ROPA entries.
Live Context Messages
When selecting a document type in the generation modal, GDPR4All displays a context message explaining what data will be used and from which module. If no source records are available (e.g., you try to generate a Breach Notification but have no breach records), the generate button is disabled with an explanation of what you need to create first.
The Markdown Editor
Documents in GDPR4All are created and edited using a built-in markdown editor with two modes:
Edit Mode
Write and modify your document using standard markdown syntax. The editor supports:
- Headings — use
#,##,###for different heading levels. - Bold and italic text — use
**bold**and*italic*. - Lists — both bulleted (
-) and numbered (1.) lists. - Tables — standard markdown table syntax for structured data.
- Blockquotes — use
>for quoted text or important callouts. - Horizontal rules — use
---to separate sections.
Preview Mode
Switch to preview mode to see how your document will look when rendered. The preview uses a clean, professional layout that is suitable for printing or sharing as a PDF. This is especially useful for reviewing generated documents before sending them through the approval workflow.
Working with Documents
Editing Restrictions
Documents can only be edited while they are in Draft status. Once a document has been submitted for review or approved, its content is locked to preserve its integrity. If you need to make changes to an approved document, the approval workflow allows for rejection back to Draft status, where edits can be made before resubmission.
Versioning Through the Workflow
While GDPR4All does not maintain a version history of document edits, the approval workflow effectively creates checkpoints. Each time a document moves through Draft, Under Review, Approved, Final, and Archived, the transition is recorded with a timestamp and the user who initiated it. This provides a clear audit trail of the document's lifecycle.
Tips for Effective Document Management
- Customise generated content — the templates provide an excellent starting point, but every organisation is different. Review the generated text carefully and adjust it to reflect your specific circumstances, terminology, and processes.
- Keep policies current — privacy policies, cookie policies, and employee privacy notices should be reviewed and updated whenever your processing activities change. A privacy policy that does not reflect your current data practices is worse than useless — it is misleading.
- Use the Vendor DPA template for every processor — Article 28 requires a written contract with every processor. Generate a DPA from the template for each vendor and customise it to the specific processing arrangement.
- Generate reports for audits — before an audit or compliance review, generate DPIA Reports for your key assessments and Data Subject Responses for completed DSR requests. Having these documents ready demonstrates preparedness and accountability.
- Start with the Privacy Policy — if you are new to the platform, generating a Privacy Policy is an excellent way to validate your ROPA. The generated policy will reflect your documented processing activities, so any gaps or inaccuracies in the policy highlight gaps in your ROPA.
- Link documents to their source — the connection between a generated document and its source record creates a traceable chain. If a supervisory authority asks about a breach notification, you can trace it back to the breach record, which links to the affected processing activities in your ROPA.
The Document Generator transforms your structured compliance data into polished, professional documents. Combined with the approval workflow, it ensures that every document your organisation produces is accurate, reviewed, and accountable.