{
"name": "Visual Privacy Icons",
"version": "2.0",
"licence": "CC BY 4.0",
"categories": [
{
"id": "data",
"name": "Data collected",
"short": "What",
"colour": "#5B9BFF",
"blurb": "The kinds of personal data an organisation collects or holds. GDPR Art 14(1)(d) and APP 1.4(a) require categories of data to be stated; CCPA §1798.130 requires categories of personal information and sensitive personal information to be listed.",
"law": "GDPR Arts 4(1), 9, 10, 14(1)(d); UK GDPR (same); Privacy Act 1988 (Cth) APP 1.4(a); Cal. Civ. Code §1798.140(v), (ae)",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/",
"gdprinfo": "https://gdpr-info.eu/art-4-gdpr/",
"g16": "",
"id_full": "cat.data",
"file": "icons/cat.data.svg"
},
{
"id": "source",
"name": "How it is collected",
"short": "Source",
"colour": "#38C3DA",
"blurb": "Where the data comes from. GDPR Art 14(2)(f) requires the source to be identified when data are not obtained from the data subject; APP 1.4(b) requires an explanation of how personal information is collected.",
"law": "GDPR Art 14(2)(f); Recital 61; APP 1.4(b), APP 5.2(b)",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/",
"gdprinfo": "https://gdpr-info.eu/art-14-gdpr/",
"g16": "",
"id_full": "cat.source",
"file": "icons/cat.source.svg"
},
{
"id": "purpose",
"name": "Purposes",
"short": "Why",
"colour": "#B48CFF",
"blurb": "Why the data is used. Every purpose must be specified, explicit and legitimate (Art 5(1)(b)) and stated with its lawful basis (Art 13(1)(c)). CCPA requires the business or commercial purpose for each category.",
"law": "GDPR Arts 5(1)(b), 13(1)(c); APP 1.4(c), APP 6; Cal. Civ. Code §1798.100(a)(1)",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/the-principles/purpose-limitation/",
"gdprinfo": "https://gdpr-info.eu/art-5-gdpr/",
"g16": "",
"id_full": "cat.purpose",
"file": "icons/cat.purpose.svg"
},
{
"id": "basis",
"name": "Lawful basis",
"short": "Basis",
"colour": "#FF6FA8",
"blurb": "The Article 6 ground relied on for each purpose, and the Article 9 condition for special category data. Not a concept in the Australian APPs or CCPA, but mandatory in every GDPR-compliant policy.",
"law": "GDPR Arts 6(1), 9(2), 13(1)(c)-(d); UK GDPR Art 6(1)(ea) and Annex 1 (recognised legitimate interests, inserted by the Data (Use and Access) Act 2025)",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/",
"gdprinfo": "https://gdpr-info.eu/art-6-gdpr/",
"g16": "",
"id_full": "cat.basis",
"file": "icons/cat.basis.svg"
},
{
"id": "processing",
"name": "Types of processing",
"short": "How",
"colour": "#FF9450",
"blurb": "What is done with the data. Profiling and automated decision-making carry specific disclosure duties (Art 13(2)(f), Art 22); pseudonymisation and anonymisation change the risk profile and, for anonymous data, take it outside the GDPR altogether (Recital 26).",
"law": "GDPR Arts 4(2), 4(4), 4(5), 13(2)(f), 22, 25, 32; Recital 26",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/automated-decision-making-and-profiling/",
"gdprinfo": "https://gdpr-info.eu/art-22-gdpr/",
"g16": "",
"id_full": "cat.processing",
"file": "icons/cat.processing.svg"
},
{
"id": "sharing",
"name": "Recipients & disclosure",
"short": "Who",
"colour": "#4FD37A",
"blurb": "Who receives the data. Art 13(1)(e) requires recipients or categories of recipients; CCPA additionally requires disclosure of whether data is 'sold' or 'shared' for cross-context behavioural advertising, with an opt-out link.",
"law": "GDPR Arts 4(9), 13(1)(e), 28; APP 6, APP 1.4(c); Cal. Civ. Code §§1798.115, 1798.120, 1798.135, 1798.140(ad), (ah)",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/",
"gdprinfo": "https://gdpr-info.eu/art-28-gdpr/",
"g16": "",
"id_full": "cat.sharing",
"file": "icons/cat.sharing.svg"
},
{
"id": "transfer",
"name": "International transfers",
"short": "Where",
"colour": "#33CDB4",
"blurb": "Whether data leaves the EEA or UK and on what safeguard. Art 13(1)(f) requires the fact of transfer, the safeguard and how to obtain a copy; APP 8 and APP 1.4(f)-(g) require the likelihood of overseas disclosure and the countries, where practicable.",
"law": "GDPR Arts 13(1)(f), 44-49; UK GDPR Arts 44-49 and the ICO International Data Transfer Agreement; APP 1.4(f)-(g), APP 8",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/",
"gdprinfo": "https://gdpr-info.eu/chapter-5/",
"g16": "",
"id_full": "cat.transfer",
"file": "icons/cat.transfer.svg"
},
{
"id": "retention",
"name": "Retention",
"short": "How long",
"colour": "#F2DC6B",
"blurb": "How long data is kept, or the criteria used to decide. Art 13(2)(a) requires the period or the criteria; CCPA regulations require the retention period (or criteria) for each category in the notice at collection.",
"law": "GDPR Arts 5(1)(e), 13(2)(a); APP 11.2; Cal. Civ. Code §1798.100(a)(3)",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/the-principles/storage-limitation/",
"gdprinfo": "https://gdpr-info.eu/art-5-gdpr/",
"g16": "",
"id_full": "cat.retention",
"file": "icons/cat.retention.svg"
},
{
"id": "rights",
"name": "Your rights & controls",
"short": "Rights",
"colour": "#8E9CFF",
"blurb": "What the individual can do. GDPR Arts 15-22 and the right to complain; CCPA adds opt-out of sale/sharing, limitation of sensitive data use and non-discrimination; APP 12-13 give access and correction and APP 1.4(d)-(e) require a complaints process.",
"law": "GDPR Arts 7(3), 13(2)(b)-(d), 15-22, 77; APP 1.4(d)-(e), APP 12, APP 13; Cal. Civ. Code §§1798.105-1798.125, 1798.135",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/",
"gdprinfo": "https://gdpr-info.eu/chapter-3/",
"g16": "",
"id_full": "cat.rights",
"file": "icons/cat.rights.svg"
},
{
"id": "governance",
"name": "Security & accountability",
"short": "Safeguards",
"colour": "#A9B2C3",
"blurb": "Who is responsible and how data is protected: controller identity, DPO, representative, security measures, breach handling, children and policy updates.",
"law": "GDPR Arts 13(1)(a)-(b), 8, 27, 32-35, 37; APP 1, APP 11; Cal. Civ. Code §1798.130(a)(5)",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/",
"gdprinfo": "https://gdpr-info.eu/art-24-gdpr/",
"g16": "",
"id_full": "cat.governance",
"file": "icons/cat.governance.svg"
}
],
"icons": [
{
"id": "data.identity",
"cat": "data",
"name": "Identity data",
"desc": "Name, title, date of birth, username or other identifiers that identify you as a person.",
"snippet": "We collect identity data, such as your [name, title, date of birth and username].",
"law": "GDPR Art 4(1); APP 1.4(a); CCPA §1798.140(v)(1)(A)",
"ccpa_category": "identifiers",
"clause": "We collect identity data, meaning your [identity_items].{if identity_items_more} We may collect other such data in future.{/if}",
"vars": [
{
"name": "identity_items",
"type": "multi",
"label": "Which identity data do you collect?",
"required": true,
"options": [
{
"value": "name",
"label": "Name"
},
{
"value": "title",
"label": "Title"
},
{
"value": "dob",
"label": "Date of birth"
},
{
"value": "username",
"label": "Username"
},
{
"value": "account_number",
"label": "Customer or account number"
},
{
"value": "signature",
"label": "Signature"
},
{
"value": "photo",
"label": "Profile photo"
}
],
"free": true,
"extensible": true
}
],
"conditions": "data.identity",
"asks": {
"step": 3,
"q": "Do you collect names, dates of birth, usernames, or other identifiers?",
"why": "The GDPR requires the categories of personal data only when they come from other sources, but Californian and Australian law require them always.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/data.identity.svg"
},
{
"id": "data.contact",
"cat": "data",
"name": "Contact details",
"desc": "Email address, postal address, telephone number and similar means of reaching you.",
"snippet": "We collect contact details, such as your [email address, postal address and telephone number].",
"law": "GDPR Art 4(1); APP 1.4(a); CCPA §1798.140(v)(1)(A)",
"ccpa_category": "identifiers",
"clause": "We collect contact details, meaning your [contact_items].{if contact_items_more} We may collect other contact details in future.{/if}",
"vars": [
{
"name": "contact_items",
"type": "multi",
"label": "Which contact details do you collect?",
"required": true,
"options": [
{
"value": "email",
"label": "Email address"
},
{
"value": "postal",
"label": "Postal address"
},
{
"value": "telephone",
"label": "Telephone number"
},
{
"value": "mobile",
"label": "Mobile number"
},
{
"value": "messaging",
"label": "Messaging app ID"
},
{
"value": "social_handle",
"label": "Social media handle"
}
],
"free": true,
"extensible": true
}
],
"conditions": "data.contact",
"asks": {
"step": 3,
"q": "Do you collect email addresses, postal addresses, or telephone numbers?",
"why": "The GDPR requires the categories of personal data only when they come from other sources, but Californian and Australian law require them always.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/data.contact.svg"
},
{
"id": "data.credentials",
"cat": "data",
"name": "Account credentials",
"desc": "Passwords, security questions, tokens or other information used to authenticate you.",
"snippet": "We collect account credentials, including your [password (stored in hashed form) and security questions].",
"law": "GDPR Arts 4(1), 32; CCPA §1798.140(ae)(1)(B) (account log-in in combination with a password or credentials is sensitive personal information)",
"ccpa_category": "sensitive personal information",
"clause": "We collect account credentials, meaning your [credential_items].{if password_storage} [password_storage]{/if}",
"vars": [
{
"name": "credential_items",
"type": "multi",
"label": "Which credentials do you collect?",
"required": true,
"options": [
{
"value": "password",
"label": "Password"
},
{
"value": "security_questions",
"label": "Security questions and answers"
},
{
"value": "pin",
"label": "PIN"
},
{
"value": "tokens",
"label": "Login tokens"
},
{
"value": "mfa",
"label": "Multi-factor authentication codes"
},
{
"value": "passkey",
"label": "Passkeys"
}
]
},
{
"name": "password_storage",
"type": "choice",
"label": "How do you store passwords?",
"required": true,
"options": [
{
"value": "hashed",
"label": "Hashed, so we cannot read them",
"text": "We store passwords only in a scrambled (hashed) form that we cannot reverse."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Only choose \"hashed\" if your system never stores the plain password."
}
],
"conditions": "data.credentials",
"asks": {
"step": 3,
"q": "Do people create passwords or other login credentials with you?",
"why": "The GDPR requires appropriate security for personal data, and credentials are sensitive personal information under Californian law.",
"links": {
"gdpr": "https://gdpr-info.eu/art-32-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/passwords-in-online-services/"
}
},
"g16": "",
"file": "icons/data.credentials.svg"
},
{
"id": "data.payment",
"cat": "data",
"name": "Payment & financial data",
"desc": "Card details, bank account numbers, billing address and transaction records.",
"snippet": "We collect payment data, such as your [card number, expiry date, billing address and bank account details]. [Full card numbers are handled by our payment processor and are not stored by us.]",
"law": "GDPR Art 4(1); CCPA §1798.140(v)(1)(B) and §1798.80(e) (customer records); CCPA §1798.140(ae)(1)(B) (financial account or card number in combination with an access code or password is sensitive personal information, reported through governance.ca-sensitive)",
"ccpa_category": "customer records",
"clause": "We collect payment data, meaning your [payment_items].{if card_storage} [card_storage]{/if}",
"vars": [
{
"name": "payment_items",
"type": "multi",
"label": "Which payment data do you collect?",
"required": true,
"options": [
{
"value": "card_number",
"label": "Card number"
},
{
"value": "expiry",
"label": "Card expiry date"
},
{
"value": "billing_address",
"label": "Billing address"
},
{
"value": "bank_account",
"label": "Bank account details"
},
{
"value": "wallet",
"label": "Digital wallet ID, for example PayPal"
},
{
"value": "cardholder",
"label": "Cardholder name"
}
],
"free": true,
"extensible": true
},
{
"name": "card_storage",
"type": "choice",
"label": "Who holds the full card number?",
"required": true,
"options": [
{
"value": "processor",
"label": "Our payment provider, we never store it",
"text": "Our payment provider handles your full card number. We do not store it."
},
{
"value": "token",
"label": "We store a token from our payment provider",
"text": "We store only a token from our payment provider so we can take future payments."
},
{
"value": "stored",
"label": "We store card details ourselves",
"text": "We store your card details so we can take future payments."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Choose \"not stated\" unless you are sure. The policy only claims what you choose."
}
],
"conditions": "data.payment",
"asks": {
"step": 3,
"q": "Do you collect card details, bank details, or billing addresses?",
"why": "Californian law treats card or account numbers combined with access codes as sensitive personal information, which your notice must list separately.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/"
}
},
"g16": "",
"file": "icons/data.payment.svg"
},
{
"id": "data.transactions",
"cat": "data",
"name": "Purchase & transaction history",
"desc": "Products or services bought, orders, subscriptions and invoices.",
"snippet": "We keep records of your [purchases, orders, subscriptions and invoices].",
"law": "GDPR Art 4(1); CCPA §1798.140(v)(1)(D) (commercial information)",
"ccpa_category": "commercial information",
"clause": "We keep records of your [transaction_items].{if transaction_items_more} We may record other transactions in future.{/if}",
"vars": [
{
"name": "transaction_items",
"type": "multi",
"label": "Which transaction records do you keep?",
"required": true,
"options": [
{
"value": "purchases",
"label": "Purchases"
},
{
"value": "orders",
"label": "Orders"
},
{
"value": "subscriptions",
"label": "Subscriptions"
},
{
"value": "invoices",
"label": "Invoices"
},
{
"value": "refunds",
"label": "Refunds and returns"
},
{
"value": "donations",
"label": "Donations"
},
{
"value": "bookings",
"label": "Bookings"
},
{
"value": "fees",
"label": "Membership fees"
}
],
"free": true,
"extensible": true
}
],
"conditions": "data.transactions",
"asks": {
"step": 3,
"q": "Do you keep records of purchases, orders, subscriptions, or invoices?",
"why": "The GDPR requires data categories only when they come from other sources, but Californian law requires them always and calls these commercial information.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/data.transactions.svg"
},
{
"id": "data.demographic",
"cat": "data",
"name": "Demographic data",
"desc": "Age range, gender, language, nationality or similar characteristics that are not special category data.",
"snippet": "We collect demographic data, such as your [age range, gender, language and country].",
"law": "GDPR Art 4(1); CCPA §1798.140(v)(1)(C)",
"ccpa_category": "protected characteristics",
"clause": "We collect demographic data, meaning your [demographic_items].{if demographic_items_more} We may collect other such data in future.{/if}",
"vars": [
{
"name": "demographic_items",
"type": "multi",
"label": "Which demographic data do you collect?",
"required": true,
"options": [
{
"value": "age_range",
"label": "Age range"
},
{
"value": "gender",
"label": "Gender"
},
{
"value": "language",
"label": "Language"
},
{
"value": "country",
"label": "Country of residence"
},
{
"value": "nationality",
"label": "Nationality"
},
{
"value": "marital",
"label": "Marital status"
},
{
"value": "household",
"label": "Household size"
}
],
"hint": "Data revealing racial or ethnic origin, religion, or sexual orientation is special category data, not demographic data.",
"free": true,
"extensible": true
}
],
"conditions": "data.demographic",
"asks": {
"step": 3,
"q": "Do you collect age range, gender, language, nationality, or similar characteristics?",
"why": "The GDPR requires you to collect only the data you need, and Californian and Australian law require you to list the kinds you collect.",
"links": {
"gdpr": "https://gdpr-info.eu/art-5-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/"
}
},
"g16": "",
"file": "icons/data.demographic.svg"
},
{
"id": "data.location-precise",
"cat": "data",
"name": "Precise location",
"desc": "GPS or similar coordinates that locate you within a small radius, typically from a mobile device.",
"snippet": "We collect precise location data from your device [with your permission] [using GPS, Wi-Fi and cell-tower information].",
"law": "GDPR Art 4(1); ePrivacy Directive Art 5(3); CCPA §1798.140(ae)(1)(C) (precise geolocation is sensitive personal information)",
"ccpa_category": "sensitive personal information",
"clause": "We collect precise location data from your device, using [location_tech].{if location_permission} [location_permission]{/if}",
"vars": [
{
"name": "location_tech",
"type": "multi",
"label": "How do you obtain the location?",
"required": true,
"options": [
{
"value": "gps",
"label": "GPS",
"text": "GPS"
},
{
"value": "wifi",
"label": "Wi-Fi",
"text": "Wi-Fi"
},
{
"value": "cell",
"label": "Mobile network cell towers",
"text": "mobile network information"
},
{
"value": "bluetooth",
"label": "Bluetooth beacons",
"text": "Bluetooth beacons"
},
{
"value": "browser",
"label": "Browser geolocation",
"text": "your browser location feature"
}
]
},
{
"name": "location_permission",
"type": "choice",
"label": "Is location collected only after a device or browser permission prompt?",
"required": true,
"options": [
{
"value": "device",
"label": "Yes, only with the device or browser permission",
"text": "We do this only when you allow it in your device or browser settings."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "device"
}
],
"conditions": "data.location-precise",
"asks": {
"step": 3,
"q": "Do you collect precise location, for example GPS coordinates, from devices?",
"why": "The GDPR and ePrivacy rules treat device location as personal data needing clear notice, and it is sensitive under Californian law.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/communications-networks-and-services/"
}
},
"g16": "",
"file": "icons/data.location-precise.svg"
},
{
"id": "data.location-approx",
"cat": "data",
"name": "Approximate location",
"desc": "City- or region-level location inferred from an IP address or postal code.",
"snippet": "We infer your approximate location (city or region) from your [IP address or postal code].",
"law": "GDPR Art 4(1); CCPA §1798.140(v)(1)(G)",
"ccpa_category": "geolocation",
"clause": "We work out your approximate location, meaning your city or region, from your [approx_source].",
"vars": [
{
"name": "approx_source",
"type": "multi",
"label": "What do you infer it from?",
"required": true,
"options": [
{
"value": "ip",
"label": "IP address"
},
{
"value": "postcode",
"label": "Postal code"
},
{
"value": "timezone",
"label": "Time zone setting"
},
{
"value": "dialling",
"label": "Telephone dialling code"
}
]
}
],
"conditions": "data.location-approx",
"asks": {
"step": 3,
"q": "Do you work out a city or region from IP addresses or postal codes?",
"why": "The GDPR treats location data and online identifiers as personal data, and Californian and Australian law require you to list the kinds you collect.",
"links": {
"gdpr": "https://gdpr-info.eu/recitals/no-30/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-information-a-guide/"
}
},
"g16": "",
"file": "icons/data.location-approx.svg"
},
{
"id": "data.device",
"cat": "data",
"name": "Device & technical data",
"desc": "IP address, browser type, operating system, device identifiers, screen size, time zone and log data.",
"snippet": "We automatically collect technical data, including your [IP address, browser type and version, operating system, device identifiers, time-zone setting and other technology on the devices you use].",
"law": "GDPR Art 4(1), Recital 30; CCPA §1798.140(v)(1)(A) (IP address, online identifier), (F)",
"ccpa_category": "internet or network activity",
"clause": "We collect technical data from the device you use, meaning your [device_items].{if device_items_more} We may collect other technical data in future.{/if}",
"vars": [
{
"name": "device_items",
"type": "multi",
"label": "Which technical data do you collect?",
"required": true,
"options": [
{
"value": "ip",
"label": "IP address"
},
{
"value": "browser",
"label": "Browser type and version"
},
{
"value": "os",
"label": "Operating system"
},
{
"value": "device_id",
"label": "Device identifiers"
},
{
"value": "screen",
"label": "Screen size"
},
{
"value": "timezone",
"label": "Time zone setting"
},
{
"value": "language",
"label": "Language setting"
},
{
"value": "logs",
"label": "Crash and log data"
}
],
"free": true,
"extensible": true
}
],
"conditions": "data.device",
"asks": {
"step": 3,
"q": "Do your systems log IP addresses, browser types, device identifiers, or similar data?",
"why": "The GDPR treats online identifiers such as IP addresses and device IDs as personal data, which Californian and Australian law require you to list.",
"links": {
"gdpr": "https://gdpr-info.eu/recitals/no-30/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-information-a-guide/"
}
},
"g16": "",
"file": "icons/data.device.svg"
},
{
"id": "data.cookies",
"cat": "data",
"name": "Cookies & tracking identifiers",
"desc": "Cookie IDs, advertising IDs, pixels, local storage and similar identifiers stored on your device.",
"snippet": "We use cookies and similar technologies that store identifiers on your device. Details of each cookie, its purpose and duration are in our [Cookie Policy].",
"law": "ePrivacy Directive Art 5(3); PECR reg 6 and Sch A1 (UK, from 5 February 2026); GDPR Recital 30; CCPA §1798.140(v)(1)(A) (unique identifiers)",
"ccpa_category": "identifiers",
"clause": "We use [cookie_tech] that store identifiers on your device.{if cookie_detail} [cookie_detail]{/if}",
"vars": [
{
"name": "cookie_tech",
"type": "multi",
"label": "Which technologies do you use?",
"required": true,
"options": [
{
"value": "cookies",
"label": "Cookies",
"text": "cookies"
},
{
"value": "pixels",
"label": "Tracking pixels",
"text": "tracking pixels"
},
{
"value": "local_storage",
"label": "Browser local storage",
"text": "browser local storage"
},
{
"value": "ad_ids",
"label": "Mobile advertising identifiers",
"text": "mobile advertising identifiers"
},
{
"value": "sdk",
"label": "App SDKs",
"text": "software development kits in our app"
}
]
},
{
"name": "cookie_detail",
"type": "choice",
"label": "Where are the cookie details given?",
"required": true,
"options": [
{
"value": "table",
"label": "In a cookie table in this policy",
"text": "The cookie table at the end of this policy lists each cookie, its purpose, and how long it lasts."
},
{
"value": "url",
"label": "In a separate cookie policy",
"text": "Our cookie policy at [cookie_policy_url] lists each cookie, its purpose, and how long it lasts."
},
{
"value": "purposes",
"label": "In this policy, by listing what the cookies are for",
"text": "We use them for [cookie_purposes]."
}
],
"default": "table",
"hint": "Choose \"purposes\" if you have neither a cookie table nor a cookie policy. The ePrivacy rules require the purposes of cookies to be stated."
},
{
"name": "cookie_purposes",
"type": "multi",
"label": "What do you use cookies and similar technologies for?",
"required": false,
"free": true,
"options": [
{
"value": "login",
"label": "keeping you logged in"
},
{
"value": "settings",
"label": "remembering your settings"
},
{
"value": "measure",
"label": "measuring how our site is used"
},
{
"value": "ads",
"label": "showing you personalised advertising"
},
{
"value": "testing",
"label": "testing changes to our site"
},
{
"value": "fraud",
"label": "preventing fraud"
}
],
"hint": "Required when cookie_detail is \"purposes\". Each entry completes the sentence \"We use them for ...\"."
},
{
"name": "cookie_policy_url",
"type": "url",
"label": "Link to your cookie policy, if you have one",
"required": false,
"shared": true,
"validation": {
"https": true
}
}
],
"conditions": "data.cookies",
"asks": {
"step": 3,
"q": "Do you set cookies, pixels, or similar identifiers on devices?",
"why": "The ePrivacy rules require clear information about the purpose of cookies and, unless an exception applies, consent before setting them.",
"links": {
"gdpr": "https://gdpr-info.eu/recitals/no-30/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/"
}
},
"g16": "",
"file": "icons/data.cookies.svg"
},
{
"id": "data.usage",
"cat": "data",
"name": "Usage & behaviour data",
"desc": "How you use the site or app: pages viewed, clicks, features used, time spent, search queries.",
"snippet": "We collect usage data about how you interact with our [website/app], including [pages viewed, links clicked, features used, search terms and the dates and times of your visits].",
"law": "GDPR Art 4(1); CCPA §1798.140(v)(1)(F) (internet or other electronic network activity)",
"ccpa_category": "internet or network activity",
"clause": "We collect usage data about how you use our [service_kind], meaning [usage_items].{if usage_items_more} We may collect other usage data in future.{/if}",
"vars": [
{
"name": "service_kind",
"type": "choice",
"label": "Is your service a website, an app, or both?",
"required": true,
"shared": true,
"default": "website",
"options": [
{
"value": "website",
"label": "Website",
"text": "website"
},
{
"value": "app",
"label": "App",
"text": "app"
},
{
"value": "both",
"label": "Website and app",
"text": "website and app"
}
]
},
{
"name": "usage_items",
"type": "multi",
"label": "Which usage data do you collect?",
"required": true,
"options": [
{
"value": "pages",
"label": "Pages viewed"
},
{
"value": "clicks",
"label": "Links clicked"
},
{
"value": "features",
"label": "Features used"
},
{
"value": "search",
"label": "Search terms"
},
{
"value": "time",
"label": "Time spent"
},
{
"value": "timestamps",
"label": "Dates and times of visits"
},
{
"value": "referrer",
"label": "The site you came from"
}
],
"free": true,
"extensible": true
}
],
"conditions": "data.usage",
"asks": {
"step": 3,
"q": "Do you record pages viewed, clicks, searches, or other activity on your service?",
"why": "The GDPR requires data categories only when they come from other sources, but Californian law requires them always and calls this network activity.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/data.usage.svg"
},
{
"id": "data.communications",
"cat": "data",
"name": "Communications",
"desc": "The content of messages, emails, chats, calls or support tickets exchanged with us or through our service.",
"snippet": "We collect the content of communications you send to us or through our service, such as [emails, chat messages, support requests and call recordings].",
"law": "GDPR Art 4(1); ePrivacy Directive Art 5(1); APP 1.4(a); CCPA §1798.140(ae)(1)(E) (contents of mail, email, and text messages where the business is not the intended recipient are sensitive personal information)",
"ccpa_category": "sensitive personal information",
"clause": "We collect the content of communications, meaning your [comm_items].{if comm_scope} [comm_scope]{/if}",
"vars": [
{
"name": "comm_items",
"type": "multi",
"label": "Which communications do you collect?",
"required": true,
"options": [
{
"value": "emails",
"label": "Emails"
},
{
"value": "chat",
"label": "Chat messages"
},
{
"value": "support",
"label": "Support requests"
},
{
"value": "calls",
"label": "Call recordings"
},
{
"value": "forms",
"label": "Contact form submissions"
},
{
"value": "letters",
"label": "Letters"
},
{
"value": "video",
"label": "Video call recordings"
}
],
"free": true,
"extensible": true
},
{
"name": "comm_scope",
"type": "choice",
"label": "Whose messages does this cover?",
"required": true,
"options": [
{
"value": "with_us",
"label": "Messages sent to us",
"text": "This covers messages you send to us."
},
{
"value": "through",
"label": "Messages sent to us and to other people through our service",
"text": "This covers messages you send to us and messages you send to other people through our service."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "with_us"
}
],
"conditions": "data.communications",
"asks": {
"step": 3,
"q": "Do you keep the content of emails, chats, calls, or support tickets?",
"why": "The ePrivacy rules protect the confidentiality of communications, and Californian law treats messages you carry between other people as sensitive personal information.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/data.communications.svg"
},
{
"id": "data.content",
"cat": "data",
"name": "User-generated content",
"desc": "Posts, reviews, comments, uploads, profiles and other material you create or share.",
"snippet": "We collect content you create or upload, such as [posts, comments, reviews, profile information and files].",
"law": "GDPR Art 4(1); CCPA §1798.140(v)(1)(A), (H)",
"ccpa_category": "sensory data",
"clause": "We collect content you create or upload, meaning your [content_items].{if content_items_more} We may collect other content in future.{/if}",
"vars": [
{
"name": "content_items",
"type": "multi",
"label": "Which content do people create on your service?",
"required": true,
"options": [
{
"value": "posts",
"label": "Posts"
},
{
"value": "comments",
"label": "Comments"
},
{
"value": "reviews",
"label": "Reviews and ratings"
},
{
"value": "profile",
"label": "Profile information"
},
{
"value": "files",
"label": "Uploaded files"
},
{
"value": "listings",
"label": "Listings and adverts"
},
{
"value": "messages",
"label": "Messages to other users"
}
],
"free": true,
"extensible": true
}
],
"conditions": "data.content",
"asks": {
"step": 3,
"q": "Do people post, upload, or publish content on your service?",
"why": "The GDPR requires you to name who receives personal data, and Californian and Australian law require you to list the kinds you collect.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/data.content.svg"
},
{
"id": "data.media",
"cat": "data",
"name": "Photo, video & audio",
"desc": "Images, recordings or voice data captured by you or by our systems (including CCTV and call recording).",
"snippet": "We collect [photographs, video and audio recordings] [that you upload / captured by our CCTV / when calls are recorded].",
"law": "GDPR Art 4(1); Art 9 where used for biometric identification; CCPA §1798.140(v)(1)(H)",
"ccpa_category": "sensory data",
"clause": "We collect [media_items]. They come from [media_source].",
"vars": [
{
"name": "media_items",
"type": "multi",
"label": "Which media do you collect?",
"required": true,
"options": [
{
"value": "photos",
"label": "Photographs",
"text": "photographs"
},
{
"value": "video",
"label": "Video recordings",
"text": "video recordings"
},
{
"value": "audio",
"label": "Audio recordings",
"text": "audio recordings"
}
]
},
{
"name": "media_source",
"type": "multi",
"label": "Where do they come from?",
"required": true,
"options": [
{
"value": "upload",
"label": "Files people upload",
"text": "files you upload"
},
{
"value": "cctv",
"label": "Our CCTV cameras",
"text": "our CCTV cameras"
},
{
"value": "calls",
"label": "Recorded calls with us",
"text": "recordings of calls with us"
},
{
"value": "video_calls",
"label": "Video calls and online events",
"text": "video calls and online events"
},
{
"value": "events",
"label": "Photographs taken at our events",
"text": "photographs taken at our events"
},
{
"value": "voice",
"label": "Voice commands to our app",
"text": "voice commands you give our app"
}
],
"free": true
}
],
"conditions": "data.media",
"asks": {
"step": 3,
"q": "Do you collect photographs, video, or audio, including CCTV or call recordings?",
"why": "The GDPR requires you to state why you record and, for recordings from other sources, where they come from.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/"
}
},
"g16": "",
"file": "icons/data.media.svg"
},
{
"id": "data.biometric",
"cat": "data",
"name": "Biometric data",
"desc": "Fingerprints, facial geometry, voiceprints or other data from technical processing that uniquely identifies you.",
"snippet": "We process biometric data ([fingerprint / facial recognition / voiceprint]) to [uniquely identify you], with your explicit consent.",
"law": "GDPR Arts 4(14), 9(1); APP 3.3 (sensitive information); CCPA §1798.140(ae)(2)",
"ccpa_category": "sensitive personal information",
"clause": "We process biometric data, meaning [biometric_kind], to identify you uniquely. We use it for [biometric_purpose]. We do this [art9_condition].",
"vars": [
{
"name": "biometric_kind",
"type": "multi",
"label": "Which biometric data do you process?",
"required": true,
"options": [
{
"value": "fingerprint",
"label": "Fingerprints",
"text": "your fingerprints"
},
{
"value": "face",
"label": "Facial geometry",
"text": "the geometry of your face"
},
{
"value": "voice",
"label": "Voiceprints",
"text": "your voiceprint"
},
{
"value": "iris",
"label": "Iris or retina scans",
"text": "your iris pattern"
},
{
"value": "behaviour",
"label": "Behavioural patterns",
"text": "the way you type or move"
}
],
"hint": "Biometric data is special category data only when used to identify a person uniquely."
},
{
"name": "biometric_purpose",
"type": "multi",
"label": "Which purposes is it used for?",
"required": true,
"options": "@purpose"
},
{
"name": "art9_condition",
"type": "choice",
"label": "Which Article 9(2) condition allows this?",
"required": true,
"options": [
{
"value": "basis.explicit-consent",
"label": "Your explicit consent (Art 9(2)(a))",
"text": "with your explicit consent (Article 9(2)(a) GDPR)"
},
{
"value": "basis.art9-employment",
"label": "Employment, social security, or social protection law (Art 9(2)(b))",
"text": "because employment, social security, or social protection law requires or allows it (Article 9(2)(b) GDPR)"
},
{
"value": "basis.vital-interests",
"label": "Vital interests where the person cannot consent (Art 9(2)(c))",
"text": "to protect your life or someone else's when you cannot consent (Article 9(2)(c) GDPR)"
},
{
"value": "basis.art9-not-for-profit",
"label": "Not-for-profit body with a political, philosophical, religious, or trade union aim (Art 9(2)(d))",
"text": "as a not-for-profit body, for our members, former members, and regular contacts (Article 9(2)(d) GDPR)"
},
{
"value": "basis.art9-public",
"label": "Data you made public yourself (Art 9(2)(e))",
"text": "because you have made this data public yourself (Article 9(2)(e) GDPR)"
},
{
"value": "basis.art9-legal-claims",
"label": "Legal claims (Art 9(2)(f))",
"text": "to establish, exercise, or defend legal claims (Article 9(2)(f) GDPR)"
},
{
"value": "basis.art9-public-interest",
"label": "Substantial public interest or public health under law (Art 9(2)(g) or (i))",
"text": "for reasons of substantial public interest or public health set out in law (Article 9(2)(g) or (i) GDPR)"
},
{
"value": "basis.art9-health",
"label": "Health or social care under professional secrecy (Art 9(2)(h))",
"text": "for health or social care, under a duty of professional secrecy (Article 9(2)(h) GDPR)"
},
{
"value": "basis.art9-research",
"label": "Research, statistics, or archiving with safeguards (Art 9(2)(j))",
"text": "for research, statistics, or archiving, with safeguards for your data (Article 9(2)(j) GDPR)"
}
],
"hint": "Proposed from the purpose: employment matters (b), health service (h), research (j), legal claims (f), otherwise explicit consent (a)."
}
],
"conditions": "data.biometric",
"asks": {
"step": 3,
"q": "Do you use fingerprints, face recognition, voiceprints, or similar to identify people?",
"why": "The GDPR bans processing biometric data for unique identification unless an Article 9(2) condition applies, and it must be named.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/biometric-data-guidance-biometric-recognition/"
}
},
"g16": "",
"file": "icons/data.biometric.svg"
},
{
"id": "data.health",
"cat": "data",
"name": "Health data",
"desc": "Information about physical or mental health, medical history, treatment or disability.",
"snippet": "We collect health data, such as [medical conditions, allergies, medication and accessibility needs], [with your explicit consent / because it is necessary for [purpose]].",
"law": "GDPR Arts 4(15), 9(1), 9(2)(a) or (h); APP 3.3, s 6FA Privacy Act 1988 (Cth); CCPA §1798.140(ae)(2)",
"ccpa_category": "sensitive personal information",
"clause": "We collect health data, meaning [health_items]. We use it for [health_purpose]. We do this [art9_condition].",
"vars": [
{
"name": "health_items",
"type": "multi",
"label": "Which health data do you collect?",
"required": true,
"options": [
{
"value": "conditions",
"label": "Medical conditions"
},
{
"value": "allergies",
"label": "Allergies"
},
{
"value": "medication",
"label": "Medication"
},
{
"value": "disability",
"label": "Disability and accessibility needs"
},
{
"value": "mental",
"label": "Mental health information"
},
{
"value": "fitness",
"label": "Fitness and wellbeing data"
},
{
"value": "sickness",
"label": "Sickness absence records"
},
{
"value": "vaccination",
"label": "Vaccination status"
}
],
"free": true
},
{
"name": "health_purpose",
"type": "multi",
"label": "Which purposes is it used for?",
"required": true,
"options": "@purpose"
},
{
"name": "art9_condition",
"type": "choice",
"label": "Which Article 9(2) condition allows this?",
"required": true,
"options": [
{
"value": "basis.explicit-consent",
"label": "Your explicit consent (Art 9(2)(a))",
"text": "with your explicit consent (Article 9(2)(a) GDPR)"
},
{
"value": "basis.art9-employment",
"label": "Employment, social security, or social protection law (Art 9(2)(b))",
"text": "because employment, social security, or social protection law requires or allows it (Article 9(2)(b) GDPR)"
},
{
"value": "basis.vital-interests",
"label": "Vital interests where the person cannot consent (Art 9(2)(c))",
"text": "to protect your life or someone else's when you cannot consent (Article 9(2)(c) GDPR)"
},
{
"value": "basis.art9-not-for-profit",
"label": "Not-for-profit body with a political, philosophical, religious, or trade union aim (Art 9(2)(d))",
"text": "as a not-for-profit body, for our members, former members, and regular contacts (Article 9(2)(d) GDPR)"
},
{
"value": "basis.art9-public",
"label": "Data you made public yourself (Art 9(2)(e))",
"text": "because you have made this data public yourself (Article 9(2)(e) GDPR)"
},
{
"value": "basis.art9-legal-claims",
"label": "Legal claims (Art 9(2)(f))",
"text": "to establish, exercise, or defend legal claims (Article 9(2)(f) GDPR)"
},
{
"value": "basis.art9-public-interest",
"label": "Substantial public interest or public health under law (Art 9(2)(g) or (i))",
"text": "for reasons of substantial public interest or public health set out in law (Article 9(2)(g) or (i) GDPR)"
},
{
"value": "basis.art9-health",
"label": "Health or social care under professional secrecy (Art 9(2)(h))",
"text": "for health or social care, under a duty of professional secrecy (Article 9(2)(h) GDPR)"
},
{
"value": "basis.art9-research",
"label": "Research, statistics, or archiving with safeguards (Art 9(2)(j))",
"text": "for research, statistics, or archiving, with safeguards for your data (Article 9(2)(j) GDPR)"
}
],
"hint": "Proposed from the purpose: employment matters (b), health service (h), research (j), legal claims (f), otherwise explicit consent (a)."
}
],
"conditions": "data.health",
"asks": {
"step": 3,
"q": "Do you collect health information, including disability, allergy, or accessibility needs?",
"why": "The GDPR bans processing health data unless an Article 9(2) condition applies, and your notice must name it.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/"
}
},
"g16": "",
"file": "icons/data.health.svg"
},
{
"id": "data.genetic",
"cat": "data",
"name": "Genetic data",
"desc": "Data from analysis of a biological sample that reveals inherited or acquired characteristics.",
"snippet": "We process genetic data derived from [a sample you provide / test results] for [purpose], with your explicit consent.",
"law": "GDPR Arts 4(13), 9(1); APP 3.3; CCPA §1798.140(ae)(1)(F)",
"ccpa_category": "sensitive personal information",
"clause": "We process genetic data from [genetic_source]. We use it for [genetic_purpose]. We do this [art9_condition].",
"vars": [
{
"name": "genetic_source",
"type": "choice",
"label": "Where does the genetic data come from?",
"required": true,
"options": [
{
"value": "sample",
"label": "A sample the person provides",
"text": "a sample you provide"
},
{
"value": "results",
"label": "Test results the person gives us",
"text": "test results you give us"
},
{
"value": "either",
"label": "Either",
"text": "a sample you provide or test results you give us"
}
]
},
{
"name": "genetic_purpose",
"type": "multi",
"label": "Which purposes is it used for?",
"required": true,
"options": "@purpose"
},
{
"name": "art9_condition",
"type": "choice",
"label": "Which Article 9(2) condition allows this?",
"required": true,
"options": [
{
"value": "basis.explicit-consent",
"label": "Your explicit consent (Art 9(2)(a))",
"text": "with your explicit consent (Article 9(2)(a) GDPR)"
},
{
"value": "basis.art9-employment",
"label": "Employment, social security, or social protection law (Art 9(2)(b))",
"text": "because employment, social security, or social protection law requires or allows it (Article 9(2)(b) GDPR)"
},
{
"value": "basis.vital-interests",
"label": "Vital interests where the person cannot consent (Art 9(2)(c))",
"text": "to protect your life or someone else's when you cannot consent (Article 9(2)(c) GDPR)"
},
{
"value": "basis.art9-not-for-profit",
"label": "Not-for-profit body with a political, philosophical, religious, or trade union aim (Art 9(2)(d))",
"text": "as a not-for-profit body, for our members, former members, and regular contacts (Article 9(2)(d) GDPR)"
},
{
"value": "basis.art9-public",
"label": "Data you made public yourself (Art 9(2)(e))",
"text": "because you have made this data public yourself (Article 9(2)(e) GDPR)"
},
{
"value": "basis.art9-legal-claims",
"label": "Legal claims (Art 9(2)(f))",
"text": "to establish, exercise, or defend legal claims (Article 9(2)(f) GDPR)"
},
{
"value": "basis.art9-public-interest",
"label": "Substantial public interest or public health under law (Art 9(2)(g) or (i))",
"text": "for reasons of substantial public interest or public health set out in law (Article 9(2)(g) or (i) GDPR)"
},
{
"value": "basis.art9-health",
"label": "Health or social care under professional secrecy (Art 9(2)(h))",
"text": "for health or social care, under a duty of professional secrecy (Article 9(2)(h) GDPR)"
},
{
"value": "basis.art9-research",
"label": "Research, statistics, or archiving with safeguards (Art 9(2)(j))",
"text": "for research, statistics, or archiving, with safeguards for your data (Article 9(2)(j) GDPR)"
}
],
"hint": "Proposed from the purpose: employment matters (b), health service (h), research (j), legal claims (f), otherwise explicit consent (a)."
}
],
"conditions": "data.genetic",
"asks": {
"step": 3,
"q": "Do you process DNA or other genetic test data?",
"why": "The GDPR bans processing genetic data unless an Article 9(2) condition applies, and your notice must name it.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/"
}
},
"g16": "",
"file": "icons/data.genetic.svg"
},
{
"id": "data.special",
"cat": "data",
"name": "Special category data",
"desc": "Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation.",
"snippet": "We process special category data, namely [racial or ethnic origin / political opinions / religious or philosophical beliefs / trade union membership / sex life or sexual orientation], for [purpose], relying on [your explicit consent / Article 9(2)([x])].",
"law": "GDPR Art 9; UK GDPR Art 9 and DPA 2018 Sch 1; APP 3.3 (sensitive information); CCPA §1798.140(ae)(1)(D), (2)(C) (political opinions are not sensitive personal information under the CCPA)",
"ccpa_category": "sensitive personal information",
"clause": "We process special category data revealing your [special_kinds]. We use it for [special_purpose]. We do this [art9_condition].",
"vars": [
{
"name": "special_kinds",
"type": "multi",
"label": "Which kinds of special category data?",
"required": true,
"options": [
{
"value": "ethnicity",
"label": "Racial or ethnic origin",
"text": "racial or ethnic origin"
},
{
"value": "politics",
"label": "Political opinions",
"text": "political opinions"
},
{
"value": "religion",
"label": "Religious or philosophical beliefs",
"text": "religious or philosophical beliefs"
},
{
"value": "union",
"label": "Trade union membership",
"text": "trade union membership"
},
{
"value": "sex_life",
"label": "Sex life or sexual orientation",
"text": "sex life or sexual orientation"
}
],
"hint": "Health, biometric, and genetic data have their own tiles."
},
{
"name": "special_purpose",
"type": "multi",
"label": "Which purposes is it used for?",
"required": true,
"options": "@purpose"
},
{
"name": "art9_condition",
"type": "choice",
"label": "Which Article 9(2) condition allows this?",
"required": true,
"options": [
{
"value": "basis.explicit-consent",
"label": "Your explicit consent (Art 9(2)(a))",
"text": "with your explicit consent (Article 9(2)(a) GDPR)"
},
{
"value": "basis.art9-employment",
"label": "Employment, social security, or social protection law (Art 9(2)(b))",
"text": "because employment, social security, or social protection law requires or allows it (Article 9(2)(b) GDPR)"
},
{
"value": "basis.vital-interests",
"label": "Vital interests where the person cannot consent (Art 9(2)(c))",
"text": "to protect your life or someone else's when you cannot consent (Article 9(2)(c) GDPR)"
},
{
"value": "basis.art9-not-for-profit",
"label": "Not-for-profit body with a political, philosophical, religious, or trade union aim (Art 9(2)(d))",
"text": "as a not-for-profit body, for our members, former members, and regular contacts (Article 9(2)(d) GDPR)"
},
{
"value": "basis.art9-public",
"label": "Data you made public yourself (Art 9(2)(e))",
"text": "because you have made this data public yourself (Article 9(2)(e) GDPR)"
},
{
"value": "basis.art9-legal-claims",
"label": "Legal claims (Art 9(2)(f))",
"text": "to establish, exercise, or defend legal claims (Article 9(2)(f) GDPR)"
},
{
"value": "basis.art9-public-interest",
"label": "Substantial public interest or public health under law (Art 9(2)(g) or (i))",
"text": "for reasons of substantial public interest or public health set out in law (Article 9(2)(g) or (i) GDPR)"
},
{
"value": "basis.art9-health",
"label": "Health or social care under professional secrecy (Art 9(2)(h))",
"text": "for health or social care, under a duty of professional secrecy (Article 9(2)(h) GDPR)"
},
{
"value": "basis.art9-research",
"label": "Research, statistics, or archiving with safeguards (Art 9(2)(j))",
"text": "for research, statistics, or archiving, with safeguards for your data (Article 9(2)(j) GDPR)"
}
],
"hint": "Proposed from the purpose: employment matters (b), health service (h), research (j), legal claims (f), otherwise explicit consent (a)."
}
],
"conditions": "data.special",
"asks": {
"step": 3,
"q": "Do you collect data about ethnicity, politics, religion, union membership, or sexual orientation?",
"why": "The GDPR bans processing special category data unless an Article 9(2) condition applies, and your notice must name it.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/"
}
},
"multiple": true,
"g16": "",
"file": "icons/data.special.svg"
},
{
"id": "data.criminal",
"cat": "data",
"name": "Criminal offence data",
"desc": "Data about criminal convictions, offences, allegations or related security measures.",
"snippet": "We process data about [criminal convictions and offences / allegations] for [purpose], as permitted by [Article 10 GDPR and [national law] / Schedule 1 of the Data Protection Act 2018].",
"law": "GDPR Art 10; UK DPA 2018 s 10 and Sch 1; APP 3.3 (criminal record is sensitive information); CCPA §1798.140(v)(1)(B) and §1798.80(e) (customer records)",
"ccpa_category": "customer records",
"clause": "We process data about [criminal_kinds]. We use it for [criminal_purpose]. We do this [art10_condition].",
"vars": [
{
"name": "criminal_kinds",
"type": "multi",
"label": "Which criminal offence data do you process?",
"required": true,
"options": [
{
"value": "convictions",
"label": "Criminal convictions",
"text": "criminal convictions"
},
{
"value": "offences",
"label": "Offences and alleged offences",
"text": "offences and alleged offences"
},
{
"value": "checks",
"label": "Criminal record checks",
"text": "criminal record checks"
},
{
"value": "measures",
"label": "Related security measures",
"text": "related security measures"
}
]
},
{
"name": "criminal_purpose",
"type": "multi",
"label": "Which purposes is it used for?",
"required": true,
"options": "@purpose"
},
{
"name": "art10_condition",
"type": "choice",
"label": "Under what authority is this processing allowed?",
"required": true,
"options": [
{
"value": "basis.art10",
"label": "Official authority or authorisation by law (Art 10)",
"text": "under the authority set out in Our lawful basis (Article 10 GDPR)"
}
],
"hint": "Article 10 GDPR requires official authority or an authorising law. The next question names it and the purposes it covers."
}
],
"conditions": "data.criminal",
"asks": {
"step": 3,
"q": "Do you process criminal convictions, offences, allegations, or criminal record checks?",
"why": "The GDPR only allows criminal offence data to be processed under official authority or a law that permits it, which the notice should name.",
"links": {
"gdpr": "https://gdpr-info.eu/art-10-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/criminal-offence-data/"
}
},
"g16": "",
"file": "icons/data.criminal.svg"
},
{
"id": "data.children",
"cat": "data",
"name": "Children's data",
"desc": "Personal data about children, meaning persons under the age of digital consent, which Article 8 sets at 16 unless the Member State or UK law sets a lower age down to 13.",
"snippet": "We collect personal data about children under [16/13] only [with verifiable consent from a parent or guardian / where necessary for [purpose]].",
"law": "GDPR Art 8, Recital 38; UK GDPR Art 8 (age 13); Age Appropriate Design Code (UK); COPPA 15 U.S.C. §6501 (under 13); CCPA §1798.120(c)",
"ccpa_category": null,
"clause": "We collect personal data about children under [child_age].{if child_basis} [child_basis]{/if}{if age_check} [age_check]{/if}",
"vars": [
{
"name": "child_age",
"type": "number",
"label": "Below what age is a person a child for your service?",
"required": true,
"validation": {
"min": 13,
"max": 18
},
"default": 16,
"hint": "The GDPR age of digital consent is 16 unless the Member State sets a lower age, down to 13. The UK uses 13."
},
{
"name": "child_basis",
"type": "choice",
"label": "On what footing do you collect it?",
"required": true,
"options": [
{
"value": "parental",
"label": "Only with verifiable parental consent",
"text": "We do this only with verifiable consent from a parent or guardian."
},
{
"value": "necessary",
"label": "Only where necessary for a stated purpose",
"text": "We do this only where necessary for [child_purpose]."
},
{
"value": "both",
"label": "With parental consent or where necessary for a stated purpose",
"text": "We do this only with verifiable consent from a parent or guardian, or where necessary for [child_purpose]."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "parental"
},
{
"name": "child_purpose",
"type": "multi",
"label": "Which purposes?",
"required": false,
"options": "@purpose"
},
{
"name": "age_check",
"type": "choice",
"label": "How do you find out a person's age?",
"required": true,
"options": [
{
"value": "ask",
"label": "We ask when they sign up",
"text": "We ask your age when you sign up."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
}
],
"conditions": "data.children",
"asks": {
"step": 3,
"q": "Could children use your service, or do you collect data about children?",
"why": "The GDPR requires parental consent where you rely on consent for online services offered directly to children below the digital consent age.",
"links": {
"gdpr": "https://gdpr-info.eu/art-8-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/children-and-the-uk-gdpr/"
}
},
"g16": "",
"file": "icons/data.children.svg"
},
{
"id": "data.employment",
"cat": "data",
"name": "Employment & professional data",
"desc": "Job title, employer, CV, qualifications, work history and references.",
"snippet": "We collect professional data, such as your [job title, employer, qualifications, CV and references].",
"law": "GDPR Art 4(1); CCPA §1798.140(v)(1)(I)",
"ccpa_category": "professional or employment information",
"clause": "We collect employment and professional data, meaning your [employment_items].{if employment_items_more} We may collect other work-related data in future.{/if}",
"vars": [
{
"name": "employment_items",
"type": "multi",
"label": "Which employment or professional data do you collect?",
"required": true,
"options": [
{
"value": "job_title",
"label": "Job title"
},
{
"value": "employer",
"label": "Employer"
},
{
"value": "qualifications",
"label": "Qualifications"
},
{
"value": "cv",
"label": "CV"
},
{
"value": "history",
"label": "Work history"
},
{
"value": "references",
"label": "References"
},
{
"value": "memberships",
"label": "Professional memberships"
},
{
"value": "pay",
"label": "Salary and benefits"
}
],
"free": true,
"extensible": true
}
],
"conditions": "data.employment",
"asks": {
"step": 3,
"q": "Do you collect job titles, CVs, qualifications, or work history?",
"why": "Californian and Australian law require you to list the kinds of data you collect, and the GDPR lets countries set extra rules for employee data.",
"links": {
"gdpr": "https://gdpr-info.eu/art-88-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/recruitment-and-selection/"
}
},
"g16": "",
"file": "icons/data.employment.svg"
},
{
"id": "data.social",
"cat": "data",
"name": "Social media data",
"desc": "Profile information, friends lists or content obtained from social networks when you connect or log in with a social account.",
"snippet": "If you log in or connect using a social media account, we receive [your profile name, picture, email address and public profile information] from that platform.",
"law": "GDPR Arts 4(1), 14; CCPA §1798.140(v)(1)(F)",
"ccpa_category": "internet or network activity",
"clause": "If you log in or connect using a social media account, we receive [social_items] from that platform.{if social_platforms} This applies to [social_platforms].{/if}",
"vars": [
{
"name": "social_items",
"type": "multi",
"label": "What do you receive from the platform?",
"required": true,
"options": [
{
"value": "name",
"label": "Profile name",
"text": "your profile name"
},
{
"value": "picture",
"label": "Profile picture",
"text": "your profile picture"
},
{
"value": "email",
"label": "Email address",
"text": "your email address"
},
{
"value": "public_profile",
"label": "Public profile information",
"text": "your public profile information"
},
{
"value": "contacts",
"label": "Friends or contacts list",
"text": "your friends or contacts list"
},
{
"value": "posts",
"label": "Posts the person allows us to see",
"text": "posts you allow us to see"
}
],
"free": true
},
{
"name": "social_platforms",
"type": "multi",
"label": "Which platforms?",
"required": false,
"options": [
{
"value": "google",
"label": "Google"
},
{
"value": "apple",
"label": "Apple"
},
{
"value": "facebook",
"label": "Facebook"
},
{
"value": "microsoft",
"label": "Microsoft"
},
{
"value": "linkedin",
"label": "LinkedIn"
},
{
"value": "x",
"label": "X"
},
{
"value": "github",
"label": "GitHub"
},
{
"value": "discord",
"label": "Discord"
}
],
"free": true
}
],
"conditions": "data.social",
"asks": {
"step": 3,
"q": "Can people log in or connect with a social media or other account?",
"why": "The GDPR requires you to name the source when personal data comes from another organisation rather than the person.",
"links": {
"gdpr": "https://gdpr-info.eu/art-14-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/data.social.svg"
},
{
"id": "data.inferred",
"cat": "data",
"name": "Inferred & derived data",
"desc": "Preferences, interests, characteristics or scores that we deduce from other data about you.",
"snippet": "We derive information about you from the data we hold, such as [your likely interests, preferences and [segment/score]].",
"law": "GDPR Art 4(4) (profiling); CCPA §1798.140(v)(1)(K) (inferences)",
"ccpa_category": "inferences",
"clause": "We work out information about you from the data we hold, meaning [inferred_items].{if inferred_items_more} We may derive other information in future.{/if}",
"vars": [
{
"name": "inferred_items",
"type": "multi",
"label": "What do you infer or derive?",
"required": true,
"options": [
{
"value": "interests",
"label": "Likely interests",
"text": "your likely interests"
},
{
"value": "preferences",
"label": "Preferences",
"text": "your preferences"
},
{
"value": "segment",
"label": "Customer segment",
"text": "the customer group you belong to"
},
{
"value": "risk",
"label": "Fraud or risk scores",
"text": "a fraud or risk score"
},
{
"value": "demographic",
"label": "Likely age or demographic",
"text": "your likely age or demographic"
},
{
"value": "propensity",
"label": "Likelihood to buy or leave",
"text": "how likely you are to buy or to leave"
}
],
"free": true,
"extensible": true
}
],
"conditions": "data.inferred",
"asks": {
"step": 3,
"q": "Do you deduce interests, preferences, segments, or scores from other data?",
"why": "The GDPR calls automated evaluation of people profiling, and your notice must explain it where it produces solely automated decisions with significant effects.",
"links": {
"gdpr": "https://gdpr-info.eu/art-4-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/automated-decision-making-and-profiling/"
}
},
"g16": "",
"file": "icons/data.inferred.svg"
},
{
"id": "data.preferences",
"cat": "data",
"name": "Preferences & settings",
"desc": "Marketing choices, communication preferences, language and account settings.",
"snippet": "We record your [marketing and communication preferences, language and other account settings].",
"law": "GDPR Art 4(1), Art 7(1) (record of consent); CCPA §1798.140(v)(1)(B) and §1798.80(e) (customer records)",
"ccpa_category": "customer records",
"clause": "We record your [preference_items].{if preference_items_more} We may record other settings in future.{/if}",
"vars": [
{
"name": "preference_items",
"type": "multi",
"label": "Which preferences and settings do you record?",
"required": true,
"options": [
{
"value": "marketing",
"label": "Marketing preferences"
},
{
"value": "communication",
"label": "Communication preferences"
},
{
"value": "language",
"label": "Language"
},
{
"value": "settings",
"label": "Account settings"
},
{
"value": "consent",
"label": "Consent choices, what you agreed to and when"
},
{
"value": "cookies",
"label": "Cookie choices"
},
{
"value": "accessibility",
"label": "Accessibility settings"
}
],
"free": true,
"extensible": true
}
],
"conditions": "data.preferences",
"asks": {
"step": 3,
"q": "Do you store people's marketing choices, settings, or consent records?",
"why": "The GDPR requires you to be able to show that consent was given, so records of choices are personal data you must list.",
"links": {
"gdpr": "https://gdpr-info.eu/art-7-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/how-should-we-obtain-record-and-manage-consent/"
}
},
"g16": "",
"file": "icons/data.preferences.svg"
},
{
"id": "data.government-id",
"cat": "data",
"name": "Government identifiers",
"desc": "Passport, national ID, driving licence, tax or social security numbers.",
"snippet": "We collect government-issued identifiers, such as your [passport / national ID / driving licence / tax number], for [identity verification / legal compliance].",
"law": "GDPR Art 87; CCPA §1798.140(ae)(1)(A); APP 9 (government related identifiers)",
"ccpa_category": "sensitive personal information",
"clause": "We collect government-issued identifiers, meaning your [govid_items]. We use them [govid_purpose].",
"vars": [
{
"name": "govid_items",
"type": "multi",
"label": "Which identifiers or documents?",
"required": true,
"options": [
{
"value": "passport",
"label": "Passport number"
},
{
"value": "national_id",
"label": "National ID number"
},
{
"value": "licence",
"label": "Driving licence number"
},
{
"value": "tax",
"label": "Tax number"
},
{
"value": "ssn",
"label": "Social security or national insurance number"
},
{
"value": "copy",
"label": "A copy of the document"
}
],
"free": true
},
{
"name": "govid_purpose",
"type": "multi",
"label": "Why do you need them?",
"required": true,
"options": [
{
"value": "identity",
"label": "To verify identity",
"text": "to check your identity"
},
{
"value": "age",
"label": "To verify age",
"text": "to check your age"
},
{
"value": "legal",
"label": "A legal requirement",
"text": "because the law requires us to"
},
{
"value": "tax",
"label": "Tax or payroll reporting",
"text": "for tax and payroll reporting"
},
{
"value": "right_to_work",
"label": "Right-to-work checks",
"text": "to check your right to work"
}
],
"free": true
}
],
"conditions": "data.government-id",
"asks": {
"step": 3,
"q": "Do you collect passport, ID card, driving licence, tax, or social security numbers?",
"why": "The GDPR lets Member States set conditions for national identifiers, and Australian law restricts use of government identifiers.",
"links": {
"gdpr": "https://gdpr-info.eu/art-87-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/"
}
},
"g16": "",
"file": "icons/data.government-id.svg"
},
{
"id": "data.financial-status",
"cat": "data",
"name": "Financial status",
"desc": "Income, credit history, creditworthiness or affordability information.",
"snippet": "We collect information about your [income, credit history and financial circumstances] from [you / credit reference agencies] for [purpose].",
"law": "GDPR Art 4(1); Consumer Credit Act 1974 (UK); Privacy Act 1988 (Cth) Part IIIA (credit reporting); FCRA 15 U.S.C. §1681 (US); CCPA §1798.140(v)(1)(B) and §1798.80(e) (customer records)",
"ccpa_category": "customer records",
"clause": "We collect information about your [finstatus_items] from [finstatus_source]. We use it for [finstatus_purpose].",
"vars": [
{
"name": "finstatus_items",
"type": "multi",
"label": "Which financial information?",
"required": true,
"options": [
{
"value": "income",
"label": "Income",
"text": "income"
},
{
"value": "credit_history",
"label": "Credit history",
"text": "credit history"
},
{
"value": "credit_score",
"label": "Credit score",
"text": "credit score"
},
{
"value": "circumstances",
"label": "Financial circumstances",
"text": "financial circumstances"
},
{
"value": "affordability",
"label": "Affordability",
"text": "ability to afford payments"
}
],
"free": true
},
{
"name": "finstatus_source",
"type": "multi",
"label": "Where does it come from?",
"required": true,
"options": [
{
"value": "you",
"label": "The person",
"text": "you"
},
{
"value": "cra",
"label": "Credit reference agencies",
"text": "credit reference agencies"
},
{
"value": "bank",
"label": "Their bank, with their permission",
"text": "your bank, with your permission"
},
{
"value": "public",
"label": "Public records",
"text": "public records"
}
],
"free": true
},
{
"name": "finstatus_purpose",
"type": "multi",
"label": "Which purposes is it used for?",
"required": true,
"options": "@purpose"
}
],
"conditions": "data.financial-status",
"asks": {
"step": 3,
"q": "Do you collect income, credit history, or affordability information?",
"why": "The GDPR requires you to name the source when data comes from credit reference agencies and to say why you need it.",
"links": {
"gdpr": "https://gdpr-info.eu/art-14-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/data.financial-status.svg"
},
{
"id": "source.direct",
"cat": "source",
"name": "Provided by you",
"desc": "Data you give us directly, for example by filling in forms, creating an account or contacting us.",
"snippet": "We collect data directly from you when you [create an account, fill in forms, make a purchase, subscribe to our newsletter or contact us].",
"law": "GDPR Art 13; APP 1.4(b), APP 5",
"clause": "We collect personal data directly from you when you [direct_ways].{if direct_ways_more} We may add other ways of collecting data from you in future.{/if}",
"vars": [
{
"name": "direct_ways",
"type": "multi",
"label": "When do people give you data directly?",
"required": true,
"extensible": true,
"free": true,
"options": [
{
"value": "account",
"label": "create an account"
},
{
"value": "form",
"label": "fill in a form"
},
{
"value": "order",
"label": "place an order"
},
{
"value": "newsletter",
"label": "subscribe to our newsletter"
},
{
"value": "contact",
"label": "contact us"
},
{
"value": "survey",
"label": "take part in a survey"
},
{
"value": "competition",
"label": "enter a competition"
},
{
"value": "job",
"label": "apply for a job"
},
{
"value": "post",
"label": "post content"
},
{
"value": "donate",
"label": "make a donation"
},
{
"value": "event",
"label": "register for an event"
},
{
"value": "membership",
"label": "join as a member"
}
],
"hint": "Each entry completes the sentence \"when you ...\"."
}
],
"conditions": "source.direct",
"asks": {
"step": 4,
"q": "Do people give you data directly, for example by filling in forms or contacting you?",
"why": "The GDPR requires you to give people privacy information at the time you collect data from them.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-be-informed/"
}
},
"g16": "",
"file": "icons/source.direct.svg"
},
{
"id": "source.automatic",
"cat": "source",
"name": "Collected automatically",
"desc": "Data gathered by our systems as you use the service, through cookies, logs, SDKs and similar technologies.",
"snippet": "We collect data automatically as you use our [website/app], through [server logs, cookies, pixels and software development kits].",
"law": "GDPR Art 13, Recital 30; ePrivacy Directive Art 5(3); APP 1.4(b)",
"clause": "We collect some personal data automatically as you use our [service_kind], through [auto_tech].{if auto_tech_more} We may use other technologies in future.{/if}{if cookie_policy_url} Our cookie policy at [cookie_policy_url] explains the cookies and similar technologies we use.{/if}",
"vars": [
{
"name": "service_kind",
"type": "choice",
"label": "Is your service a website, an app, or both?",
"required": true,
"shared": true,
"default": "website",
"options": [
{
"value": "website",
"label": "Website",
"text": "website"
},
{
"value": "app",
"label": "App",
"text": "app"
},
{
"value": "both",
"label": "Website and app",
"text": "website and app"
}
]
},
{
"name": "auto_tech",
"type": "multi",
"label": "Which technologies collect data automatically?",
"required": true,
"extensible": true,
"options": [
{
"value": "logs",
"label": "server logs"
},
{
"value": "cookies",
"label": "cookies"
},
{
"value": "pixels",
"label": "pixels and tags"
},
{
"value": "sdk",
"label": "software development kits in our app"
},
{
"value": "local_storage",
"label": "browser local storage"
},
{
"value": "device",
"label": "device and browser information sent by your device"
}
]
},
{
"name": "cookie_policy_url",
"type": "url",
"label": "Link to your cookie policy, if you have one",
"required": false,
"shared": true,
"validation": {
"https": true
}
}
],
"conditions": "source.automatic",
"asks": {
"step": 4,
"q": "Do your systems collect data automatically, for example through cookies, logs, or app SDKs?",
"why": "Data collected by cookies and similar technologies must be disclosed, and ePrivacy rules require consent for non-essential ones.",
"links": {
"gdpr": "https://gdpr-info.eu/recitals/no-30/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/"
}
},
"g16": "",
"file": "icons/source.automatic.svg"
},
{
"id": "source.third-party",
"cat": "source",
"name": "From third parties",
"desc": "Data received from other organisations, such as partners, data brokers, credit reference agencies or fraud databases.",
"snippet": "We receive data about you from third parties, including [business partners, credit reference agencies, fraud-prevention services, advertising networks and data providers]. [We received the following categories: [categories].]",
"law": "GDPR Art 14(1)(d) (categories of data), 14(2)(f) (source must be stated), Recital 61; APP 1.4(b), APP 5.2(b); CCPA §1798.110(c)(2) (categories of sources)",
"clause": "We receive personal data about you from [third_party_types].{if third_party_names} They include [third_party_names].{/if}{if third_party_types_more} We may receive data from other kinds of organisation in future.{/if} This data includes [third_party_data].{if art14_notice} [art14_notice]{/if}",
"vars": [
{
"name": "third_party_types",
"type": "multi",
"label": "What kinds of organisation send you data about people?",
"required": true,
"extensible": true,
"free": true,
"options": [
{
"value": "partners",
"label": "business partners"
},
{
"value": "credit",
"label": "credit reference agencies"
},
{
"value": "fraud",
"label": "fraud prevention services"
},
{
"value": "adnetworks",
"label": "advertising networks"
},
{
"value": "brokers",
"label": "data providers"
},
{
"value": "social",
"label": "social media platforms, when you log in through them"
},
{
"value": "payment",
"label": "payment providers"
},
{
"value": "delivery",
"label": "delivery companies"
},
{
"value": "identity",
"label": "identity verification providers"
},
{
"value": "employer",
"label": "your employer or organisation, for business accounts"
},
{
"value": "public_bodies",
"label": "public bodies"
}
]
},
{
"name": "third_party_names",
"type": "multi",
"label": "Name specific organisations, if you want to",
"required": false,
"free": true,
"options": []
},
{
"name": "third_party_data",
"type": "multi",
"label": "Which categories of data do you receive from them?",
"required": true,
"options": "@data"
},
{
"name": "art14_notice",
"type": "choice",
"label": "How do you tell people whose data did not come from them?",
"required": false,
"options": [
{
"value": "contact",
"label": "When we first contact them, and within 1 month at the latest",
"text": "We tell you about this when we first contact you, and in any case within 1 month of receiving your data."
},
{
"value": "publish",
"label": "We cannot contact everyone, so we publish this notice instead",
"text": "We cannot contact everyone whose data we receive this way, so we publish this notice instead."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Article 14(3) GDPR: within 1 month, at first contact, or at first disclosure, whichever is earliest. Choose \"publish\" only where telling everyone is impossible or a disproportionate effort (Article 14(5)(b))."
}
],
"conditions": "source.third-party",
"asks": {
"step": 4,
"q": "Do you get data about people from other organisations, for example partners or credit reference agencies?",
"why": "When data does not come from the person, the GDPR requires you to say its source and the categories you received.",
"links": {
"gdpr": "https://gdpr-info.eu/art-14-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/source.third-party.svg"
},
{
"id": "source.public",
"cat": "source",
"name": "Publicly accessible sources",
"desc": "Data from public registers, websites, social media profiles or other publicly accessible sources.",
"snippet": "We collect data from publicly accessible sources, such as [company registers, public social media profiles and websites].",
"law": "GDPR Art 14(1)(d), 14(2)(f) (publicly accessible sources must be flagged), Recital 61; APP 1.4(b), APP 5.2(b)",
"clause": "We collect personal data about you from publicly accessible sources, such as [public_sources].{if public_sources_more} We may use other public sources in future.{/if} This data includes [public_data].{if art14_notice} [art14_notice]{/if}",
"vars": [
{
"name": "public_sources",
"type": "multi",
"label": "Which public sources do you use?",
"required": true,
"extensible": true,
"free": true,
"options": [
{
"value": "company_registers",
"label": "company registers"
},
{
"value": "other_registers",
"label": "other public registers, for example land, charity, or insolvency registers"
},
{
"value": "websites",
"label": "public websites"
},
{
"value": "social",
"label": "public social media profiles"
},
{
"value": "news",
"label": "news and media"
},
{
"value": "directories",
"label": "professional directories"
}
]
},
{
"name": "public_data",
"type": "multi",
"label": "Which categories of data do you collect from them?",
"required": true,
"options": "@data"
},
{
"name": "art14_notice",
"type": "choice",
"label": "How do you tell people whose data did not come from them?",
"required": false,
"options": [
{
"value": "contact",
"label": "When we first contact them, and within 1 month at the latest",
"text": "We tell you about this when we first contact you, and in any case within 1 month of receiving your data."
},
{
"value": "publish",
"label": "We cannot contact everyone, so we publish this notice instead",
"text": "We cannot contact everyone whose data we receive this way, so we publish this notice instead."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Article 14(3) GDPR: within 1 month, at first contact, or at first disclosure, whichever is earliest. Choose \"publish\" only where telling everyone is impossible or a disproportionate effort (Article 14(5)(b))."
}
],
"conditions": "source.public",
"asks": {
"step": 4,
"q": "Do you collect data from public sources, such as company registers or public social media profiles?",
"why": "The GDPR requires you to tell people the source of data they did not give you, including public sources.",
"links": {
"gdpr": "https://gdpr-info.eu/art-14-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/source.public.svg"
},
{
"id": "source.other-users",
"cat": "source",
"name": "From other users",
"desc": "Data about you provided by other users, such as contacts uploaded, referrals, tags or mentions.",
"snippet": "We may receive data about you from other users, for example when they [share their contacts, refer you to us, or tag you in content].",
"law": "GDPR Art 14(1)(d), 14(2)(f), 14(3), Recital 61; APP 1.4(b), APP 5.2(b)",
"clause": "We receive personal data about you from other users of [service_name]{if other_user_ways_more}, for example{/if} when they [other_user_ways].{if other_user_ways_more} We may add other features that work this way in future.{/if} This data includes [other_user_data].{if art14_notice} [art14_notice]{/if}",
"vars": [
{
"name": "service_name",
"type": "text",
"label": "Name of the service",
"required": true,
"shared": true,
"validation": {
"max": 100
}
},
{
"name": "other_user_ways",
"type": "multi",
"label": "How do other users give you data about people?",
"required": true,
"extensible": true,
"free": true,
"options": [
{
"value": "contacts",
"label": "upload or sync their contacts"
},
{
"value": "refer",
"label": "refer or invite you"
},
{
"value": "tag",
"label": "tag or mention you in content"
},
{
"value": "message",
"label": "send you a message"
},
{
"value": "share",
"label": "share content that includes you"
},
{
"value": "nominate",
"label": "give your details as a contact, guarantor, or emergency contact"
}
],
"hint": "Each entry completes the sentence \"when they ...\"."
},
{
"name": "other_user_data",
"type": "multi",
"label": "Which categories of data do you receive this way?",
"required": true,
"options": "@data"
},
{
"name": "art14_notice",
"type": "choice",
"label": "How do you tell people whose data did not come from them?",
"required": false,
"options": [
{
"value": "contact",
"label": "When we first contact them, and within 1 month at the latest",
"text": "We tell you about this when we first contact you, and in any case within 1 month of receiving your data."
},
{
"value": "publish",
"label": "We cannot contact everyone, so we publish this notice instead",
"text": "We cannot contact everyone whose data we receive this way, so we publish this notice instead."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Article 14(3) GDPR: within 1 month, at first contact, or at first disclosure, whichever is earliest. Choose \"publish\" only where telling everyone is impossible or a disproportionate effort (Article 14(5)(b))."
}
],
"conditions": "source.other-users",
"asks": {
"step": 4,
"q": "Do other users give you data about people, for example by uploading contacts or tagging them?",
"why": "Data given by other users falls under Article 14, so you must say you receive it and what it includes.",
"links": {
"gdpr": "https://gdpr-info.eu/art-14-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/source.other-users.svg"
},
{
"id": "source.generated",
"cat": "source",
"name": "Generated by us",
"desc": "Data created by our systems about you, such as account IDs, transaction records, scores or logs.",
"snippet": "We generate data about you in the course of providing our services, such as [account identifiers, order records and service logs].",
"law": "GDPR Art 4(1), 4(2); APP 1.4(a); CCPA §1798.140(v)(1)(K) (inferences)",
"clause": "We create personal data about you as we provide [service_name], such as [generated_kinds].{if generated_kinds_more} We may create other kinds of data in future.{/if}",
"vars": [
{
"name": "service_name",
"type": "text",
"label": "Name of the service",
"required": true,
"shared": true,
"validation": {
"max": 100
}
},
{
"name": "generated_kinds",
"type": "multi",
"label": "What data do your systems create about people?",
"required": true,
"extensible": true,
"free": true,
"options": [
{
"value": "ids",
"label": "account identifiers"
},
{
"value": "orders",
"label": "order and transaction records"
},
{
"value": "support",
"label": "support tickets and notes"
},
{
"value": "logs",
"label": "service and security logs"
},
{
"value": "usage",
"label": "usage statistics"
},
{
"value": "scores",
"label": "scores and assessments"
},
{
"value": "history",
"label": "your history of using the service"
}
]
}
],
"conditions": "source.generated",
"asks": {
"step": 4,
"q": "Do your systems create data about people, for example account IDs, order records, or logs?",
"why": "Data you create about people is personal data under the GDPR, and Australian and Californian law require the kinds of data held to be listed.",
"links": {
"gdpr": "https://gdpr-info.eu/art-4-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/"
}
},
"g16": "",
"file": "icons/source.generated.svg"
},
{
"id": "purpose.service",
"cat": "purpose",
"name": "Providing the service",
"desc": "Operating the website, app or service you have asked for, including delivering orders and features.",
"snippet": "To provide our [products/services] to you, including [processing orders, delivering content and operating core features].",
"law": "GDPR Art 6(1)(b); APP 6.1 (primary purpose); CCPA §1798.140(e)(5) (business purpose: servicing accounts, fulfilling orders, processing payments)",
"clause": "We use your personal data to provide [service_scope] to you, including [service_activities].{if service_activities_more} We may add other features in future.{/if}",
"vars": [
{
"name": "service_scope",
"type": "choice",
"label": "What do you provide?",
"required": true,
"options": [
{
"value": "products",
"label": "Products",
"text": "our products"
},
{
"value": "services",
"label": "Services",
"text": "our service"
},
{
"value": "both",
"label": "Products and services",
"text": "our products and services"
}
]
},
{
"name": "service_activities",
"type": "multi",
"label": "What does providing the service involve?",
"required": true,
"options": [
{
"value": "orders",
"label": "Processing orders",
"text": "processing your orders"
},
{
"value": "content",
"label": "Delivering content",
"text": "delivering content to you"
},
{
"value": "features",
"label": "Operating core features",
"text": "operating the features you use"
},
{
"value": "digital",
"label": "Delivering digital goods or downloads",
"text": "delivering digital goods"
},
{
"value": "bookings",
"label": "Managing bookings",
"text": "managing your bookings"
},
{
"value": "access",
"label": "Giving access to paid areas",
"text": "giving you access to paid areas"
}
],
"free": true,
"extensible": true
}
],
"conditions": "purpose.service",
"asks": {
"step": 5,
"q": "Do you use personal data to provide your products or services to people?",
"why": "The GDPR requires you to state each purpose, and providing a service someone asked for normally rests on the contract basis.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/contract/"
}
},
"g16": "",
"file": "icons/purpose.service.svg"
},
{
"id": "purpose.account",
"cat": "purpose",
"name": "Account management",
"desc": "Creating and administering your account, authentication and keeping your details up to date.",
"snippet": "To create and manage your account, verify your identity when you log in and keep your details up to date.",
"law": "GDPR Art 6(1)(b); APP 6.1",
"clause": "We use your personal data to create and manage your account. We check your identity when you log in and keep your details up to date.",
"vars": [],
"conditions": "purpose.account",
"asks": {
"step": 5,
"q": "Do people create accounts with you?",
"why": "Running an account is a purpose the GDPR requires you to state, normally under the contract basis.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/contract/"
}
},
"g16": "",
"file": "icons/purpose.account.svg"
},
{
"id": "purpose.payment",
"cat": "purpose",
"name": "Processing payments",
"desc": "Taking payment, issuing refunds, invoicing and keeping accounting records.",
"snippet": "To process payments and refunds, issue invoices and maintain accounting records.",
"law": "GDPR Art 6(1)(b), (c); APP 6.1",
"clause": "We use your personal data to [payment_activities].{if payment_records} We keep accounting and tax records of these transactions.{/if}",
"vars": [
{
"name": "payment_activities",
"type": "multi",
"label": "What do you do with payment data?",
"required": true,
"options": [
{
"value": "take",
"label": "Take payments",
"text": "take payments"
},
{
"value": "refund",
"label": "Make refunds",
"text": "make refunds"
},
{
"value": "invoice",
"label": "Issue invoices and receipts",
"text": "issue invoices and receipts"
},
{
"value": "verify",
"label": "Check payments have cleared",
"text": "check that payments have cleared"
}
]
},
{
"name": "payment_records",
"type": "choice",
"label": "Do you keep accounting and tax records of transactions?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes"
},
{
"value": "none",
"label": "No"
}
],
"default": "yes",
"hint": "Taking a payment rests on the contract. Keeping accounting and tax records is normally a legal obligation, stated under Legal compliance."
}
],
"conditions": "purpose.payment",
"asks": {
"step": 5,
"q": "Do you take payments, make refunds, or issue invoices?",
"why": "Taking payment rests on the contract basis, and keeping accounting records is a legal obligation the GDPR requires you to state.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/legal-obligation/"
}
},
"g16": "",
"file": "icons/purpose.payment.svg"
},
{
"id": "purpose.support",
"cat": "purpose",
"name": "Customer support",
"desc": "Responding to enquiries, complaints and requests, and keeping a record of them.",
"snippet": "To respond to your enquiries, complaints and requests and to keep a record of our communications with you.",
"law": "GDPR Art 6(1)(b), (f); APP 6.1",
"clause": "We use your personal data to respond to your enquiries, complaints, and requests.{if support_record} We keep a record of our communications with you.{/if}",
"vars": [
{
"name": "support_record",
"type": "choice",
"label": "Do you keep a record of communications?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes"
},
{
"value": "none",
"label": "No"
}
],
"default": "yes"
}
],
"conditions": "purpose.support",
"asks": {
"step": 5,
"q": "Do you handle enquiries, complaints, or requests from people?",
"why": "Handling enquiries is a purpose the GDPR requires you to state, under the contract or legitimate interests basis.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/"
}
},
"g16": "",
"file": "icons/purpose.support.svg"
},
{
"id": "purpose.notifications",
"cat": "purpose",
"name": "Service communications",
"desc": "Sending administrative messages such as order confirmations, security alerts and changes to terms.",
"snippet": "To send you service messages, such as [order confirmations, security alerts, reminders and notices of changes to our terms or this policy]. These are part of providing the service and are not marketing messages.",
"law": "GDPR Art 6(1)(b), (c); ePrivacy Directive Art 13 (not marketing)",
"clause": "We send you service messages, such as [service_message_types]{if service_message_channel}, by [service_message_channel]{/if}.{if service_message_types_more} We may send other service messages in future.{/if} These are part of providing the service and are not marketing.",
"vars": [
{
"name": "service_message_types",
"type": "multi",
"label": "Which service messages do you send?",
"required": true,
"options": [
{
"value": "order",
"label": "Order confirmations",
"text": "order confirmations"
},
{
"value": "delivery",
"label": "Delivery updates",
"text": "delivery updates"
},
{
"value": "security",
"label": "Security alerts",
"text": "security alerts"
},
{
"value": "reminders",
"label": "Reminders",
"text": "reminders"
},
{
"value": "billing",
"label": "Billing notices",
"text": "billing notices"
},
{
"value": "terms",
"label": "Notices of changes to our terms or this policy",
"text": "notices of changes to our terms or this policy"
}
],
"extensible": true
},
{
"name": "service_message_channel",
"type": "multi",
"label": "How do you send service messages?",
"required": false,
"options": [
{
"value": "email",
"label": "Email",
"text": "email"
},
{
"value": "sms",
"label": "SMS",
"text": "SMS"
},
{
"value": "push",
"label": "Push notification",
"text": "push notification"
},
{
"value": "in_app",
"label": "In-app messages",
"text": "in-app message"
},
{
"value": "post",
"label": "Post",
"text": "post"
}
],
"hint": "A push notification that carries an offer is marketing, not a service message."
}
],
"conditions": "purpose.notifications",
"asks": {
"step": 5,
"q": "Do you send service messages, such as confirmations, security alerts, or notices of changes?",
"why": "Service messages are not direct marketing under the ePrivacy rules, but the GDPR still requires you to state the purpose.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/"
}
},
"g16": "",
"file": "icons/purpose.notifications.svg"
},
{
"id": "purpose.marketing",
"cat": "purpose",
"name": "Direct marketing",
"desc": "Sending newsletters, offers and promotional messages by email, SMS, post or telephone.",
"snippet": "To send you marketing communications about [our products and services / those of our partners] by [email/SMS/post/telephone], [with your consent / where you are an existing customer and have not opted out]. You can opt out at any time by [clicking unsubscribe / contacting us].",
"law": "GDPR Art 6(1)(a) or (f), Recital 47, Art 21(2); ePrivacy Directive Art 13(1) to (3); PECR reg 22(2) and (3) (UK); UK GDPR Art 6(11)(a) (inserted by DUAA 2025: direct marketing as an example legitimate interest); Spam Act 2003 (Cth) s 16; CAN-SPAM (US), 15 USC 7704; ePrivacy Directive Art 5(3) and PECR reg 6 (tracking pixels in emails; EDPB Guidelines 2/2023 v2.0 para 48)",
"clause": "We send you marketing about [marketing_scope]{if marketing_channel_more}, normally{/if} by [marketing_channel].{if marketing_channel_more} We may use other methods in future.{/if}{if email_tracking} [email_tracking]{/if}{if @basis.purpose.marketing=basis.consent} We do this only with your consent.{else} We do this if you are an existing customer and have not opted out. We send only marketing about our own similar products and services. We offer a way to opt out when we collect your details and when we contact you.{/if}",
"vars": [
{
"name": "marketing_scope",
"type": "choice",
"label": "What do you market?",
"required": true,
"options": [
{
"value": "own",
"label": "Our own products and services",
"text": "our products and services"
},
{
"value": "own_partners",
"label": "Ours and selected partners' products",
"text": "our products and services and those of selected partners"
}
],
"hint": "Partners' products cannot be marketed under the existing-customer (soft opt-in) branch by email, SMS, or other electronic messages: ePrivacy Art 13(2) and PECR reg 22(3) cover your own similar products and services only."
},
{
"name": "marketing_channel",
"type": "multi",
"label": "Which channels do you use?",
"required": true,
"extensible": true,
"options": [
{
"value": "email",
"label": "Email"
},
{
"value": "sms",
"label": "SMS"
},
{
"value": "post",
"label": "Post"
},
{
"value": "telephone",
"label": "Telephone"
},
{
"value": "push",
"label": "Push notification"
},
{
"value": "in_app",
"label": "In-app messages"
}
]
},
{
"name": "email_tracking",
"type": "choice",
"label": "Do your emails track whether they are opened or which links are clicked?",
"required": false,
"options": [
{
"value": "yes",
"label": "Yes",
"text": "Our emails tell us whether you open them and which links you click."
},
{
"value": "none",
"label": "No",
"text": ""
}
],
"hint": "Tracking pixels and tracked links in emails are covered by the cookie rules (EDPB Guidelines 2/2023 para 48, PECR reg 6). Yes adds them to your cookie list on step 4."
}
],
"conditions": "purpose.marketing",
"asks": {
"step": 5,
"q": "Do you send people marketing messages?",
"why": "The GDPR and ePrivacy rules require you to say how you market and on what basis.",
"links": {
"gdpr": "https://gdpr-info.eu/art-21-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/"
}
},
"g16": "",
"file": "icons/purpose.marketing.svg"
},
{
"id": "purpose.advertising",
"cat": "purpose",
"name": "Advertising",
"desc": "Showing adverts, chosen from the content being viewed or from a person's interests, behaviour or profile, and measuring and attributing their results.",
"snippet": "To show you personalised advertising based on your [browsing activity, interests and profile], on our services and on third-party sites, [with your consent]. This involves sharing identifiers with advertising partners; see 'Recipients' and our Cookie Policy.",
"law": "GDPR Art 6(1)(a), Art 22; ePrivacy Directive Art 5(3); Digital Services Act Arts 26(1)(d), 28(2); CCPA §1798.140(k) (cross-context behavioral advertising), §1798.120",
"clause": "{if advertising_activities}We use your personal data for [advertising_activities].{/if}{if ad_signals} We show you personalised advertising based on your [ad_signals], on our service{if ad_other_sites} and on other websites and apps{/if}. This involves sharing identifiers with advertising partners.{/if}{if @basis.purpose.advertising=basis.consent} We do this only with your consent.{/if}{if ad_params} [ad_params]{/if}{if ad_minors} [ad_minors]{/if}",
"vars": [
{
"name": "advertising_activities",
"type": "multi",
"label": "What advertising activities do you carry out?",
"required": false,
"options": [
{
"value": "contextual",
"label": "Contextual adverts, chosen from the content being viewed",
"text": "contextual advertising, based on the content you are viewing"
},
{
"value": "targeting",
"label": "Personalised adverts, chosen from a person's interests or behaviour",
"text": "personalised advertising"
},
{
"value": "measurement",
"label": "Measuring how adverts perform",
"text": "measuring how our adverts perform"
},
{
"value": "attribution",
"label": "Working out which adverts led to a visit or purchase",
"text": "working out which adverts led to a visit or purchase"
}
],
"hint": "Choose personalised adverts if you also answer the next question. Contextual adverts still use device data such as your visitor's IP address or cookies."
},
{
"name": "ad_signals",
"type": "multi",
"label": "What is the advertising based on?",
"required": false,
"options": [
{
"value": "browsing",
"label": "Browsing activity on our service",
"text": "browsing activity"
},
{
"value": "interests",
"label": "Interests",
"text": "interests"
},
{
"value": "profile",
"label": "Profile",
"text": "profile"
},
{
"value": "purchases",
"label": "Purchase history",
"text": "purchase history"
},
{
"value": "location",
"label": "Approximate location",
"text": "approximate location"
},
{
"value": "demographic",
"label": "Age and other demographic details",
"text": "demographic details"
}
],
"hint": "Answer only for personalised adverts."
},
{
"name": "ad_other_sites",
"type": "choice",
"label": "Do you show these adverts on other websites and apps too?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes, on other sites and apps"
},
{
"value": "none",
"label": "No"
}
],
"default": "none"
},
{
"name": "ad_params",
"type": "choice",
"label": "Does each advert show why the person is seeing it and how to change that?",
"required": false,
"options": [
{
"value": "yes",
"label": "Yes",
"text": "Each advert shows why you are seeing it and how to change the settings."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "The Digital Services Act (Art 26(1)(d)) requires online platforms to give this information with each advert."
},
{
"name": "ad_minors",
"type": "choice",
"label": "Do you stop showing personalised adverts to people you know are under 18?",
"required": false,
"options": [
{
"value": "yes",
"label": "Yes",
"text": "We do not show personalised advertising to people we know to be under 18."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "The Digital Services Act (Art 28(2)) bans profiling-based adverts to recipients the platform knows with reasonable certainty to be minors."
}
],
"conditions": "purpose.advertising",
"asks": {
"step": 5,
"q": "Do you show adverts, or measure how adverts perform?",
"why": "Personalised advertising needs consent under ePrivacy rules where it uses cookies or device data, and the GDPR requires the purpose to be stated.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/"
}
},
"g16": "",
"file": "icons/purpose.advertising.svg"
},
{
"id": "purpose.analytics",
"cat": "purpose",
"name": "Analytics",
"desc": "Measuring how the service is used in order to understand audiences, performance and errors.",
"snippet": "To analyse how our [website/app] is used, measure the performance of our content and diagnose errors, [using [analytics provider]] [with your consent / on the basis of our legitimate interests].",
"law": "GDPR Art 6(1)(a) or (f); ePrivacy Directive Art 5(3); PECR reg 6 and Sch A1 paras 2, 4 and 5 (UK, substituted by DUAA 2025 from 5 February 2026; para 5 allows first-party statistics without consent if information and a simple means of objecting are given)",
"clause": "We analyse how our [service_kind] is used, measure how our content performs, and diagnose errors.{if analytics_provider} We use [analytics_provider] for this.{/if}{if @basis.purpose.analytics=basis.consent} We do this only with your consent.{/if}",
"vars": [
{
"name": "service_kind",
"type": "choice",
"label": "Is your service a website, an app, or both?",
"required": true,
"shared": true,
"default": "website",
"options": [
{
"value": "website",
"label": "Website",
"text": "website"
},
{
"value": "app",
"label": "App",
"text": "app"
},
{
"value": "both",
"label": "Website and app",
"text": "website and app"
}
]
},
{
"name": "analytics_provider",
"type": "multi",
"label": "Which analytics tools do you use, if you want to name them?",
"required": false,
"options": [
{
"value": "google_analytics",
"label": "Google Analytics"
},
{
"value": "matomo",
"label": "Matomo"
},
{
"value": "plausible",
"label": "Plausible"
},
{
"value": "fathom",
"label": "Fathom"
},
{
"value": "mixpanel",
"label": "Mixpanel"
},
{
"value": "amplitude",
"label": "Amplitude"
},
{
"value": "hotjar",
"label": "Hotjar"
},
{
"value": "adobe",
"label": "Adobe Analytics"
}
],
"free": true
}
],
"conditions": "purpose.analytics",
"asks": {
"step": 5,
"q": "Do you measure how people use your website or app?",
"why": "Analytics that reads cookies or device data needs consent under ePrivacy rules, except UK first-party statistics, and the GDPR requires the purpose stated.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/"
}
},
"g16": "",
"file": "icons/purpose.analytics.svg"
},
{
"id": "purpose.personalisation",
"cat": "purpose",
"name": "Personalisation",
"desc": "Tailoring content, recommendations and the user experience to you.",
"snippet": "To personalise your experience, including [recommending content and products, remembering your preferences and tailoring what you see].",
"law": "GDPR Art 6(1)(b) or (f), Art 22; Digital Services Act Art 27 (recommender systems) (main parameters and options to change them, Art 27(1), (2))",
"clause": "We tailor the service to you, including [personalisation_activities].{if personalisation_activities_more} We may personalise other parts of the service in future.{/if}{if rec_criteria} We rank recommendations mainly by [rec_criteria].{if rec_reason} We weight them this way because [rec_reason].{/if}{if rec_options} You can change how we rank content [rec_options].{/if}{/if}",
"vars": [
{
"name": "personalisation_activities",
"type": "multi",
"label": "How do you personalise the service?",
"required": true,
"options": [
{
"value": "content",
"label": "Recommending content",
"text": "recommending content"
},
{
"value": "products",
"label": "Recommending products",
"text": "recommending products"
},
{
"value": "preferences",
"label": "Remembering your preferences",
"text": "remembering your preferences"
},
{
"value": "saved",
"label": "Remembering wishlists and saved items",
"text": "remembering your wishlists and saved items"
},
{
"value": "tailor",
"label": "Tailoring what you see",
"text": "tailoring what you see"
},
{
"value": "locale",
"label": "Showing content for your language and region",
"text": "showing content for your language and region"
}
],
"extensible": true
},
{
"name": "rec_criteria",
"type": "multi",
"label": "Which criteria matter most in your recommendations?",
"required": false,
"options": [
{
"value": "viewed",
"label": "What the person has viewed or bought",
"text": "what you have viewed or bought"
},
{
"value": "follows",
"label": "What the person follows or likes",
"text": "what you follow or like"
},
{
"value": "recency",
"label": "How recent an item is",
"text": "how recent an item is"
},
{
"value": "popularity",
"label": "How popular an item is",
"text": "how popular an item is"
},
{
"value": "locale",
"label": "Location and language",
"text": "your location and language"
},
{
"value": "similar_users",
"label": "What similar users engaged with",
"text": "what similar users engaged with"
},
{
"value": "paid",
"label": "Whether the item is paid promotion",
"text": "whether the item is paid promotion"
}
],
"hint": "The Digital Services Act (Art 27) requires online platforms to state the main parameters of their recommender systems and any options to change them."
},
{
"name": "rec_reason",
"type": "text",
"label": "Why are these criteria weighted this way?",
"required": false,
"validation": {
"max": 200
},
"hint": "For example 'recent and popular items are more likely to interest most people'."
},
{
"name": "rec_options",
"type": "choice",
"label": "How can people change how content is ranked?",
"required": false,
"options": [
{
"value": "settings",
"label": "In their privacy settings",
"text": "in your settings{if privacy_settings_url} at [privacy_settings_url]{/if}"
},
{
"value": "feed",
"label": "By choosing a non-personalised feed",
"text": "by choosing a non-personalised feed"
},
{
"value": "controls",
"label": "With controls shown next to recommendations",
"text": "by adjusting the controls shown next to recommendations"
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
},
{
"name": "privacy_settings_url",
"type": "url",
"label": "Link to your privacy settings page, if you have one",
"required": false,
"shared": true,
"validation": {
"https": true
}
}
],
"conditions": "purpose.personalisation",
"asks": {
"step": 5,
"q": "Do you tailor content, recommendations, or the experience to each person?",
"why": "Personalisation is a stated purpose under the GDPR and, where it involves profiling, must be explained in the policy.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/"
}
},
"g16": "",
"file": "icons/purpose.personalisation.svg"
},
{
"id": "purpose.security",
"cat": "purpose",
"name": "Security & fraud prevention",
"desc": "Protecting the service, detecting and preventing fraud, abuse and security incidents.",
"snippet": "To keep our services secure, prevent fraud and abuse, detect and investigate security incidents and enforce our terms.",
"law": "GDPR Art 6(1)(f), Recitals 47 (fraud prevention) and 49; UK GDPR Art 6(11)(c) (inserted by DUAA 2025: security of network and information systems as an example legitimate interest); CCPA §1798.140(e)(2)",
"clause": "We use your personal data to keep our service secure, prevent fraud and abuse, and investigate security incidents.{if security_enforce} We also use it to enforce our terms.{/if}",
"vars": [
{
"name": "security_enforce",
"type": "choice",
"label": "Do you also use data to enforce your terms of service?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes"
},
{
"value": "none",
"label": "No"
}
],
"default": "yes"
}
],
"conditions": "purpose.security",
"asks": {
"step": 5,
"q": "Do you use personal data to secure your service and prevent fraud or abuse?",
"why": "The GDPR recognises network security and fraud prevention as legitimate interests, and requires the purpose to be stated.",
"links": {
"gdpr": "https://gdpr-info.eu/recitals/no-49/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/"
}
},
"g16": "",
"file": "icons/purpose.security.svg"
},
{
"id": "purpose.compliance",
"cat": "purpose",
"name": "Legal & regulatory compliance",
"desc": "Meeting legal obligations such as tax, accounting, anti-money-laundering, consumer protection and responding to lawful requests.",
"snippet": "To comply with our legal obligations, including [tax and accounting rules, anti-money-laundering checks, consumer protection law and responding to lawful requests from authorities].",
"law": "GDPR Art 6(1)(c); APP 6.2(b); CCPA §1798.145(a)",
"clause": "We use your personal data to meet our legal obligations, including [compliance_obligations].{if compliance_obligations_more} We may have other legal duties in future.{/if}",
"vars": [
{
"name": "compliance_obligations",
"type": "multi",
"label": "Which legal obligations apply?",
"required": true,
"options": [
{
"value": "tax",
"label": "Tax and accounting rules",
"text": "tax and accounting rules"
},
{
"value": "aml",
"label": "Anti-money-laundering checks",
"text": "anti-money-laundering checks"
},
{
"value": "consumer",
"label": "Consumer protection law",
"text": "consumer protection law"
},
{
"value": "requests",
"label": "Responding to lawful requests from authorities",
"text": "responding to lawful requests from authorities"
},
{
"value": "sanctions",
"label": "Sanctions checks",
"text": "sanctions checks"
},
{
"value": "safety",
"label": "Product safety and recall rules",
"text": "product safety rules"
},
{
"value": "platform",
"label": "Platform reporting duties for sellers",
"text": "reporting duties that apply to online platforms"
}
],
"free": true,
"extensible": true
}
],
"conditions": "purpose.compliance",
"asks": {
"step": 5,
"q": "Do you process personal data to meet legal duties, such as tax or anti-money-laundering rules?",
"why": "Processing under a legal obligation must rest on a law that applies to you, and the GDPR requires you to state the purpose.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/legal-obligation/"
}
},
"g16": "",
"file": "icons/purpose.compliance.svg"
},
{
"id": "purpose.legal-claims",
"cat": "purpose",
"name": "Legal claims",
"desc": "Establishing, exercising or defending legal claims, and enforcing our rights and agreements.",
"snippet": "To establish, exercise or defend legal claims, enforce our agreements and protect our rights and those of others.",
"law": "GDPR Art 6(1)(f), Art 9(2)(f); APP 6.2(c) with Privacy Act 1988 (Cth) s 16A item 4 (permitted general situation: legal or equitable claim)",
"clause": "We use your personal data to establish, exercise, or defend legal claims, enforce our agreements, and protect our rights and those of others.",
"vars": [],
"conditions": "purpose.legal-claims",
"asks": {
"step": 5,
"q": "Do you keep or use personal data to deal with legal claims or enforce agreements?",
"why": "Defending legal claims is a legitimate interest under the GDPR and a purpose the policy must state.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/"
}
},
"g16": "",
"file": "icons/purpose.legal-claims.svg"
},
{
"id": "purpose.research",
"cat": "purpose",
"name": "Research & statistics",
"desc": "Producing aggregated statistics, surveys and research, including for public interest or scientific purposes.",
"snippet": "To carry out research and produce statistics about [our services and our users], [in aggregated or anonymised form wherever possible].",
"law": "GDPR Arts 5(1)(b), 89, Recital 159; APP 6.2",
"clause": "We carry out research and produce statistics about [research_subject].{if research_activities} This includes [research_activities].{if research_activities_more} We may add other research activities in future.{/if}{/if}{if research_form} [research_form]{/if}",
"vars": [
{
"name": "research_subject",
"type": "multi",
"label": "What is the research about?",
"required": true,
"options": [
{
"value": "services",
"label": "Our service",
"text": "our service"
},
{
"value": "users",
"label": "The people who use it",
"text": "the people who use it"
},
{
"value": "sector",
"label": "Our sector or market",
"text": "our sector"
},
{
"value": "public",
"label": "Public interest or scientific questions",
"text": "public interest questions"
}
]
},
{
"name": "research_activities",
"type": "multi",
"label": "What does your research involve?",
"required": false,
"options": [
{
"value": "recruitment",
"label": "Recruiting participants",
"text": "recruiting participants"
},
{
"value": "participation",
"label": "Running studies with participants",
"text": "running studies with participants"
},
{
"value": "follow_up",
"label": "Following up with participants after a study",
"text": "following up with participants after a study"
},
{
"value": "analysis",
"label": "Analysing research data",
"text": "analysing research data"
}
],
"extensible": true
},
{
"name": "research_form",
"type": "choice",
"label": "What form does the data take?",
"required": true,
"options": [
{
"value": "anonymised",
"label": "Anonymised or aggregated wherever possible",
"text": "We use anonymised or aggregated data for this wherever possible."
},
{
"value": "aggregate_only",
"label": "Results published only in aggregate",
"text": "We publish results only in aggregated form that does not identify you."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "anonymised"
}
],
"conditions": "purpose.research",
"asks": {
"step": 5,
"q": "Do you produce research or statistics from personal data?",
"why": "The GDPR allows research and statistics as compatible purposes only with safeguards such as minimisation and pseudonymisation.",
"links": {
"gdpr": "https://gdpr-info.eu/art-89-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/the-research-provisions/"
}
},
"g16": "",
"file": "icons/purpose.research.svg"
},
{
"id": "purpose.improvement",
"cat": "purpose",
"name": "Product development",
"desc": "Improving and developing our products, features and services, including testing.",
"snippet": "To improve and develop our [products and services], including [testing new features and analysing feedback].",
"law": "GDPR Art 6(1)(f); CCPA §1798.140(e)(8)",
"clause": "We use your personal data to improve and develop our [improvement_scope], including [improvement_activities].{if improvement_activities_more} We may use it for other development work in future.{/if}",
"vars": [
{
"name": "improvement_scope",
"type": "choice",
"label": "What do you develop?",
"required": true,
"options": [
{
"value": "products",
"label": "Products",
"text": "products"
},
{
"value": "services",
"label": "Services",
"text": "services"
},
{
"value": "both",
"label": "Products and services",
"text": "products and services"
}
]
},
{
"name": "improvement_activities",
"type": "multi",
"label": "What does this involve?",
"required": true,
"options": [
{
"value": "testing",
"label": "Testing new features",
"text": "testing new features"
},
{
"value": "feedback",
"label": "Analysing feedback",
"text": "analysing feedback"
},
{
"value": "bugs",
"label": "Finding and fixing faults",
"text": "finding and fixing faults"
},
{
"value": "usage",
"label": "Measuring how features are used",
"text": "measuring how features are used"
}
],
"extensible": true
}
],
"conditions": "purpose.improvement",
"asks": {
"step": 5,
"q": "Do you use personal data to improve or develop your products or services?",
"why": "Product improvement is normally a legitimate interest, and the GDPR requires the purpose to be stated and balanced against people's rights.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/"
}
},
"g16": "",
"file": "icons/purpose.improvement.svg"
},
{
"id": "purpose.ai-training",
"cat": "purpose",
"name": "AI & machine-learning training",
"desc": "Using data to train, test or improve artificial-intelligence or machine-learning models.",
"snippet": "To train, test and improve [our / third-party] artificial-intelligence and machine-learning models, [after removing direct identifiers / with your consent / on the basis of our legitimate interests].",
"law": "GDPR Arts 5(1)(b), 6(1)(a) or (f), 21; EDPB Opinion 28/2024 on AI models; EU AI Act (Reg 2024/1689); UK GDPR Art 6(1)(f)",
"clause": "We use [ai_training_data] to train, test, and improve [ai_model_owner] artificial intelligence models.{if ai_deidentify} [ai_deidentify]{/if}{if ai_model_hosting} [ai_model_hosting]{/if}{if ai_model_providers} The models are run by [ai_model_providers].{/if}{if @basis.purpose.ai-training=basis.consent} We do this only with your consent.{/if}",
"vars": [
{
"name": "ai_training_data",
"type": "multi",
"label": "Which data is used for training?",
"required": true,
"options": "@data"
},
{
"name": "ai_model_owner",
"type": "choice",
"label": "Whose models?",
"required": true,
"options": [
{
"value": "own",
"label": "Our own",
"text": "our own"
},
{
"value": "third",
"label": "Third-party",
"text": "third-party"
},
{
"value": "both",
"label": "Ours and third parties'",
"text": "our own and third-party"
}
]
},
{
"name": "ai_model_hosting",
"type": "choice",
"label": "If you use third-party models, where do they run?",
"required": false,
"options": [
{
"value": "self_hosted",
"label": "On our own systems (self-hosted)",
"text": "We run the third-party models on our own systems."
},
{
"value": "provider",
"label": "With the model provider",
"text": ""
}
],
"hint": "Self-hosted means you run the model yourself, for example open-weight models on your own servers or cloud account. Otherwise the provider runs it and receives the data."
},
{
"name": "ai_model_providers",
"type": "multi",
"label": "Which providers run the models?",
"required": false,
"free": true,
"options": [
{
"value": "anthropic",
"label": "Anthropic (Claude)",
"text": "Anthropic"
},
{
"value": "openai",
"label": "OpenAI (GPT)",
"text": "OpenAI"
},
{
"value": "google",
"label": "Google (Gemini, Vertex AI)",
"text": "Google"
},
{
"value": "alibaba",
"label": "Alibaba Cloud (Qwen)",
"text": "Alibaba Cloud"
},
{
"value": "aws",
"label": "Amazon Web Services (Bedrock, Nova)",
"text": "Amazon Web Services"
},
{
"value": "cohere",
"label": "Cohere",
"text": "Cohere"
},
{
"value": "deepseek",
"label": "DeepSeek",
"text": "DeepSeek"
},
{
"value": "meta",
"label": "Meta (Llama)",
"text": "Meta"
},
{
"value": "microsoft",
"label": "Microsoft (Azure AI Foundry, Azure OpenAI)",
"text": "Microsoft"
},
{
"value": "mistral",
"label": "Mistral AI",
"text": "Mistral AI"
},
{
"value": "xai",
"label": "xAI (Grok)",
"text": "xAI"
}
],
"hint": "Ordered by share of enterprise LLM API spend where known (Anthropic 40%, OpenAI 27%, Google 21%: Menlo Ventures, 9 December 2025); the rest alphabetically. Add any other provider."
},
{
"name": "ai_deidentify",
"type": "choice",
"label": "Do you remove identifiers before training?",
"required": true,
"options": [
{
"value": "remove",
"label": "We remove direct identifiers first",
"text": "We remove direct identifiers, such as names and email addresses, before training."
},
{
"value": "pseudonymise",
"label": "We pseudonymise the data first",
"text": "We pseudonymise the data before training."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
}
],
"conditions": "purpose.ai-training",
"asks": {
"step": 5,
"q": "Do you use personal data to train or improve AI or machine-learning models?",
"why": "Training AI on personal data needs a lawful basis and a stated purpose, and may need a data protection impact assessment.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/"
}
},
"g16": "",
"file": "icons/purpose.ai-training.svg"
},
{
"id": "purpose.recruitment",
"cat": "purpose",
"name": "Recruitment",
"desc": "Assessing job applications and managing the hiring process.",
"snippet": "To assess your application for employment, conduct interviews and, where relevant, carry out [background and reference] checks.",
"law": "GDPR Art 6(1)(b), (f); Art 88 (EU only: omitted from the UK GDPR); APP 6",
"clause": "We use your personal data to assess your job application, arrange interviews, and decide whether to offer you a role.{if recruitment_checks} Where the role requires it, we carry out [recruitment_checks].{/if}{if recruitment_retention} We keep unsuccessful applications for [recruitment_retention].{/if}{if recruitment_agency} As a recruitment agency, we also [recruitment_agency].{/if}",
"vars": [
{
"name": "recruitment_checks",
"type": "multi",
"label": "Which pre-employment checks do you carry out?",
"required": false,
"options": [
{
"value": "references",
"label": "Reference checks",
"text": "reference checks"
},
{
"value": "right_to_work",
"label": "Right-to-work checks",
"text": "right-to-work checks"
},
{
"value": "criminal",
"label": "Criminal record checks",
"text": "criminal record checks"
},
{
"value": "qualifications",
"label": "Qualification checks",
"text": "qualification checks"
},
{
"value": "credit",
"label": "Credit checks",
"text": "credit checks"
}
]
},
{
"name": "recruitment_retention",
"type": "period",
"label": "How long do you keep unsuccessful applications?",
"required": false,
"default": {
"n": 18,
"unit": "months"
},
"hint": "Leave blank to state this in the retention section instead."
},
{
"name": "recruitment_agency",
"type": "multi",
"label": "If you are a recruitment agency, what else do you do with candidates' data?",
"required": false,
"options": [
{
"value": "talent_pool",
"label": "Keep candidates in a talent pool for future roles",
"text": "keep your details in a talent pool for future roles"
},
{
"value": "matching",
"label": "Match candidates with clients' roles",
"text": "match you with roles our clients offer"
},
{
"value": "client_disclosure",
"label": "Send candidates' details to clients who may hire them",
"text": "send your details to clients who may hire you"
}
],
"hint": "Clients who receive candidates' details are separate recipients. Select the sharing practice for business counterparties too."
}
],
"conditions": "purpose.recruitment",
"asks": {
"step": 5,
"q": "Do you process job applications or run a hiring process?",
"why": "Recruitment data falls under the GDPR employment provisions, and criminal record checks need specific legal authority.",
"links": {
"gdpr": "https://gdpr-info.eu/art-88-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/recruitment-and-selection/"
}
},
"g16": "",
"file": "icons/purpose.recruitment.svg"
},
{
"id": "purpose.promotions",
"cat": "purpose",
"name": "Competitions & promotions",
"desc": "Running prize draws, competitions, loyalty schemes and similar promotions.",
"snippet": "To administer [competitions, prize draws and loyalty programmes] you enter, including contacting winners and fulfilling prizes.",
"law": "GDPR Art 6(1)(b); APP 6",
"clause": "We use your personal data to run the [promotion_types] you enter, including contacting winners and delivering prizes.{if promotion_publish} [promotion_publish]{/if}",
"vars": [
{
"name": "promotion_types",
"type": "multi",
"label": "Which promotions do you run?",
"required": true,
"options": [
{
"value": "competitions",
"label": "Competitions",
"text": "competitions"
},
{
"value": "prize_draws",
"label": "Prize draws",
"text": "prize draws"
},
{
"value": "giveaways",
"label": "Giveaways",
"text": "giveaways"
},
{
"value": "contests",
"label": "Contests of skill",
"text": "contests of skill"
}
]
},
{
"name": "promotion_publish",
"type": "choice",
"label": "Do you publish winners' details?",
"required": true,
"options": [
{
"value": "surname_county",
"label": "Surname and county, where rules require",
"text": "We publish the surname and county of winners where promotion rules require it."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
}
],
"conditions": "purpose.promotions",
"asks": {
"step": 5,
"q": "Do you run competitions, prize draws, or similar promotions?",
"why": "Running a promotion someone enters rests on the contract basis, and the GDPR requires the purpose to be stated.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/contract/"
}
},
"g16": "",
"file": "icons/purpose.promotions.svg"
},
{
"id": "purpose.community",
"cat": "purpose",
"name": "Social & community features",
"desc": "Enabling profiles, messaging, sharing and interaction between users.",
"snippet": "To enable social features, such as [public profiles, messaging, comments and sharing content with other users]. [Information you post publicly can be seen by anyone.]",
"law": "GDPR Art 6(1)(b); Digital Services Act",
"clause": "We provide social features, such as [community_features].{if community_features_more} We may add other social features in future.{/if}{if community_visibility} [community_visibility]{/if}",
"vars": [
{
"name": "community_features",
"type": "multi",
"label": "Which social features do you offer?",
"required": true,
"options": [
{
"value": "profiles",
"label": "Public profiles",
"text": "public profiles"
},
{
"value": "comments",
"label": "Comments",
"text": "comments"
},
{
"value": "sharing",
"label": "Sharing content with other users",
"text": "sharing content with other users"
},
{
"value": "groups",
"label": "Groups and forums",
"text": "groups and forums"
},
{
"value": "follow",
"label": "Following other users",
"text": "following other users"
},
{
"value": "reactions",
"label": "Likes and reactions",
"text": "likes and reactions"
}
],
"extensible": true
},
{
"name": "community_visibility",
"type": "choice",
"label": "Who can see what people post?",
"required": true,
"options": [
{
"value": "anyone",
"label": "Anyone, including people without an account",
"text": "Anything you post publicly can be seen by anyone, including people without an account."
},
{
"value": "members",
"label": "Registered users only",
"text": "Content you post can be seen by other registered users."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
}
],
"conditions": "purpose.community",
"asks": {
"step": 5,
"q": "Do people have profiles, post content, or interact with each other on your service?",
"why": "Social features are a stated purpose under the GDPR, and people must be told who can see what they post.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/online-safety-and-data-protection/"
}
},
"g16": "",
"file": "icons/purpose.community.svg"
},
{
"id": "purpose.messaging",
"cat": "purpose",
"name": "User-to-user messaging",
"desc": "Enabling users to send messages to each other; the content is stored to deliver it and may be reviewed for safety.",
"snippet": "We provide messaging between users. We store messages to deliver them [and to allow you to see your history], and may review them [only when reported / using automated tools] to detect abuse. [Messages are / are not end-to-end encrypted.]",
"law": "GDPR Art 6(1)(b), (c), (f); ePrivacy Directive Art 5(1); Digital Services Act Arts 14 to 16",
"clause": "We provide messaging between users. We store your messages to deliver them{if messaging_history} and to show you your message history{/if}.{if messaging_review} [messaging_review]{if @basis.purpose.messaging=basis.legal-obligation} We do this because the law requires us to act on illegal content.{else} We do this to keep people safe and enforce our rules.{/if}{/if}{if messaging_encryption} [messaging_encryption]{/if}{if messaging_alerts} [messaging_alerts]{/if}",
"vars": [
{
"name": "messaging_history",
"type": "choice",
"label": "Do you keep messages so people can see their history?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes"
},
{
"value": "none",
"label": "No"
}
],
"default": "yes"
},
{
"name": "messaging_review",
"type": "choice",
"label": "Do you review message content?",
"required": true,
"options": [
{
"value": "reported",
"label": "Only when reported",
"text": "We review messages only when another user reports them, to detect abuse."
},
{
"value": "automated",
"label": "Automated scanning, with human review of flagged messages",
"text": "We scan messages with automated tools to detect abuse, and staff review flagged messages."
},
{
"value": "both",
"label": "Automated scanning and reports",
"text": "We scan messages with automated tools and review messages that other users report, to detect abuse."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
},
{
"name": "messaging_encryption",
"type": "choice",
"label": "Are messages end-to-end encrypted?",
"required": true,
"options": [
{
"value": "e2e",
"label": "Yes",
"text": "Messages are end-to-end encrypted, so we cannot read their content."
},
{
"value": "not_e2e",
"label": "No",
"text": "Messages are not end-to-end encrypted."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
},
{
"name": "messaging_alerts",
"type": "choice",
"label": "How do you tell people about new messages?",
"required": false,
"options": [
{
"value": "push",
"label": "Push notification",
"text": "We tell you about new messages by push notification."
},
{
"value": "email",
"label": "Email",
"text": "We tell you about new messages by email."
},
{
"value": "both",
"label": "Push notification and email",
"text": "We tell you about new messages by push notification and email."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
}
],
"conditions": "purpose.messaging",
"asks": {
"step": 5,
"q": "Can people send messages to each other on your service?",
"why": "Private messages are confidential under the ePrivacy rules, so any review of their content must be explained and justified.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/online-safety-and-data-protection/"
}
},
"g16": "",
"file": "icons/purpose.messaging.svg"
},
{
"id": "purpose.moderation",
"cat": "purpose",
"name": "Content moderation & safety",
"desc": "Reviewing content and behaviour to enforce rules, remove illegal content and handle reports.",
"snippet": "We review content and account activity [using automated tools and human moderators] to enforce our rules, act on reports and remove illegal content.",
"law": "GDPR Art 6(1)(c), (f), Art 22; Digital Services Act Arts 14, 16, 17, 20; UK Online Safety Act 2023; Digital Services Act Art 14(1) (moderation policies and complaint procedure in the terms)",
"clause": "We moderate content and accounts to enforce our rules, act on reports, and remove illegal content. We review [moderation_scope]. We also check account activity.{if moderation_means} We use [moderation_means] to do this.{/if}{if moderation_terms} Our terms at [moderation_terms] explain our moderation rules and how to complain about a moderation decision.{/if}",
"vars": [
{
"name": "moderation_scope",
"type": "multi",
"label": "What do you review?",
"required": true,
"options": [
{
"value": "posts",
"label": "Posts and comments",
"text": "posts and comments"
},
{
"value": "media",
"label": "Images and video",
"text": "images and video"
},
{
"value": "profiles",
"label": "Profiles",
"text": "profiles"
},
{
"value": "listings",
"label": "Listings and adverts",
"text": "listings"
},
{
"value": "reviews",
"label": "Reviews",
"text": "reviews"
}
]
},
{
"name": "moderation_means",
"type": "choice",
"label": "Who or what does the reviewing?",
"required": true,
"options": [
{
"value": "automated",
"label": "Automated tools",
"text": "automated tools"
},
{
"value": "human",
"label": "Human moderators",
"text": "human moderators"
},
{
"value": "both",
"label": "Automated tools and human moderators",
"text": "automated tools and human moderators"
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "both"
},
{
"name": "moderation_terms",
"type": "url",
"label": "Link to the terms that explain your moderation rules and complaint process, if you have them",
"required": false,
"validation": {
"https": true
},
"hint": "The Digital Services Act (Art 14(1), 17, 20) places moderation rules, statements of reasons, and complaint handling in your terms, not in this policy. Check whether you have met your notice-and-takedown duties under Art 16(1) DSA for any hosting service you supply."
}
],
"conditions": "purpose.moderation",
"asks": {
"step": 5,
"q": "Do you moderate content or user behaviour on your service?",
"why": "Moderation must be explained as a purpose under the GDPR, and platforms have transparency duties under the Digital Services Act.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/online-safety-and-data-protection/content-moderation-and-data-protection/"
}
},
"g16": "",
"file": "icons/purpose.moderation.svg"
},
{
"id": "purpose.reviews",
"cat": "purpose",
"name": "Reviews & ratings",
"desc": "Publishing reviews, ratings or testimonials you submit, with your display name, and verifying that they are genuine.",
"snippet": "We publish reviews and ratings you submit together with your [display name / first name and initial] and may verify that they relate to a genuine [purchase/experience]. [We do not edit review content.]",
"law": "GDPR Art 6(1)(a), (b), (f); Unfair Commercial Practices Directive Annex I para 23b to 23c (fake reviews); Digital Services Act",
"clause": "We publish reviews and ratings you submit, together with your [review_name].{if review_verify} [review_verify]{/if}{if review_edit} [review_edit]{/if}",
"vars": [
{
"name": "review_name",
"type": "choice",
"label": "What name appears with a review?",
"required": true,
"options": [
{
"value": "display",
"label": "Display name",
"text": "display name"
},
{
"value": "first_initial",
"label": "First name and initial",
"text": "first name and initial"
},
{
"value": "full",
"label": "Full name",
"text": "full name"
},
{
"value": "chosen",
"label": "A name the reviewer chooses",
"text": "chosen name"
}
]
},
{
"name": "review_verify",
"type": "choice",
"label": "Do you check that reviews are genuine?",
"required": true,
"options": [
{
"value": "purchase",
"label": "Yes, against a purchase",
"text": "We check that each review relates to a genuine purchase before we publish it."
},
{
"value": "experience",
"label": "Yes, against a booking or experience",
"text": "We check that each review relates to a genuine booking or experience before we publish it."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Choose a check only if you take reasonable and proportionate steps to confirm that reviewers actually used or bought the product."
},
{
"name": "review_edit",
"type": "choice",
"label": "Do you edit or remove reviews?",
"required": true,
"options": [
{
"value": "no_edit",
"label": "We do not edit review content",
"text": "We do not edit the content of reviews."
},
{
"value": "remove_only",
"label": "We remove rule-breaking reviews but do not edit them",
"text": "We remove reviews that break our rules but do not change their content."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
}
],
"conditions": "purpose.reviews",
"asks": {
"step": 5,
"q": "Do you publish reviews, ratings, or testimonials that people submit?",
"why": "Publishing a review with a name is a stated purpose under the GDPR, and consumer law bans fake or unverified review claims.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/"
}
},
"g16": "",
"file": "icons/purpose.reviews.svg"
},
{
"id": "purpose.delivery",
"cat": "purpose",
"name": "Order fulfilment & delivery",
"desc": "Passing your name, address and contact details to warehouses and carriers to deliver goods, and tracking shipments.",
"snippet": "We share your name, delivery address and contact details with [our warehouse and carriers, for example [names]] to deliver your order and provide tracking updates.",
"law": "GDPR Art 6(1)(b), Art 13(1)(e)",
"clause": "We share your name, delivery address, and contact details with [delivery_recipients] to deliver your order and send tracking updates.{if delivery_names} They include [delivery_names].{/if}{if delivery_recipients_more} We may use other delivery partners in future.{/if}",
"vars": [
{
"name": "delivery_recipients",
"type": "multi",
"label": "Who delivers your goods?",
"required": true,
"options": [
{
"value": "warehouse",
"label": "Our warehouse",
"text": "our warehouse"
},
{
"value": "carriers",
"label": "Carriers and couriers",
"text": "carriers"
},
{
"value": "postal",
"label": "Postal services",
"text": "postal services"
},
{
"value": "fulfilment",
"label": "Fulfilment partners",
"text": "fulfilment partners"
},
{
"value": "drivers",
"label": "Local delivery drivers",
"text": "local delivery drivers"
}
],
"extensible": true
},
{
"name": "delivery_names",
"type": "multi",
"label": "Name your carriers, if you want to",
"required": false,
"options": [
{
"value": "royal_mail",
"label": "Royal Mail"
},
{
"value": "dhl",
"label": "DHL"
},
{
"value": "dpd",
"label": "DPD"
},
{
"value": "ups",
"label": "UPS"
},
{
"value": "fedex",
"label": "FedEx"
},
{
"value": "evri",
"label": "Evri"
},
{
"value": "gls",
"label": "GLS"
},
{
"value": "postnl",
"label": "PostNL"
}
],
"free": true
}
],
"conditions": "purpose.delivery",
"asks": {
"step": 5,
"q": "Do you pass customer details to warehouses or carriers to deliver goods?",
"why": "The GDPR requires you to name recipients or categories of recipients of personal data.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/"
}
},
"g16": "",
"file": "icons/purpose.delivery.svg"
},
{
"id": "purpose.returns-fraud",
"cat": "purpose",
"name": "Returns, refunds & chargebacks",
"desc": "Handling returns and refunds, and keeping records to detect abuse of return policies and chargeback fraud.",
"snippet": "We keep records of returns, refunds and chargebacks to process them and to detect abuse of our return policy, [and may share fraud-related data with [payment providers / fraud-prevention services]].",
"law": "GDPR Art 6(1)(b), (f), Recital 47",
"clause": "{if returns_activities}We keep records of returns, refunds, and chargebacks to [returns_activities].{else} We keep records of returns, refunds, and chargebacks to process them and to detect abuse of our returns policy.{/if}{if returns_share} We share fraud-related data with [returns_share].{/if}",
"vars": [
{
"name": "returns_activities",
"type": "multi",
"label": "Why do you keep records of returns, refunds, and chargebacks?",
"required": false,
"options": [
{
"value": "returns",
"label": "To process returns and refunds",
"text": "process them"
},
{
"value": "fraud",
"label": "To detect and investigate returns abuse and chargeback fraud",
"text": "detect and investigate abuse of our returns policy and chargeback fraud"
}
]
},
{
"name": "returns_share",
"type": "multi",
"label": "Who do you share fraud-related data with?",
"required": false,
"options": [
{
"value": "payment",
"label": "Payment providers",
"text": "payment providers"
},
{
"value": "fraud",
"label": "Fraud-prevention services",
"text": "fraud-prevention services"
},
{
"value": "schemes",
"label": "Card schemes",
"text": "card schemes"
},
{
"value": "banks",
"label": "Banks",
"text": "banks"
}
]
}
],
"conditions": "purpose.returns-fraud",
"asks": {
"step": 5,
"q": "Do you keep records to detect abuse of returns or chargeback fraud?",
"why": "The GDPR recognises fraud prevention as a legitimate interest, and requires you to state the purpose and any recipients.",
"links": {
"gdpr": "https://gdpr-info.eu/recitals/no-47/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/"
}
},
"g16": "",
"file": "icons/purpose.returns-fraud.svg"
},
{
"id": "purpose.loyalty",
"cat": "purpose",
"name": "Loyalty & rewards programme",
"desc": "Tracking purchases and activity to award and redeem points, tiers or rewards.",
"snippet": "If you join our [loyalty programme], we track your [purchases and activity] to award and redeem [points/rewards] and to tell you about programme benefits.",
"law": "GDPR Art 6(1)(b); Art 22 where tiering has significant effects",
"clause": "If you join our [loyalty_name], we track your [loyalty_tracked] to award and redeem [loyalty_rewards] and to tell you about programme benefits.{if loyalty_tiers} [loyalty_tiers]{/if}",
"vars": [
{
"name": "loyalty_name",
"type": "text",
"label": "What is the programme called?",
"required": true,
"validation": {
"max": 80
},
"default": "loyalty programme"
},
{
"name": "loyalty_tracked",
"type": "multi",
"label": "What do you track?",
"required": true,
"options": [
{
"value": "purchases",
"label": "Purchases",
"text": "purchases"
},
{
"value": "activity",
"label": "Activity on our service",
"text": "activity on our service"
},
{
"value": "visits",
"label": "Visits to our premises",
"text": "visits to our premises"
},
{
"value": "referrals",
"label": "Referrals",
"text": "referrals"
}
]
},
{
"name": "loyalty_rewards",
"type": "choice",
"label": "What do members earn?",
"required": true,
"options": [
{
"value": "points",
"label": "Points",
"text": "points"
},
{
"value": "rewards",
"label": "Rewards",
"text": "rewards"
},
{
"value": "tiers",
"label": "Points and tier status",
"text": "points and tier status"
},
{
"value": "discounts",
"label": "Discounts",
"text": "discounts"
}
]
},
{
"name": "loyalty_tiers",
"type": "choice",
"label": "Are tiers or rewards decided automatically?",
"required": true,
"options": [
{
"value": "auto",
"label": "Yes, automatically from activity",
"text": "Your tier and rewards are decided automatically from your activity."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
}
],
"conditions": "purpose.loyalty",
"asks": {
"step": 5,
"q": "Do you run a loyalty or rewards programme?",
"why": "A loyalty programme is a stated purpose under the contract basis, and automated tiering may need explanation as automated decision-making.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/contract/"
}
},
"g16": "",
"file": "icons/purpose.loyalty.svg"
},
{
"id": "purpose.referrals",
"cat": "purpose",
"name": "Referral & affiliate programmes",
"desc": "Tracking who referred whom, and paying or crediting referrers or affiliates.",
"snippet": "If you are referred by, or refer, another person we record the link between you to [credit the referrer / pay affiliate commission]. [Affiliate links use tracking cookies; see our Cookie Policy.]",
"law": "GDPR Art 6(1)(b), (f), Art 14 (data about the referred person); ePrivacy Directive Art 5(3)",
"clause": "If another person refers you, or you refer someone, we record the link between you to [referral_reason].{if referral_received} [referral_received]{/if}{if referral_cookies} Affiliate links use tracking cookies.{/if}",
"vars": [
{
"name": "referral_reason",
"type": "choice",
"label": "Why do you record referrals?",
"required": true,
"options": [
{
"value": "credit",
"label": "To credit the referrer",
"text": "credit the referrer"
},
{
"value": "commission",
"label": "To pay affiliate commission",
"text": "pay affiliate commission"
},
{
"value": "both",
"label": "Both",
"text": "credit the referrer or pay affiliate commission"
}
]
},
{
"name": "referral_received",
"type": "choice",
"label": "What do you receive about a referred person?",
"required": true,
"options": [
{
"value": "contact",
"label": "Name and contact details from the referrer",
"text": "If someone refers you, we receive your name and contact details from them."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
},
{
"name": "referral_cookies",
"type": "choice",
"label": "Do affiliate links use tracking cookies?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes"
},
{
"value": "none",
"label": "No"
}
],
"default": "none"
}
],
"conditions": "purpose.referrals",
"asks": {
"step": 5,
"q": "Do you run a referral or affiliate programme?",
"why": "The GDPR requires you to tell a referred person where their data came from, and affiliate cookies need consent under ePrivacy rules.",
"links": {
"gdpr": "https://gdpr-info.eu/art-14-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/"
}
},
"g16": "",
"file": "icons/purpose.referrals.svg"
},
{
"id": "purpose.subscriptions",
"cat": "purpose",
"name": "Subscriptions & recurring billing",
"desc": "Managing recurring payments, renewals, trials and cancellations.",
"snippet": "We manage your subscription, including [trial periods, renewals, payment retries and cancellation], and store your payment method with [payment provider] for recurring charges.",
"law": "GDPR Art 6(1)(b); PSD2; Consumer Rights Directive",
"clause": "We manage your subscription, including [subscription_activities].{if subscription_activities_more} We may add other subscription features in future.{/if}{if subscription_provider} Our payment provider, [subscription_provider], stores your payment method so that we can take recurring payments.{/if}",
"vars": [
{
"name": "subscription_activities",
"type": "multi",
"label": "What does managing subscriptions involve?",
"required": true,
"options": [
{
"value": "trials",
"label": "Trial periods",
"text": "trial periods"
},
{
"value": "renewals",
"label": "Renewals",
"text": "renewals"
},
{
"value": "retries",
"label": "Payment retries",
"text": "payment retries"
},
{
"value": "cancellation",
"label": "Cancellations",
"text": "cancellations"
},
{
"value": "changes",
"label": "Plan changes",
"text": "plan changes"
},
{
"value": "reminders",
"label": "Renewal reminders",
"text": "renewal reminders"
}
],
"extensible": true
},
{
"name": "subscription_provider",
"type": "multi",
"label": "Which payment provider stores payment methods?",
"required": false,
"options": [
{
"value": "stripe",
"label": "Stripe"
},
{
"value": "paypal",
"label": "PayPal"
},
{
"value": "braintree",
"label": "Braintree"
},
{
"value": "gocardless",
"label": "GoCardless"
},
{
"value": "adyen",
"label": "Adyen"
},
{
"value": "paddle",
"label": "Paddle"
},
{
"value": "apple",
"label": "Apple App Store"
},
{
"value": "google",
"label": "Google Play"
}
],
"free": true
}
],
"conditions": "purpose.subscriptions",
"asks": {
"step": 5,
"q": "Do you run subscriptions or take recurring payments?",
"why": "Recurring billing rests on the contract basis, and the GDPR requires you to state the purpose and name payment recipients.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/contract/"
}
},
"g16": "",
"file": "icons/purpose.subscriptions.svg"
},
{
"id": "purpose.donations",
"cat": "purpose",
"name": "Donations & fundraising",
"desc": "Processing donations, issuing receipts, claiming tax relief (for example Gift Aid) and contacting supporters about campaigns.",
"snippet": "We process your donation, issue receipts, [claim Gift Aid / tax relief where you have authorised it] and, [with your consent / unless you object], keep you informed about our work and fundraising.",
"law": "GDPR Art 6(1)(a), (b), (c), (f), Art 21(2); ePrivacy Directive Art 13; PECR reg 22(3A) (UK charity soft opt-in, inserted by DUAA 2025 from 5 February 2026); Charities (Protection and Social Investment) Act 2016 s 13 (UK fundraising regulation); Fundraising Regulator Code of Fundraising Practice (from 1 November 2025); HMRC Charities guidance Chapter 3.30 (Gift Aid records)",
"clause": "{if donation_activities}We use your personal data to [donation_activities].{else} We process your donation and issue receipts.{/if}{if @jurisdiction.uk}{if gift_aid} [gift_aid]{/if}{/if}{if tax_relief} [tax_relief]{/if}{if donor_channel} We contact supporters by [donor_channel].{if @basis.purpose.donations=basis.consent} We do this only with your consent.{else} We do this if you are an existing supporter and have not opted out.{/if}{/if}",
"vars": [
{
"name": "donation_activities",
"type": "multi",
"label": "What do you do with donors' data?",
"required": false,
"options": [
{
"value": "administration",
"label": "Processing donations and issuing receipts",
"text": "process your donation and issue receipts"
},
{
"value": "tax_relief",
"label": "Claiming tax relief, such as Gift Aid",
"text": "claim tax relief on your donation where you have authorised it"
},
{
"value": "supporter_comms",
"label": "Keeping supporters informed about your work and fundraising",
"text": "keep you informed about our work and fundraising",
"hint": "Supporter communications are direct marketing. Answer the channel question below."
}
]
},
{
"name": "gift_aid",
"type": "choice",
"label": "UK only: do you claim Gift Aid?",
"required": false,
"options": [
{
"value": "yes",
"label": "Yes, where the donor has authorised it",
"text": "Where you have authorised it, we claim Gift Aid on your donation and keep your declaration as HMRC requires."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
},
{
"name": "tax_relief",
"type": "choice",
"label": "Do you claim tax relief on donations outside the UK?",
"required": false,
"options": [
{
"value": "yes",
"label": "Yes, where the donor has authorised it",
"text": "Where you have authorised it, we claim tax relief on your donation."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Leave as not stated if you only claim UK Gift Aid."
},
{
"name": "donor_channel",
"type": "multi",
"label": "How do you keep supporters informed?",
"required": false,
"options": [
{
"value": "email",
"label": "Email",
"text": "email"
},
{
"value": "post",
"label": "Post",
"text": "post"
},
{
"value": "telephone",
"label": "Telephone",
"text": "telephone"
},
{
"value": "sms",
"label": "SMS",
"text": "SMS"
}
]
}
],
"conditions": "purpose.donations",
"asks": {
"step": 5,
"q": "Do you take donations or run fundraising?",
"why": "Processing a donation rests on contract and legal obligation, and fundraising messages are direct marketing under the ePrivacy rules.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/"
}
},
"g16": "",
"file": "icons/purpose.donations.svg"
},
{
"id": "purpose.membership",
"cat": "purpose",
"name": "Membership administration",
"desc": "Managing members, subscriptions, renewals, voting rights and member communications of an association, club or society.",
"snippet": "We administer your membership, including [applications, renewals, fees, voting and member communications], [and publish a members' directory visible to other members].",
"law": "GDPR Art 6(1)(b), (f); Art 9(2)(d) where the body has a political, philosophical, religious or trade-union aim",
"clause": "We manage your membership, including [membership_activities].{if membership_activities_more} We may add other membership services in future.{/if}{if membership_directory} [membership_directory]{/if}",
"vars": [
{
"name": "membership_activities",
"type": "multi",
"label": "What does membership administration involve?",
"required": true,
"options": [
{
"value": "applications",
"label": "Applications",
"text": "applications"
},
{
"value": "renewals",
"label": "Renewals",
"text": "renewals"
},
{
"value": "fees",
"label": "Fees",
"text": "fees"
},
{
"value": "voting",
"label": "Voting",
"text": "voting"
},
{
"value": "communications",
"label": "Member communications",
"text": "member communications"
},
{
"value": "benefits",
"label": "Member benefits",
"text": "member benefits"
}
],
"extensible": true
},
{
"name": "membership_directory",
"type": "choice",
"label": "Do you publish a members' directory?",
"required": true,
"options": [
{
"value": "members",
"label": "Yes, visible to other members",
"text": "We publish a members' directory that other members can see."
},
{
"value": "public",
"label": "Yes, visible to anyone",
"text": "We publish a members' directory that anyone can see."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
}
],
"conditions": "purpose.membership",
"asks": {
"step": 5,
"q": "Do you run a membership organisation, club, or society?",
"why": "Membership administration rests on the contract basis, and membership of a political, philosophical, religious, or trade-union body is special category data.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/"
}
},
"g16": "",
"file": "icons/purpose.membership.svg"
},
{
"id": "purpose.volunteers",
"cat": "purpose",
"name": "Volunteer management",
"desc": "Recruiting, vetting, scheduling and supporting volunteers, including safeguarding checks where required.",
"snippet": "We process volunteers' data to [recruit, vet, schedule, train and support] them, including [criminal record / safeguarding checks where the role requires it].",
"law": "GDPR Art 6(1)(b), (f); Art 10 for criminal record checks; UK DPA 2018 Sch 1 Part 2 para 18 (safeguarding)",
"clause": "We use volunteers' personal data to [volunteer_activities] them.{if volunteer_checks} Where the role requires it, we carry out [volunteer_checks].{/if}",
"vars": [
{
"name": "volunteer_activities",
"type": "multi",
"label": "What do you do with volunteers' data?",
"required": true,
"options": [
{
"value": "recruit",
"label": "Recruit",
"text": "recruit"
},
{
"value": "vet",
"label": "Vet",
"text": "vet"
},
{
"value": "schedule",
"label": "Schedule",
"text": "schedule"
},
{
"value": "train",
"label": "Train",
"text": "train"
},
{
"value": "support",
"label": "Support",
"text": "support"
}
]
},
{
"name": "volunteer_checks",
"type": "multi",
"label": "Which checks do you carry out?",
"required": false,
"options": [
{
"value": "criminal",
"label": "Criminal record checks",
"text": "criminal record checks"
},
{
"value": "safeguarding",
"label": "Safeguarding checks",
"text": "safeguarding checks"
},
{
"value": "references",
"label": "Reference checks",
"text": "reference checks"
},
{
"value": "identity",
"label": "Identity checks",
"text": "identity checks"
},
{
"value": "right_to_work",
"label": "Right-to-work checks",
"text": "right-to-work checks"
}
]
}
],
"conditions": "purpose.volunteers",
"asks": {
"step": 5,
"q": "Do you recruit or manage volunteers?",
"why": "Volunteer data is a stated purpose under the GDPR, and criminal record or safeguarding checks need specific legal authority.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/criminal-offence-data/"
}
},
"g16": "",
"file": "icons/purpose.volunteers.svg"
},
{
"id": "purpose.events",
"cat": "purpose",
"name": "Event administration",
"desc": "Registering attendees, managing tickets and access, and dietary and accessibility needs at events; photography and promotional use stated separately.",
"snippet": "We use your data to register you for events, manage tickets and access and accommodate [dietary and accessibility] needs. [Events may be photographed or recorded; you can tell us if you do not want to appear.]",
"law": "GDPR Art 6(1)(b), (f); Art 9 for dietary/accessibility needs revealing health or belief",
"clause": "We use your personal data to register you for events and manage tickets and access{if event_needs}, and to meet your [event_needs] needs{/if}.{if event_media} [event_media]{/if}{if event_publication} [event_publication]{/if}",
"vars": [
{
"name": "event_needs",
"type": "multi",
"label": "Which needs do you record?",
"required": false,
"options": [
{
"value": "dietary",
"label": "Dietary",
"text": "dietary"
},
{
"value": "accessibility",
"label": "Accessibility",
"text": "accessibility"
}
]
},
{
"name": "event_media",
"type": "choice",
"label": "Are events photographed or recorded?",
"required": true,
"options": [
{
"value": "notice",
"label": "Yes, and we tell people beforehand",
"text": "We tell you before an event if it will be photographed or recorded."
},
{
"value": "consent",
"label": "Yes, only with consent of those who appear",
"text": "We photograph or record events only with the consent of the people who appear."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
},
{
"name": "event_publication",
"type": "choice",
"label": "Do you use event photos or recordings in promotional material?",
"required": false,
"options": [
{
"value": "promotional",
"label": "Yes, in our promotional material",
"text": "We use photos and recordings from our events in our promotional material."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Promotional use is a separate purpose from running the event. Choose its basis on the next step."
}
],
"conditions": "purpose.events",
"asks": {
"step": 5,
"q": "Do you register people for events or bookings?",
"why": "Event registration rests on the contract basis, and dietary or accessibility needs can be health or belief data under the GDPR.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/"
}
},
"g16": "",
"file": "icons/purpose.events.svg"
},
{
"id": "purpose.campaigning",
"cat": "purpose",
"name": "Campaigning & advocacy",
"desc": "Contacting supporters about campaigns, petitions and actions, and reporting on participation.",
"snippet": "We contact supporters about [campaigns, petitions and actions] [with your consent / on the basis of our legitimate interests] and may [publish aggregate participation figures / pass petition signatures to [recipient]].",
"law": "GDPR Art 6(1)(a), (f); Art 9(2)(d) for political or philosophical bodies; ePrivacy Directive Art 13",
"clause": "We contact supporters about [campaign_topics] by [campaign_channel].{if @basis.purpose.campaigning=basis.consent} We do this only with your consent.{/if}{if campaign_publish} [campaign_publish]{/if}{if petition_recipient} We pass petition signatures to [petition_recipient].{/if}",
"vars": [
{
"name": "campaign_topics",
"type": "multi",
"label": "What do you contact supporters about?",
"required": true,
"options": [
{
"value": "campaigns",
"label": "Campaigns",
"text": "campaigns"
},
{
"value": "petitions",
"label": "Petitions",
"text": "petitions"
},
{
"value": "actions",
"label": "Actions",
"text": "actions"
},
{
"value": "events",
"label": "Events",
"text": "events"
}
],
"extensible": true
},
{
"name": "campaign_channel",
"type": "multi",
"label": "By which channels?",
"required": true,
"options": [
{
"value": "email",
"label": "Email",
"text": "email"
},
{
"value": "sms",
"label": "SMS",
"text": "SMS"
},
{
"value": "post",
"label": "Post",
"text": "post"
},
{
"value": "telephone",
"label": "Telephone",
"text": "telephone"
},
{
"value": "social",
"label": "Social media messages",
"text": "social media messages"
}
]
},
{
"name": "campaign_publish",
"type": "choice",
"label": "Do you publish participation figures?",
"required": true,
"options": [
{
"value": "aggregate",
"label": "Yes, aggregate figures only",
"text": "We publish only aggregate figures about participation, which do not identify you."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
},
{
"name": "petition_recipient",
"type": "text",
"label": "Who receives petition signatures, if anyone?",
"required": false,
"validation": {
"max": 200
},
"hint": "For example \"the UK Parliament\" or \"the European Commission\"."
}
],
"conditions": "purpose.campaigning",
"asks": {
"step": 5,
"q": "Do you contact supporters about campaigns, petitions, or actions?",
"why": "Campaign messages are direct marketing under the ePrivacy rules, and support for a cause can reveal political opinions under the GDPR.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-for-the-use-of-personal-data-in-political-campaigning-1/"
}
},
"g16": "",
"file": "icons/purpose.campaigning.svg"
},
{
"id": "purpose.marketplace",
"cat": "purpose",
"name": "Marketplace seller & buyer data",
"desc": "Sharing buyer details with independent sellers (and vice versa) so that they can complete transactions.",
"snippet": "When you buy from an independent seller on our platform we share your [name, delivery address and contact details] with the seller, who is a separate controller of that data. [Sellers' identity and tax details are collected to meet our platform obligations.]",
"law": "GDPR Art 6(1)(b), Art 13(1)(e), Art 26/28 allocation; DAC7 (Council Directive (EU) 2021/514) seller reporting; Digital Services Act Art 30 (trader traceability)",
"clause": "When you buy from an independent seller on our platform, we share your [marketplace_buyer_data] with the seller. The seller is a separate controller of that data and uses it under its own privacy policy.{if marketplace_seller_data} We collect sellers' [marketplace_seller_data] to meet our platform obligations.{/if}{if marketplace_disputes} [marketplace_disputes]{/if}",
"vars": [
{
"name": "marketplace_buyer_data",
"type": "multi",
"label": "What do sellers receive about buyers?",
"required": true,
"options": [
{
"value": "name",
"label": "Name",
"text": "name"
},
{
"value": "address",
"label": "Delivery address",
"text": "delivery address"
},
{
"value": "contact",
"label": "Contact details",
"text": "contact details"
},
{
"value": "order",
"label": "Order details",
"text": "order details"
}
]
},
{
"name": "marketplace_seller_data",
"type": "multi",
"label": "What do you collect from sellers to meet platform duties?",
"required": false,
"options": [
{
"value": "identity",
"label": "Identity details",
"text": "identity details"
},
{
"value": "tax",
"label": "Tax details",
"text": "tax details"
},
{
"value": "bank",
"label": "Bank details",
"text": "bank details"
},
{
"value": "registration",
"label": "Business registration details",
"text": "business registration details"
}
]
},
{
"name": "marketplace_disputes",
"type": "choice",
"label": "Do you help resolve disputes between buyers and sellers?",
"required": false,
"options": [
{
"value": "yes",
"label": "Yes",
"text": "If a buyer and a seller disagree, we use the details of the transaction to help resolve the dispute."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
}
],
"conditions": "purpose.marketplace",
"asks": {
"step": 5,
"q": "Do you run a marketplace where buyers deal with independent sellers?",
"why": "The GDPR requires you to name recipients, and marketplace sellers are normally separate controllers of buyer data.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/"
}
},
"g16": "",
"file": "icons/purpose.marketplace.svg"
},
{
"id": "purpose.surveys",
"cat": "purpose",
"name": "Surveys & feedback",
"desc": "Inviting you to complete surveys and using responses to improve services.",
"snippet": "We may invite you to take part in surveys and use your responses to [improve our services]. Participation is voluntary [and responses are analysed in aggregate].",
"law": "GDPR Art 6(1)(a), (f)",
"clause": "We invite you to take part in surveys and use your answers to [survey_use]. Taking part is voluntary.{if survey_aggregate} We analyse answers in aggregate and do not publish individual responses.{/if}",
"vars": [
{
"name": "survey_use",
"type": "choice",
"label": "What do you use survey answers for?",
"required": true,
"options": [
{
"value": "improve",
"label": "Improving our service",
"text": "improve our service"
},
{
"value": "satisfaction",
"label": "Measuring satisfaction",
"text": "measure satisfaction with our service"
},
{
"value": "needs",
"label": "Understanding what people want from us",
"text": "understand what people want from us"
}
]
},
{
"name": "survey_aggregate",
"type": "choice",
"label": "Do you analyse answers only in aggregate?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes"
},
{
"value": "none",
"label": "No"
}
],
"default": "none"
}
],
"conditions": "purpose.surveys",
"asks": {
"step": 5,
"q": "Do you invite people to complete surveys or give feedback?",
"why": "Surveys are a stated purpose under the GDPR, resting on consent or legitimate interests, and survey invitations by email fall under ePrivacy rules.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/"
}
},
"g16": "",
"file": "icons/purpose.surveys.svg"
},
{
"id": "purpose.integrations",
"cat": "purpose",
"name": "Third-party integrations & APIs",
"desc": "Exchanging your data with services you choose to connect (calendar, storage, payment, social) via API.",
"snippet": "If you connect a third-party service [such as [examples]] we exchange the data needed to make the integration work. The connected service processes that data under its own privacy policy.",
"law": "GDPR Art 6(1)(b), 13(1)(e); Art 20 (portability)",
"clause": "If you connect a third-party service{if integration_examples}, such as [integration_examples],{/if} we exchange the data needed to make the connection work{if integration_achieves}, for example to [integration_achieves]{/if}.{if integration_achieves_more} We may offer other connections in future.{/if} The connected service handles that data under its own privacy policy.",
"vars": [
{
"name": "integration_achieves",
"type": "multi",
"label": "What do the connections do?",
"required": false,
"options": [
{
"value": "calendar",
"label": "Synchronise calendars",
"text": "synchronise your calendar"
},
{
"value": "files",
"label": "Exchange files",
"text": "exchange files"
},
{
"value": "payment",
"label": "Take payments",
"text": "take payments"
},
{
"value": "sign_in",
"label": "Sign in with another account",
"text": "let you sign in with another account"
}
],
"extensible": true
},
{
"name": "integration_examples",
"type": "multi",
"label": "Name example services, if you want to",
"required": false,
"options": [
{
"value": "google_calendar",
"label": "Google Calendar"
},
{
"value": "microsoft_365",
"label": "Microsoft 365"
},
{
"value": "google_drive",
"label": "Google Drive"
},
{
"value": "dropbox",
"label": "Dropbox"
},
{
"value": "slack",
"label": "Slack"
},
{
"value": "zapier",
"label": "Zapier"
},
{
"value": "facebook",
"label": "Facebook"
},
{
"value": "stripe",
"label": "Stripe"
}
],
"free": true
}
],
"conditions": "purpose.integrations",
"asks": {
"step": 5,
"q": "Can people connect other services, such as calendars or storage, to your service?",
"why": "The GDPR requires you to name the recipients of personal data, including services a person chooses to connect.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/"
}
},
"g16": "",
"file": "icons/purpose.integrations.svg"
},
{
"id": "purpose.sales",
"cat": "purpose",
"name": "Sales enquiries and quotations",
"desc": "Answering enquiries from prospective customers, preparing quotations and proposals, and agreeing terms before a contract is made.",
"snippet": "To answer your enquiries about our [products/services], prepare [quotations and proposals], agree terms with you [and follow up on quotations we have sent] before any contract is made.",
"law": "GDPR Art 6(1)(b) (steps at the request of the data subject prior to entering into a contract), (f); Recital 44",
"clause": "We use your personal data to [sales_activities].{if sales_activities_more} We may add other steps in future.{/if} We do this before we enter into any contract with you or your organisation.",
"vars": [
{
"name": "sales_activities",
"type": "multi",
"label": "What do you do when people ask about buying from you?",
"required": true,
"options": [
{
"value": "enquiries",
"label": "Answering enquiries",
"text": "answer your enquiries about our products and services"
},
{
"value": "needs",
"label": "Understanding what the person needs",
"text": "understand what you need from us"
},
{
"value": "quotations",
"label": "Preparing quotations and proposals",
"text": "prepare quotations and proposals"
},
{
"value": "negotiation",
"label": "Agreeing terms",
"text": "agree terms with you"
},
{
"value": "follow_up",
"label": "Following up quotations you have sent",
"text": "follow up on quotations we have sent"
}
],
"extensible": true,
"hint": "Promotional campaigns belong under Direct marketing, not here."
}
],
"conditions": "purpose.sales",
"asks": {
"step": 5,
"q": "Do you answer sales enquiries or prepare quotations for people before they become customers?",
"why": "The GDPR requires you to state this purpose and its basis, usually contract for steps a person requests and legitimate interests for business contacts.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/contract/"
}
},
"g16": "",
"file": "icons/purpose.sales.svg"
},
{
"id": "purpose.engagements",
"cat": "purpose",
"name": "Client work and case administration",
"desc": "Carrying out work that clients engage a professional services firm to do, including client files, matter administration and conflict checks.",
"snippet": "We use your information to carry out the work you engage us to do, [keep client files, administer your matter and check for conflicts of interest before we act]. [We also hold information about other people involved in your matter, such as other parties and witnesses.]",
"law": "GDPR Art 6(1)(b), (c), (f); Art 14 and Art 14(5)(d) (people involved in a client's matter); UK DPA 2018 Sch 2 para 19 (legal professional privilege)",
"clause": "We use your personal data to [engagement_activities].{if engagement_activities_more} We may add other client services in future.{/if}{if engagement_others} [engagement_others]{/if}",
"vars": [
{
"name": "engagement_activities",
"type": "multi",
"label": "What does your client work involve?",
"required": true,
"options": [
{
"value": "delivery",
"label": "Doing the work clients engage us for",
"text": "carry out the work you engage us to do"
},
{
"value": "client_files",
"label": "Keeping client files",
"text": "keep client files"
},
{
"value": "matter_admin",
"label": "Administering matters or projects",
"text": "administer your matter or project"
},
{
"value": "conflicts",
"label": "Conflict of interest checks",
"text": "check for conflicts of interest before we act"
}
],
"extensible": true
},
{
"name": "engagement_others",
"type": "choice",
"label": "Do you hold information about other people involved in a client's matter?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes, such as other parties, witnesses, or the client's staff",
"text": "We also hold personal data about other people involved in a client's matter, such as other parties, witnesses, and the client's staff."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "If yes, also select source.third-party so the policy states where this data comes from."
}
],
"conditions": "purpose.engagements",
"asks": {
"step": 5,
"q": "Do you carry out client work, such as legal, accounting, or consulting services, for people who engage you?",
"why": "The GDPR requires you to state this purpose and its basis, normally contract, and to inform other people in a matter unless an exemption applies.",
"links": {
"gdpr": "https://gdpr-info.eu/art-14-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/contract/"
}
},
"g16": "",
"file": "icons/purpose.engagements.svg"
},
{
"id": "purpose.appointments",
"cat": "purpose",
"name": "Appointments and reservations",
"desc": "Scheduling appointments and taking reservations for tables, rooms, equipment and rentals, including reminders, changes and deposits.",
"snippet": "We use your data to [schedule appointments / take reservations], send you reminders and handle [changes, cancellations and waiting lists], [and to take and refund deposits].",
"law": "GDPR Art 6(1)(b) (contract and steps before a contract); Art 9(1), (2) where booking details reveal health; APP 6.1 (primary purpose)",
"clause": "We use your personal data to [appointment_activities].{if appointment_activities_more} We may add other booking services in future.{/if}",
"vars": [
{
"name": "appointment_activities",
"type": "multi",
"label": "What does your booking process involve?",
"required": true,
"options": [
{
"value": "scheduling",
"label": "Scheduling appointments",
"text": "schedule appointments"
},
{
"value": "reservations",
"label": "Taking reservations for tables, rooms, or equipment",
"text": "take reservations"
},
{
"value": "reminders",
"label": "Sending reminders",
"text": "send you reminders",
"hint": "Keep reminders free of promotional content, or the direct marketing rules apply to them."
},
{
"value": "cancellations",
"label": "Handling changes and cancellations",
"text": "handle changes and cancellations"
},
{
"value": "waiting_lists",
"label": "Managing waiting lists",
"text": "manage waiting lists"
},
{
"value": "deposits",
"label": "Taking and refunding deposits",
"text": "take and refund deposits"
},
{
"value": "rentals",
"label": "Administering rentals",
"text": "administer rentals"
}
],
"extensible": true,
"hint": "If bookings reveal health, such as clinic appointments, select health data in the data step."
}
],
"conditions": "purpose.appointments",
"asks": {
"step": 5,
"q": "Do you take bookings for appointments, tables, rooms, equipment, or rentals?",
"why": "Taking and managing bookings normally rests on the contract basis, and the GDPR requires you to state this purpose.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/contract/"
}
},
"g16": "",
"file": "icons/purpose.appointments.svg"
},
{
"id": "purpose.suppliers",
"cat": "purpose",
"name": "Suppliers and contractors",
"desc": "Dealing with the people who supply goods or services to us, or who work for our suppliers, from tenders to payment.",
"snippet": "If you supply goods or services to us, or work for a supplier, we use your data to [keep in touch with you, run tenders, manage contracts and pay suppliers].",
"law": "GDPR Art 6(1)(b), (f); Recital 47; APP 6.1",
"clause": "If you supply goods or services to us, or work for a supplier, we use your personal data to [supplier_activities].{if supplier_activities_more} We may use it for other dealings with suppliers in future.{/if}",
"vars": [
{
"name": "supplier_activities",
"type": "multi",
"label": "What do you use supplier data for?",
"required": true,
"options": [
{
"value": "contacts",
"label": "Keeping in touch with contacts at suppliers and contractors",
"text": "keep in touch with you"
},
{
"value": "tenders",
"label": "Running tenders and choosing suppliers",
"text": "run tenders and choose suppliers"
},
{
"value": "contracts",
"label": "Managing contracts with suppliers",
"text": "manage our contracts with suppliers"
},
{
"value": "payments",
"label": "Paying suppliers",
"text": "pay suppliers"
}
],
"extensible": true
}
],
"conditions": "purpose.suppliers",
"asks": {
"step": 5,
"q": "Do you deal with suppliers or contractors, or with people who work for them?",
"why": "The GDPR requires you to state the purpose and lawful basis, usually contract for sole traders and legitimate interests for supplier staff.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/when-can-we-rely-on-legitimate-interests/"
}
},
"g16": "",
"file": "icons/purpose.suppliers.svg"
},
{
"id": "purpose.identity-checks",
"cat": "purpose",
"name": "Identity and eligibility checks",
"desc": "Verifying who people are, checking their eligibility or age, and carrying out identity checks the law requires before giving access to products or services.",
"snippet": "To verify [your identity / sellers and service providers on our platform], check [your eligibility / your age] and carry out checks the law requires, [such as anti-money-laundering and sanctions checks], [using [identity documents / a verification service / credit reference records]].",
"law": "GDPR Art 6(1)(c), (f), Recital 47 (fraud prevention); Art 8(2); Art 9(1), Art 4(14), Recital 51 (face matching, facial age estimation); UK Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 reg 28(2), (18), (19) (customer due diligence) and reg 40 (records); Directive (EU) 2015/849 Art 13(1)(a); UK Online Safety Act 2023 s 12(4), (6) (age verification or age estimation for primary priority content); Digital Services Act Art 28; Cal. Age-Appropriate Design Code Act, Civil Code §1798.99.31(a)(5) (injunction against the age estimation provision vacated, NetChoice v Bonta, 9th Cir, 12 March 2026)",
"clause": "We use your personal data to [identity_activities].{if check_method} We check identity by [check_method].{/if}{if age_minimum} We check that you are at least [age_minimum]{if age_scope} before you can use [age_scope]{/if}{if age_method}, by [age_method]{/if}.{/if}{if check_result} [check_result]{/if}",
"vars": [
{
"name": "identity_activities",
"type": "multi",
"label": "Which checks do you carry out?",
"required": true,
"options": [
{
"value": "account_opening",
"label": "Identity checks when someone opens an account",
"text": "verify your identity when you open an account"
},
{
"value": "eligibility",
"label": "Eligibility checks for a product or service",
"text": "check that you are eligible for a product or service"
},
{
"value": "provider_verification",
"label": "Checks on sellers and service providers using your platform",
"text": "verify sellers and service providers who use our platform"
},
{
"value": "legal_checks",
"label": "Checks the law requires, such as anti-money-laundering and sanctions checks",
"text": "carry out checks the law requires, such as anti-money-laundering and sanctions checks"
},
{
"value": "age",
"label": "Age checks",
"text": "check your age"
}
]
},
{
"name": "check_method",
"type": "multi",
"label": "How do you check identity?",
"required": false,
"options": [
{
"value": "document",
"label": "Identity document check",
"text": "checking an identity document"
},
{
"value": "third_party",
"label": "Third-party verification service",
"text": "using a third-party verification service"
},
{
"value": "credit",
"label": "Credit reference records",
"text": "checking your details against credit reference records"
},
{
"value": "eid",
"label": "Electronic identity (digital ID)",
"text": "using an electronic identity"
},
{
"value": "face_match",
"label": "Face match against an identity document",
"text": "comparing your face with the photo on your identity document",
"hint": "This is special category biometric data. Select biometric data in the data step."
}
],
"hint": "Leave blank if you check only age."
},
{
"name": "age_minimum",
"type": "number",
"label": "What is the minimum age?",
"required": false,
"validation": {
"min": 13,
"max": 21
},
"hint": "Answer only if you check age. 18 suits restricted content, not the GDPR consent age."
},
{
"name": "age_scope",
"type": "choice",
"label": "What does the age check apply to?",
"required": false,
"options": [
{
"value": "services",
"label": "The whole service",
"text": "our service"
},
{
"value": "content",
"label": "Restricted content",
"text": "restricted content"
},
{
"value": "products",
"label": "Age-restricted products",
"text": "age-restricted products"
}
]
},
{
"name": "age_method",
"type": "choice",
"label": "How do you check age?",
"required": false,
"options": [
{
"value": "dob",
"label": "Ask for date of birth",
"text": "asking for your date of birth"
},
{
"value": "id",
"label": "Check an identity document",
"text": "checking an identity document"
},
{
"value": "card",
"label": "Check a payment card",
"text": "checking a payment card"
},
{
"value": "face",
"label": "Facial age estimation",
"text": "estimating your age from an image of your face"
},
{
"value": "third_party",
"label": "A third-party age verification service",
"text": "using a third-party age verification service"
},
{
"value": "credit",
"label": "Credit reference check",
"text": "checking your details against credit reference records"
}
]
},
{
"name": "check_result",
"type": "choice",
"label": "What do you keep after the checks?",
"required": true,
"options": [
{
"value": "result_only",
"label": "Only the result",
"text": "We keep only the result of the check, not the information used to make it."
},
{
"value": "nothing",
"label": "Nothing",
"text": "We do not keep the information used for the check."
},
{
"value": "records",
"label": "Records the law requires us to keep",
"text": "We keep records of the checks for as long as the law requires."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Anti-money-laundering law requires copies of the documents and information used for the checks to be kept, so choose records if you carry out those checks."
}
],
"conditions": "purpose.identity-checks",
"asks": {
"step": 5,
"q": "Do you check people's identity, eligibility, or age before giving them a product, service, or access?",
"why": "The GDPR requires you to state why you check people and on what basis, and anti-money-laundering law makes some identity checks a legal obligation.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/about-the-ico/what-we-do/information-commissioners-opinions/age-assurance-for-the-children-s-code/6-expectations-for-age-assurance-and-data-protection-compliance/",
"uk": "https://www.legislation.gov.uk/uksi/2017/692/regulation/28"
}
},
"g16": "",
"file": "icons/purpose.identity-checks.svg"
},
{
"id": "purpose.creditworthiness",
"cat": "purpose",
"name": "Credit and affordability checks",
"desc": "Checking credit history, assessing affordability and calculating credit scores before offering credit or a service paid for over time.",
"snippet": "To check your credit history with [credit reference agencies such as Experian, Equifax or TransUnion], assess whether you can afford [the credit / the service] and calculate a credit score[, and the agencies keep a record of the search].",
"law": "GDPR Art 6(1)(c), (f), Art 6(3); Art 13(1)(c), (d), Art 13(2)(f); Art 22(1), (2), Recital 71 (automatic refusal of an online credit application); CJEU C-634/21 SCHUFA (Scoring), 7 December 2023 (a credit score a lender draws strongly on is an Art 22 decision); Directive (EU) 2023/2225 Art 18(1) (creditworthiness assessment, through national transposing law); FCA Handbook CONC 5.2A.4R, 5.2A.7R, 5.2A.10R (UK creditworthiness assessment)",
"clause": "We use your personal data to [credit_activities].{if credit_agencies} We use [credit_agencies] for these checks.{/if}{if credit_search_record} [credit_search_record]{/if}",
"vars": [
{
"name": "credit_activities",
"type": "multi",
"label": "What credit checks do you carry out?",
"required": true,
"options": [
{
"value": "credit_check",
"label": "Credit history check with a credit reference agency",
"text": "check your credit history with credit reference agencies"
},
{
"value": "affordability",
"label": "Affordability assessment",
"text": "assess your ability to pay"
},
{
"value": "scoring",
"label": "Credit scoring",
"text": "calculate a credit score"
}
]
},
{
"name": "credit_agencies",
"type": "multi",
"label": "Which credit reference agencies do you use?",
"required": false,
"free": true,
"options": [
{
"value": "experian",
"label": "Experian"
},
{
"value": "equifax",
"label": "Equifax"
},
{
"value": "transunion",
"label": "TransUnion"
},
{
"value": "crif",
"label": "CRIF"
},
{
"value": "schufa",
"label": "SCHUFA"
}
],
"hint": "Add any other agency you use. Leave blank if you do not use one."
},
{
"name": "credit_search_record",
"type": "choice",
"label": "Do the agencies keep a record of your searches?",
"required": true,
"options": [
{
"value": "recorded",
"label": "Yes, the agencies record each search",
"text": "Credit reference agencies keep a record of each search we make."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "The UK agencies' joint information notice says they record every search. Check the notice of any other agency you use."
}
],
"conditions": "purpose.creditworthiness",
"asks": {
"step": 5,
"q": "Do you check people's credit history or ability to pay before giving them credit or a service?",
"why": "The GDPR requires you to state why you check credit and on what basis, and consumer credit law makes some credit checks a legal obligation.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-the-public/credit/"
}
},
"g16": "",
"file": "icons/purpose.creditworthiness.svg"
},
{
"id": "purpose.debt-recovery",
"cat": "purpose",
"name": "Debt recovery",
"desc": "Recovering money people owe, including payment reminders, tracing people who have moved, using debt collection agents or solicitors, and selling unpaid debts.",
"snippet": "To recover money you owe us, including [sending payment reminders, finding your new contact details if you have moved, passing unpaid debts to debt collection agents or solicitors, and selling unpaid debts to another organisation].",
"law": "GDPR Art 6(1)(b) (formal payment reminders), (f); Art 13(1)(c), (d), (e); Art 14(1), (2)(f) (tracing data obtained from other sources)",
"clause": "If you owe us money, we use your personal data to [debt_activities].{if debt_activities_more} We may take other steps to recover money you owe us in future.{/if}",
"vars": [
{
"name": "debt_activities",
"type": "multi",
"label": "What do you do to recover money owed to you?",
"required": true,
"extensible": true,
"options": [
{
"value": "reminders",
"label": "Payment reminders",
"text": "remind you about amounts you owe us"
},
{
"value": "tracing",
"label": "Tracing people who have moved",
"text": "find your current contact details if you have moved",
"hint": "Tracing uses data from other sources. Select the third-party sources you use, such as credit reference agencies, in the sources step."
},
{
"value": "agents",
"label": "Passing debts to debt collection agents or solicitors",
"text": "pass unpaid debts to debt collection agents or solicitors"
},
{
"value": "debt_sale",
"label": "Selling unpaid debts",
"text": "sell unpaid debts to another organisation"
}
]
}
],
"conditions": "purpose.debt-recovery",
"asks": {
"step": 5,
"q": "Do you chase people who owe you money, or pass unpaid debts to others?",
"why": "The GDPR requires you to state this purpose and its basis, and to tell people where you found data used to trace them.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/what-is-the-legitimate-interests-basis/"
}
},
"g16": "",
"file": "icons/purpose.debt-recovery.svg"
},
{
"id": "purpose.employment",
"cat": "purpose",
"name": "Employment administration",
"desc": "Administering the work of employees, workers and contractors from joining to leaving, including personnel files, attendance, leave and references.",
"snippet": "If you work for us, we use your personal data to administer your employment, including [onboarding, personnel files, attendance, leave, leaving and references][, and we keep the records employment law requires].",
"law": "GDPR Art 6(1)(b), (c); Art 88 and Recital 155 (national employment rules, EU only: Art 88 is omitted from the UK GDPR)",
"clause": "If you work for us, we use your personal data to [employment_activities].{if employment_activities_more} We may add other employment tasks in future.{/if}{if employment_records} We also keep the employment records that the law requires us to keep.{/if}",
"vars": [
{
"name": "employment_activities",
"type": "multi",
"label": "What does employment administration involve?",
"required": true,
"extensible": true,
"options": [
{
"value": "onboarding",
"label": "Onboarding new staff",
"text": "set up your employment when you join"
},
{
"value": "personnel_files",
"label": "Keeping personnel files",
"text": "keep your personnel file"
},
{
"value": "attendance",
"label": "Scheduling work and recording attendance",
"text": "schedule work and record attendance"
},
{
"value": "leave",
"label": "Managing holiday and other leave",
"text": "manage holiday and other leave"
},
{
"value": "offboarding",
"label": "Handling staff leaving",
"text": "handle the end of your employment"
},
{
"value": "references",
"label": "Giving references for former staff",
"text": "give references when you leave and ask us to"
}
]
},
{
"name": "employment_records",
"type": "choice",
"label": "Do you keep records that employment law requires, such as right-to-work or working-time records?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes"
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "yes",
"hint": "In the UK, for example, right-to-work document copies are kept during employment and for 2 years after it ends."
}
],
"conditions": "purpose.employment",
"asks": {
"step": 5,
"q": "Do you keep records about your employees, workers, or contractors?",
"why": "Staff records rest mainly on the contract basis, some records are a legal obligation, and the GDPR lets national law add employment rules.",
"links": {
"gdpr": "https://gdpr-info.eu/art-88-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/employment-practices-and-data-protection-keeping-employment-records/collecting-and-keeping-employment-records"
}
},
"g16": "",
"file": "icons/purpose.employment.svg"
},
{
"id": "purpose.payroll",
"cat": "purpose",
"name": "Payroll, pensions and benefits",
"desc": "Paying people who work for you, deducting and reporting tax and social security contributions, repaying expenses, and running pension and staff benefit arrangements.",
"snippet": "If you work for us, we use your personal data to [pay you, deduct and report tax and social security contributions, repay your expenses, and run pension and benefit arrangements], and we share the details needed with [tax and social security authorities, pension providers, benefit providers and our payroll provider].",
"law": "GDPR Art 6(1)(b), (c); Art 6(3); Art 88(1); Art 13(1)(e); UK Pensions Act 2008 s 3 (automatic enrolment)",
"clause": "If you work for us, we use your personal data to [payroll_activities].{if payroll_recipients} We share the details needed with [payroll_recipients].{/if}",
"vars": [
{
"name": "payroll_activities",
"type": "multi",
"label": "What do you do with the personal data of people who work for you?",
"required": true,
"options": [
{
"value": "payroll",
"label": "Pay wages or salaries",
"text": "pay you"
},
{
"value": "tax",
"label": "Deduct and report tax and social security contributions",
"text": "deduct and report tax and social security contributions"
},
{
"value": "expenses",
"label": "Repay expenses",
"text": "repay your expenses"
},
{
"value": "pensions",
"label": "Run pension arrangements",
"text": "run your pension arrangements"
},
{
"value": "benefits",
"label": "Provide staff benefits",
"text": "provide staff benefits",
"hint": "If benefits such as health insurance involve health data, select health data in the data step."
}
]
},
{
"name": "payroll_recipients",
"type": "multi",
"label": "Who do you share pay, pension or benefit details with?",
"required": false,
"options": [
{
"value": "tax_authorities",
"label": "Tax and social security authorities",
"text": "tax and social security authorities"
},
{
"value": "pension_providers",
"label": "Pension providers",
"text": "pension providers"
},
{
"value": "benefit_providers",
"label": "Benefit providers, such as insurers",
"text": "benefit providers"
},
{
"value": "payroll_provider",
"label": "An outside payroll provider",
"text": "our payroll provider"
}
],
"hint": "Leave blank if you name these recipients in the sharing section instead."
}
],
"conditions": "purpose.payroll",
"asks": {
"step": 5,
"q": "Do you pay people who work for you, or run pensions or benefits for them?",
"why": "Paying staff rests on the contract basis, while tax reporting and pension enrolment are often legal obligations the GDPR requires you to state.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/employment-practices-and-data-protection-keeping-employment-records/collecting-and-keeping-employment-records"
}
},
"g16": "",
"file": "icons/purpose.payroll.svg"
},
{
"id": "purpose.staff-development",
"cat": "purpose",
"name": "Training, performance and employee relations",
"desc": "Training, appraisal, disciplinary and grievance matters, sickness and injury records, and equality monitoring for people who work for the organisation.",
"snippet": "If you work for us, we use your data to [provide training, review your performance, handle disciplinary matters and grievances, keep sickness and injury records and monitor equality and diversity]. [Giving equality information is optional.]",
"law": "GDPR Art 6(1)(b), (c), (f); Recital 47; Art 88; Art 9(2)(b) for sickness and injury records; Art 9(2)(g) for equality monitoring; UK DPA 2018 s 10 and Sch 1 paras 1, 5, 8 and 39 (appropriate policy document)",
"clause": "If you work for us, we use your personal data to [staff_activities].{if staff_activities_more} We may add other employment purposes in future.{/if}{if staff_equality} [staff_equality]{/if}",
"vars": [
{
"name": "staff_activities",
"type": "multi",
"label": "What do you use staff data for?",
"required": true,
"options": [
{
"value": "training",
"label": "Training and qualifications",
"text": "provide training and record qualifications"
},
{
"value": "appraisal",
"label": "Appraisals and performance reviews",
"text": "review your performance"
},
{
"value": "disciplinary",
"label": "Disciplinary matters",
"text": "handle disciplinary matters"
},
{
"value": "grievance",
"label": "Grievances",
"text": "handle grievances"
},
{
"value": "sickness_injury",
"label": "Sickness absence and injury records",
"text": "keep records of sickness absence and injuries at work"
},
{
"value": "equality",
"label": "Equality and diversity monitoring",
"text": "monitor equality and diversity"
}
],
"extensible": true
},
{
"name": "staff_equality",
"type": "choice",
"label": "Is giving equality and diversity information optional?",
"required": true,
"options": [
{
"value": "optional",
"label": "Yes, it is optional",
"text": "We ask for equality and diversity information, but giving it is optional."
},
{
"value": "optional_statistics",
"label": "Yes, and we use it only for statistics",
"text": "We ask for equality and diversity information, but giving it is optional. We use it only for statistics, not for decisions about you."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Only relevant if you monitor equality and diversity."
}
],
"conditions": "purpose.staff-development",
"asks": {
"step": 5,
"q": "Do you keep training, performance, disciplinary, sickness or equality records about people who work for you?",
"why": "The GDPR requires the purpose and basis to be stated, and sickness and equality records usually include special category data needing a further condition.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/employment-practices-and-data-protection-keeping-employment-records/collecting-and-keeping-employment-records",
"uk": "https://www.legislation.gov.uk/ukpga/2018/12/schedule/1"
}
},
"g16": "",
"file": "icons/purpose.staff-development.svg"
},
{
"id": "purpose.premises",
"cat": "purpose",
"name": "Premises and visitors",
"desc": "Registering visitors, managing access to buildings, keeping people safe and investigating incidents at an organisation's premises.",
"snippet": "To [record visitors to our premises / manage access passes and permissions], keep people safe on our premises [, including in emergencies,] and [investigate incidents].",
"law": "GDPR Art 6(1)(f), (c); Art 13(1)(c), (d); Art 9(1) (biometric access control); UK Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 reg 12 (records of reportable incidents)",
"clause": "At our premises, we use your personal data to [premises_activities].{if premises_activities_more} We may add other uses in future.{/if}",
"vars": [
{
"name": "premises_activities",
"type": "multi",
"label": "What do you use personal data for at your premises?",
"required": true,
"options": [
{
"value": "visitor_log",
"label": "Visitor log or sign-in",
"text": "register visitors"
},
{
"value": "access_control",
"label": "Access passes and permissions",
"text": "manage access passes and permissions",
"hint": "If you use fingerprints or face recognition to control access, also select biometric data in the data step."
},
{
"value": "safety",
"label": "Safety, including emergencies",
"text": "keep people safe, including in emergencies"
},
{
"value": "incidents",
"label": "Investigating incidents",
"text": "investigate incidents"
}
],
"extensible": true,
"hint": "Camera recording is a separate practice: select CCTV and premises recording in the processing step."
}
],
"conditions": "purpose.premises",
"asks": {
"step": 5,
"q": "Do you keep visitor records, issue access passes, or record safety incidents at your premises?",
"why": "The GDPR requires you to state this purpose and its basis, normally legitimate interests, and some safety records are a legal obligation.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/legitimate-interests/"
}
},
"g16": "",
"file": "icons/purpose.premises.svg"
},
{
"id": "purpose.safeguarding",
"cat": "purpose",
"name": "Safeguarding and safety incidents",
"desc": "Recording and assessing safeguarding concerns, protecting children and adults at risk, responding to safety incidents, and reporting concerns to the authorities or other agencies.",
"snippet": "We use your data to [record and assess safeguarding concerns, protect children and adults at risk, respond to safety incidents and report concerns to the authorities or other agencies]. [Where we believe someone is at risk of harm, we may share information without consent.]",
"law": "GDPR Art 6(1)(c), (d), (e), (f); Recital 46; Art 9(2)(c), (g); Art 10; UK DPA 2018 s 10(3), (5), Sch 1 Part 2 para 18 (safeguarding of children and of individuals at risk) and Part 3 para 36 (Part 2 conditions applied to criminal offence data)",
"clause": "We use your personal data to [safeguarding_activities].{if safeguarding_activities_more} We may add other safeguarding tasks in future.{/if}{if safeguarding_sharing} [safeguarding_sharing]{/if}",
"vars": [
{
"name": "safeguarding_activities",
"type": "multi",
"label": "What does your safeguarding work involve?",
"required": true,
"extensible": true,
"options": [
{
"value": "concerns",
"label": "Recording and assessing safeguarding concerns",
"text": "record and assess safeguarding concerns"
},
{
"value": "protection",
"label": "Protecting children and adults at risk",
"text": "protect children and adults at risk"
},
{
"value": "incidents",
"label": "Responding to safety incidents",
"text": "respond to safety incidents"
},
{
"value": "reporting",
"label": "Reporting concerns to the authorities or other agencies",
"text": "report concerns to the authorities or other agencies"
}
]
},
{
"name": "safeguarding_sharing",
"type": "choice",
"label": "Do you say when you share information without consent?",
"required": true,
"options": [
{
"value": "risk",
"label": "Yes, where someone is at risk of harm",
"text": "Where we believe someone is at risk of harm, we may share information without consent."
},
{
"value": "emergency",
"label": "Yes, only in an emergency",
"text": "We share information without consent only in an emergency where someone's life or safety is at risk."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Only choose a statement that matches your safeguarding policy. In the UK, using health or other sensitive data under the safeguarding condition needs a reason for not getting consent, such as consent prejudicing protection."
}
],
"conditions": "purpose.safeguarding",
"asks": {
"step": 5,
"q": "Do you record safeguarding concerns or safety incidents, or report them to the authorities?",
"why": "The GDPR requires a lawful basis for safeguarding, and health or criminal allegation data in safeguarding records needs a further condition.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/a-10-step-guide-to-sharing-information-to-safeguard-children/",
"uk": "https://www.legislation.gov.uk/ukpga/2018/12/schedule/1/paragraph/18"
}
},
"g16": "",
"file": "icons/purpose.safeguarding.svg"
},
{
"id": "purpose.beneficiary-casework",
"cat": "purpose",
"name": "Support for beneficiaries",
"desc": "Assessing applications for support, understanding needs, providing help and services, making referrals and keeping case records for beneficiaries or service users.",
"snippet": "We use your information to [assess your application for support, understand your needs, provide help and services and keep records of the support we give you], [and to refer you to other organisations that can help].",
"law": "GDPR Art 6(1)(a), (b), (e) or (f); Art 9(1), (2)(a), (d) or (g) where support records include special category data; UK DPA 2018 s 10(3) and Sch 1 Pt 2 para 16",
"clause": "We use your personal data to [casework_activities].{if casework_activities_more} We may add other support services in future.{/if}{if casework_referral_to} We make referrals to [casework_referral_to].{/if}",
"vars": [
{
"name": "casework_activities",
"type": "multi",
"label": "What does your support for beneficiaries or service users involve?",
"required": true,
"options": [
{
"value": "applications",
"label": "Assessing applications for support",
"text": "assess your application for support"
},
{
"value": "needs_assessment",
"label": "Assessing needs",
"text": "understand your needs"
},
{
"value": "assistance",
"label": "Providing help and services",
"text": "provide help and services to you"
},
{
"value": "referrals",
"label": "Referring people to other organisations",
"text": "refer you to other organisations that can help"
},
{
"value": "case_records",
"label": "Keeping case records",
"text": "keep records of the support we give you"
}
],
"extensible": true
},
{
"name": "casework_referral_to",
"type": "multi",
"label": "Who do you refer people to?",
"required": false,
"options": [
{
"value": "charities",
"label": "Other charities",
"text": "other charities"
},
{
"value": "public_services",
"label": "Public services",
"text": "public services"
},
{
"value": "health_services",
"label": "Health services",
"text": "health services"
}
],
"free": true,
"hint": "Answer only if you make referrals. Leave blank to name recipients in the sharing section instead."
}
],
"conditions": "purpose.beneficiary-casework",
"asks": {
"step": 5,
"q": "Do you give support, help, or services to beneficiaries or service users?",
"why": "The GDPR requires you to state this purpose and its basis, and support records can include health or other special category data.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/advice-for-small-organisations/privacy-notices-and-cookies/create-your-own-privacy-notice/png-charity-and-voluntary"
}
},
"g16": "",
"file": "icons/purpose.beneficiary-casework.svg"
},
{
"id": "purpose.grants",
"cat": "purpose",
"name": "Grants",
"desc": "Receiving and assessing grant applications, paying grants and monitoring how they are used, for charities, foundations and public funders.",
"snippet": "We use your data to [receive and assess grant applications, pay grants and monitor how they are used], [and we publish the names of recipients and the amounts awarded].",
"law": "GDPR Art 6(1)(b), (e), (f); Art 6(3); Art 13(1)(c), (e); Art 14(1)(c), (2)(f); APP 6.1",
"clause": "We use your personal data to [grant_activities].{if grant_activities_more} We may use it for other grant-making activities in future.{/if}{if grant_named_people} We also use the details of contacts, trustees, and referees named in an application.{/if}{if grant_publication} [grant_publication]{/if}",
"vars": [
{
"name": "grant_activities",
"type": "multi",
"label": "What do you do with grant applicants' data?",
"required": true,
"options": [
{
"value": "applications",
"label": "Receiving grant applications",
"text": "receive grant applications"
},
{
"value": "assessment",
"label": "Assessing applications and deciding on awards",
"text": "assess applications and decide on awards"
},
{
"value": "awards",
"label": "Paying grants",
"text": "pay grants"
},
{
"value": "monitoring",
"label": "Monitoring and reporting on how grants are used",
"text": "monitor grants and report on them"
}
],
"extensible": true
},
{
"name": "grant_named_people",
"type": "choice",
"label": "Do applications name contacts, trustees, or referees?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes"
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Choose Yes if organisations apply, or if applicants give referees."
},
{
"name": "grant_publication",
"type": "choice",
"label": "Do you publish who receives grants?",
"required": true,
"options": [
{
"value": "organisations",
"label": "Yes, the names of organisations and the amounts awarded",
"text": "We publish the names of organisations that receive grants and the amounts awarded."
},
{
"value": "individuals",
"label": "Yes, the names of all recipients, including individuals, and the amounts awarded",
"text": "We publish the names of recipients, including individuals, and the amounts awarded."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Choose Not stated if what you publish differs from both options."
}
],
"conditions": "purpose.grants",
"asks": {
"step": 5,
"q": "Do you receive grant applications or award grants?",
"why": "Grant-making rests on public task for public bodies or contract for other funders, and the GDPR requires you to state the basis.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/contract/"
}
},
"g16": "",
"file": "icons/purpose.grants.svg"
},
{
"id": "purpose.public-services",
"cat": "purpose",
"name": "Public services",
"desc": "Carrying out the functions of a public authority or other body with public functions, such as handling applications, deciding eligibility, casework, permits, benefits, consultations and statutory registers.",
"snippet": "We use your data to carry out our public functions, including [processing applications, deciding eligibility, managing cases, issuing permits and licences, administering benefits and payments, running consultations and keeping public registers required by law].",
"law": "GDPR Art 6(1)(e), (c); Art 6(1) second subparagraph; Art 6(3); Recital 47; Art 9(2)(g); Arts 13(1)(c), 13(2)(f), 22; UK DPA 2018 s 10(3), Sch 1 Part 2 paras 5 and 6",
"clause": "We use your personal data to [public_service_activities].{if public_service_activities_more} We may use it for other public functions in future.{/if}",
"vars": [
{
"name": "public_service_activities",
"type": "multi",
"label": "Which public functions do you use personal data for?",
"required": true,
"options": [
{
"value": "applications",
"label": "Processing applications",
"text": "process your applications"
},
{
"value": "eligibility",
"label": "Deciding eligibility",
"text": "decide whether you are eligible"
},
{
"value": "casework",
"label": "Casework",
"text": "manage your case"
},
{
"value": "permits",
"label": "Issuing permits and licences",
"text": "issue permits and licences"
},
{
"value": "benefits",
"label": "Administering benefits and payments",
"text": "administer benefits and payments"
},
{
"value": "consultations",
"label": "Running consultations",
"text": "run consultations"
},
{
"value": "registers",
"label": "Keeping public registers that the law requires",
"text": "keep public registers that the law requires"
}
],
"free": true,
"extensible": true,
"hint": "The law that gives you these functions is asked in the lawful basis step."
}
],
"conditions": "purpose.public-services",
"asks": {
"step": 5,
"q": "Do you use personal data to carry out public functions, such as applications, casework, permits, or benefits?",
"why": "Public authorities normally rely on public task, which the GDPR requires to be laid down in law, not on legitimate interests.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/public-task/"
}
},
"g16": "",
"file": "icons/purpose.public-services.svg"
},
{
"id": "purpose.education",
"cat": "purpose",
"name": "Education and training",
"desc": "Enrolling, teaching and assessing learners, awarding qualifications, and providing learning, welfare and pastoral support at schools, colleges, universities and training providers.",
"snippet": "We use your data to [enrol you on courses, teach you, assess your work and progress, award qualifications and keep records of them, and provide learning, welfare and pastoral support].",
"law": "GDPR Art 6(1)(b), (e); Art 6(3); Art 9(2) for health or special educational needs data in learner support; Art 12(1) and Recital 58 (information addressed to children)",
"clause": "We use your personal data to [education_activities].{if education_activities_more} We may add other education and training activities in future.{/if}",
"vars": [
{
"name": "education_activities",
"type": "multi",
"label": "What do you use learners' data for?",
"required": true,
"extensible": true,
"options": [
{
"value": "enrolment",
"label": "Enrolment on courses",
"text": "enrol you on courses"
},
{
"value": "teaching",
"label": "Teaching",
"text": "teach you"
},
{
"value": "assessment",
"label": "Assessing work and progress",
"text": "assess your work and progress"
},
{
"value": "qualifications",
"label": "Awarding qualifications and keeping records of them",
"text": "award qualifications and keep records of them"
},
{
"value": "learner_support",
"label": "Learning, welfare and pastoral support",
"text": "provide learning, welfare, and pastoral support"
}
]
}
],
"conditions": "purpose.education",
"asks": {
"step": 5,
"q": "Do you enrol, teach, or assess learners, award qualifications, or give learner support?",
"why": "Education rests on the public task or contract basis under the GDPR, and learner support may involve health data needing a further condition.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/education/"
}
},
"g16": "",
"file": "icons/purpose.education.svg"
},
{
"id": "purpose.healthcare",
"cat": "purpose",
"name": "Health and care services",
"desc": "Assessing, diagnosing and treating patients and service users, coordinating their care with others, and administering health and care services such as records and referrals.",
"snippet": "We use your data to [assess your health and care needs, diagnose conditions and provide treatment and care], [share information with others involved in your care, such as your GP] and [manage records and referrals].",
"law": "GDPR Art 6(1)(b), (e), (f); Art 9(2)(h), 9(3); UK DPA 2018 s 10(2), s 11(1), Sch 1 Part 1 para 2; common law duty of confidentiality (UK, in addition to data protection law)",
"clause": "We use your personal data to [healthcare_activities].{if healthcare_activities_more} We may add other health and care services in future.{/if}{if care_recipients} To coordinate your care, we share your personal data with [care_recipients].{/if}",
"vars": [
{
"name": "healthcare_activities",
"type": "multi",
"label": "What do your health or care services involve?",
"required": true,
"extensible": true,
"options": [
{
"value": "assessment",
"label": "Assessing health and care needs",
"text": "assess your health and care needs"
},
{
"value": "diagnosis",
"label": "Diagnosing conditions",
"text": "diagnose conditions"
},
{
"value": "treatment",
"label": "Providing treatment and care",
"text": "provide treatment and care"
},
{
"value": "care_coordination",
"label": "Coordinating care with others",
"text": "share information with others involved in your care"
},
{
"value": "administration",
"label": "Administering health and care services, such as records and referrals",
"text": "manage health and care services, such as records and referrals"
}
]
},
{
"name": "care_recipients",
"type": "choice",
"label": "Who receives information when you coordinate care?",
"required": true,
"options": [
{
"value": "gp",
"label": "The person's GP and other health professionals involved in their care",
"text": "your GP and other health professionals involved in your care"
},
{
"value": "professionals",
"label": "Other health and social care professionals involved in their care",
"text": "other health and social care professionals involved in your care"
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Answer only if you tick 'Coordinating care with others', and choose only a statement that matches who you actually share with."
}
],
"conditions": "purpose.healthcare",
"asks": {
"step": 5,
"q": "Do you assess, diagnose, treat, or care for people, or run health or care services?",
"why": "Health and care data is special category data, so the GDPR requires a lawful basis and a health or social care condition.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/transparency-in-health-and-social-care/",
"uk": "https://www.legislation.gov.uk/ukpga/2018/12/section/11"
}
},
"g16": "",
"file": "icons/purpose.healthcare.svg"
},
{
"id": "purpose.property",
"cat": "purpose",
"name": "Lettings and property management",
"desc": "Assessing tenancy applications, managing tenancies, arranging repairs and inspections, and collecting rent and deposits.",
"snippet": "To [assess tenancy applications, including references / manage your tenancy / arrange repairs, maintenance and inspections / collect rent and manage deposits][, and to assess and manage guarantees given by guarantors].",
"law": "GDPR Art 6(1)(b) (contract, including steps at the applicant's request before a tenancy), (c); Art 6(3); Art 13(1)(c), Art 13(2)(e); Art 14(1), (2)(f), (3)(a) (guarantors' data and references obtained from others); UK: Housing Act 2004 s 213(1), (3), (5), (6) (tenancy deposit protection, England and Wales, words substituted by Renters' Rights Act 2025 s 26(3)); Immigration Act 2014 s 22(1), s 24(2)(a) (right-to-rent checks, England)",
"clause": "We use your personal data to [property_activities].{if property_activities_more} We may add other lettings and property services in future.{/if}{if property_guarantors} [property_guarantors]{/if}",
"vars": [
{
"name": "property_activities",
"type": "multi",
"label": "What do you use tenants' and applicants' data for?",
"required": true,
"extensible": true,
"options": [
{
"value": "applications",
"label": "Assessing tenancy applications and references",
"text": "assess tenancy applications, including references",
"hint": "Credit checks on applicants are covered separately: select Credit and affordability checks."
},
{
"value": "tenancy",
"label": "Managing tenancies",
"text": "manage your tenancy"
},
{
"value": "maintenance",
"label": "Repairs, maintenance and inspections",
"text": "arrange repairs, maintenance, and inspections"
},
{
"value": "rent",
"label": "Collecting rent and managing deposits",
"text": "collect rent and manage deposits"
}
]
},
{
"name": "property_guarantors",
"type": "choice",
"label": "Do you ask for guarantors?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes",
"text": "We also use personal data about guarantors to assess and manage their guarantees."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "If an applicant gives you a guarantor's details, the GDPR requires you to give the guarantor privacy information within one month."
}
],
"conditions": "purpose.property",
"asks": {
"step": 5,
"q": "Do you let or manage property and use tenants' or applicants' personal data?",
"why": "The GDPR requires you to state each purpose and its basis, and lettings rest on contract, with some steps, like deposit protection, set by law.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/contract/",
"uk": "https://www.legislation.gov.uk/ukpga/2004/34/section/213"
}
},
"g16": "",
"file": "icons/purpose.property.svg"
},
{
"id": "purpose.financial-services",
"cat": "purpose",
"name": "Financial and insurance services",
"desc": "Arranging and managing loans and credit, underwriting insurance, administering policies and accounts, and handling insurance claims.",
"snippet": "To [arrange and manage loans and credit / assess and price insurance cover], administer your [policy / account] and handle [insurance claims], [including information about other people involved in a claim, such as witnesses].",
"law": "GDPR Art 6(1)(b); Art 9(1), (2)(a), (g) (health data in underwriting and claims); Art 10 (criminal offence data in claims fraud checks); Art 14(1), (3) (other people involved in a claim); UK DPA 2018 Sch 1 Part 2 para 20 (insurance) and para 5 (appropriate policy document), Part 3 paras 36, 37 (insurance condition extended to criminal offence data)",
"clause": "We use your personal data to [financial_activities].{if financial_activities_more} We may offer other financial services in future.{/if}{if financial_claim_others} [financial_claim_others]{/if}",
"vars": [
{
"name": "financial_activities",
"type": "multi",
"label": "Which financial or insurance services do you provide?",
"required": true,
"extensible": true,
"options": [
{
"value": "lending",
"label": "Loans and credit",
"text": "arrange and manage loans and credit",
"hint": "If you check credit history or affordability, also select Credit and affordability checks."
},
{
"value": "underwriting",
"label": "Insurance underwriting",
"text": "assess and price insurance cover",
"hint": "Underwriting often uses health data. If so, select health data in the data step."
},
{
"value": "policy_admin",
"label": "Policy or account administration",
"text": "administer your policy or account"
},
{
"value": "claims",
"label": "Insurance claims",
"text": "handle insurance claims",
"hint": "Claims often involve health data, and fraud checks can involve criminal offence data. Select each one you use in the data step."
}
],
"hint": "Identity and anti-money-laundering checks belong under Identity and eligibility checks, and credit checks under Credit and affordability checks. Select those purposes as well if you carry them out."
},
{
"name": "financial_claim_others",
"type": "choice",
"label": "When handling claims, do you collect data about other people, such as witnesses?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes, about other people involved in a claim",
"text": "To handle claims, we also collect personal data about other people involved, such as other drivers and witnesses."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Answer yes only if you handle claims. The GDPR requires you to inform these people too, although you did not collect the data from them."
}
],
"conditions": "purpose.financial-services",
"asks": {
"step": 5,
"q": "Do you provide loans, credit, or insurance, or handle insurance claims?",
"why": "Financial services normally rest on the contract basis, and the GDPR requires a separate condition for health data used in insurance.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-substantial-public-interest-conditions/",
"uk": "https://www.legislation.gov.uk/ukpga/2018/12/schedule/1/paragraph/20"
}
},
"g16": "",
"file": "icons/purpose.financial-services.svg"
},
{
"id": "purpose.location-services",
"cat": "purpose",
"name": "Location-based features",
"desc": "Using a person's location to provide features they ask for, such as directions, dispatch to their location, nearby places, and location sharing.",
"snippet": "We use your location to [give you directions / send drivers, deliveries, or help to your location / show you places and services near you / share your location with people you choose], [only while you use the feature / also in the background].",
"law": "GDPR Art 6(1)(b), (a) or (f); Art 5(1)(c); ePrivacy Directive Art 5(3); PECR reg 6 and Sch A1 (UK: strictly necessary and emergency assistance exceptions); APP 6.1 (primary purpose)",
"clause": "We use your location to [location_activities].{if location_activities_more} We may add other location-based features in future.{/if}{if location_when} [location_when]{/if}",
"vars": [
{
"name": "location_activities",
"type": "multi",
"label": "Which location-based features do you offer?",
"required": true,
"options": [
{
"value": "navigation",
"label": "Directions and navigation",
"text": "give you directions"
},
{
"value": "dispatch",
"label": "Sending drivers, deliveries, or help to the person",
"text": "send drivers, deliveries, or help to your location"
},
{
"value": "nearby",
"label": "Showing nearby places and services",
"text": "show you places and services near you"
},
{
"value": "location_sharing",
"label": "Sharing location with people the person chooses",
"text": "share your location with people you choose"
}
],
"extensible": true
},
{
"name": "location_when",
"type": "choice",
"label": "When do you use the person's location?",
"required": true,
"options": [
{
"value": "in_use",
"label": "Only while they use the feature",
"text": "We use your location only while you are using these features."
},
{
"value": "background",
"label": "Also in the background",
"text": "We also use your location in the background, when you are not using these features.",
"hint": "Background location may go beyond what the feature needs, so the contract basis may not cover it."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
}
],
"conditions": "purpose.location-services",
"asks": {
"step": 5,
"q": "Do you use people's location to provide features such as directions, deliveries, or nearby places?",
"why": "Reading device location needs consent under ePrivacy rules unless strictly necessary for a feature someone asked for, and the GDPR requires you to state it.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/"
}
},
"g16": "",
"file": "icons/purpose.location-services.svg"
},
{
"id": "purpose.editorial",
"cat": "purpose",
"name": "Journalism and publishing",
"desc": "Working with contributors and sources, researching and reporting on people, and publishing and archiving journalism and other editorial content.",
"snippet": "We use your data to [work with writers, photographers and other contributors, deal with our sources, research and report on people in our journalism, and publish and archive our content]. [We protect the identity of confidential sources.]",
"law": "GDPR Art 6(1)(f); Art 85, Recital 153; Art 9(2)(a), (e), (g); Art 10; UK DPA 2018 Sch 1 Part 2 para 13 (journalism etc in connection with unlawful acts and dishonesty) and Part 3 para 36; UK DPA 2018 Sch 2 Part 5 para 26 (special purposes exemption)",
"clause": "We use your personal data to [editorial_activities].{if editorial_activities_more} We may add other editorial activities in future.{/if}{if editorial_sources} [editorial_sources]{/if}",
"vars": [
{
"name": "editorial_activities",
"type": "multi",
"label": "What does your journalism or publishing involve?",
"required": true,
"extensible": true,
"options": [
{
"value": "contributors",
"label": "Working with contributors",
"text": "work with writers, photographers and other contributors"
},
{
"value": "sources",
"label": "Dealing with sources",
"text": "deal with our sources"
},
{
"value": "subjects",
"label": "Researching and reporting on people",
"text": "research and report on people in our journalism"
},
{
"value": "publication",
"label": "Publishing and archiving content",
"text": "publish and archive our content"
}
]
},
{
"name": "editorial_sources",
"type": "choice",
"label": "Do you say that you protect confidential sources?",
"required": true,
"options": [
{
"value": "protect",
"label": "Yes, we protect the identity of confidential sources",
"text": "We protect the identity of confidential sources."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Only choose this if your editorial practice and security measures protect the identity of confidential sources."
}
],
"conditions": "purpose.editorial",
"asks": {
"step": 5,
"q": "Do you produce journalism or publish editorial content that involves people?",
"why": "The GDPR requires a lawful basis for journalism, and national law sets when a journalism exemption applies.",
"links": {
"gdpr": "https://gdpr-info.eu/art-85-gdpr/",
"ico": "https://ico.org.uk/media2/migrated/4025760/data-protection-and-journalism-code-202307.pdf",
"uk": "https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/paragraph/26"
}
},
"g16": "",
"file": "icons/purpose.editorial.svg"
},
{
"id": "purpose.data-products",
"cat": "purpose",
"name": "Selling data or insights",
"desc": "Supplying personal data, or reports and insights that identify people, to other organisations, including to add to or correct their records.",
"snippet": "To [supply your personal data / supply reports or insights that identify you] to [marketers, credit providers, researchers or other businesses], [and to add to or correct their records]. [We combine it with personal data we obtain from other sources.]",
"law": "GDPR Art 6(1)(a) or (f), Recital 47; Art 13(1)(c), (e), Art 13(3); Art 14(1)(c), (e), Art 14(2)(f), Art 14(3)(c), Art 14(5)(b); Art 9(1), (2); ICO, Investigation into data protection compliance in the direct marketing data broking sector (October 2020); Experian Ltd v Information Commissioner [2023] UKFTT 132 (GRC), paras 178, 180, 185, upheld Information Commissioner v Experian Ltd [2024] UKUT 105 (AAC); CCPA §1798.140(ad)(1) (sale), §1798.120(a); Cal. Civ. Code §1798.99.80(c) (data broker, Delete Act)",
"clause": "We use your personal data to [data_product_activities].{if data_product_recipients} We supply it to [data_product_recipients].{/if}{if data_product_sources} [data_product_sources]{/if}",
"vars": [
{
"name": "data_product_activities",
"type": "multi",
"label": "What do you supply to other organisations?",
"required": true,
"options": [
{
"value": "data_supply",
"label": "Personal data, such as lists or records about individuals",
"text": "supply it to other organisations"
},
{
"value": "insights",
"label": "Reports or insights that identify people",
"text": "supply reports or insights that identify you"
},
{
"value": "enrichment",
"label": "Updates that add to or correct other organisations' records",
"text": "update other organisations' records"
}
],
"hint": "Reports or insights that cannot identify anyone are not personal data and need no tick here."
},
{
"name": "data_product_recipients",
"type": "multi",
"label": "Who do you supply it to?",
"required": false,
"free": true,
"options": [
{
"value": "marketers",
"label": "Marketers",
"text": "marketing companies"
},
{
"value": "credit",
"label": "Credit providers",
"text": "credit providers"
},
{
"value": "researchers",
"label": "Researchers",
"text": "researchers"
},
{
"value": "businesses",
"label": "Other businesses",
"text": "other businesses"
}
],
"hint": "Add any other kind of recipient. The GDPR requires the recipients or categories of recipients to be stated."
},
{
"name": "data_product_sources",
"type": "choice",
"label": "Where does the data you supply come from?",
"required": true,
"options": [
{
"value": "own",
"label": "Only data we collect ourselves",
"text": "We use only personal data that we collect ourselves."
},
{
"value": "combined",
"label": "We combine it with data from other sources",
"text": "We combine it with personal data we obtain from other sources."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "Name the other sources in the sources section. The GDPR requires them for data you did not collect from the person."
}
],
"conditions": "purpose.data-products",
"asks": {
"step": 5,
"q": "Do you sell or supply personal data, or reports that identify people, to other organisations?",
"why": "The GDPR requires you to name the purpose, its basis, and the recipients, and to tell people whose data you obtained from others.",
"links": {
"gdpr": "https://gdpr-info.eu/art-14-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
"ca": "https://cppa.ca.gov/data_brokers/"
}
},
"g16": "",
"file": "icons/purpose.data-products.svg"
},
{
"id": "purpose.privacy-requests",
"cat": "purpose",
"name": "Privacy requests and preferences",
"desc": "Handling people's privacy requests, recording their consents and privacy choices, and keeping a list of people who have asked not to be contacted.",
"snippet": "To [check your identity and respond to your privacy requests], [keep a record of your consents and privacy choices] and [keep a suppression list of people who have asked not to be contacted, so that we respect that choice].",
"law": "GDPR Art 6(1)(c), (3); Art 7(1) (demonstrating consent); Arts 12 to 22, in particular Art 12(2), (3), (6) (handling requests and confirming identity); Art 21(3) (no further direct marketing after objection)",
"clause": "We use your personal data to [privacy_request_activities].",
"vars": [
{
"name": "privacy_request_activities",
"type": "multi",
"label": "What do you do to handle privacy requests and choices?",
"required": true,
"options": [
{
"value": "requests",
"label": "Checking identity and answering privacy requests",
"text": "check your identity and answer your privacy requests"
},
{
"value": "choices",
"label": "Recording consents and privacy choices",
"text": "record your consents and privacy choices"
},
{
"value": "suppression",
"label": "Keeping a record of objections, including requests not to be contacted",
"text": "keep a record of your objections so that we can comply with them",
"hint": "Keep this record so that you can comply with your obligation to comply with any objections. Keep only the information needed to do so."
}
]
}
],
"conditions": "purpose.privacy-requests",
"asks": {
"step": 5,
"q": "Do you answer privacy requests, or keep records of consents or of people who asked not to be contacted?",
"why": "The GDPR requires you to handle privacy requests, prove consent where you rely on it, and stop marketing to people who object.",
"links": {
"gdpr": "https://gdpr-info.eu/art-12-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/respect-peoples-preferences/"
}
},
"g16": "",
"file": "icons/purpose.privacy-requests.svg"
},
{
"id": "purpose.governance",
"cat": "purpose",
"name": "Investigations, audits and governance",
"desc": "Carrying out internal investigations and audits, handling whistleblowing reports, keeping company and shareholder records, and carrying out due diligence for transactions.",
"snippet": "To [carry out internal investigations, handle whistleblowing reports, carry out audits, keep company and shareholder records and carry out due diligence for a sale, purchase, or investment]. [We keep the identity of people who report concerns confidential.]",
"law": "GDPR Art 6(1)(c), (f); Art 6(3); Art 10; Directive (EU) 2019/1937 Arts 8(1), (3), 16, 17; UK Companies Act 2006 ss 113, 475",
"clause": "We use your personal data to [governance_activities].{if governance_activities_more} We may use it for other governance tasks in future.{/if}{if whistleblower_identity} [whistleblower_identity]{/if}",
"vars": [
{
"name": "governance_activities",
"type": "multi",
"label": "Which investigation, audit, or governance tasks do you carry out?",
"required": true,
"options": [
{
"value": "investigations",
"label": "Internal investigations",
"text": "carry out internal investigations"
},
{
"value": "whistleblowing",
"label": "Handling whistleblowing reports",
"text": "handle whistleblowing reports"
},
{
"value": "audits",
"label": "Audits",
"text": "carry out audits"
},
{
"value": "board_admin",
"label": "Company registers and board and shareholder records",
"text": "keep company registers and board and shareholder records"
},
{
"value": "due_diligence",
"label": "Due diligence for a sale, purchase, or investment",
"text": "carry out due diligence for a sale, purchase, or investment"
}
],
"extensible": true
},
{
"name": "whistleblower_identity",
"type": "choice",
"label": "Do you keep the identity of people who report concerns confidential?",
"required": true,
"options": [
{
"value": "confidential",
"label": "Yes, only the staff who handle a report know who made it",
"text": "Only the staff who handle a whistleblowing report know who made it, unless that person agrees or the law requires disclosure."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "In the EU, private-sector employers with 50 or more workers must run internal reporting channels that keep the reporter's identity confidential."
}
],
"conditions": "purpose.governance",
"asks": {
"step": 5,
"q": "Do you investigate concerns, handle whistleblowing reports, run audits or due diligence, or keep company records?",
"why": "The GDPR requires you to state each purpose and its basis, and allegations of crime can be criminal offence data needing specific legal authority.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/criminal-offence-data/what-is-criminal-offence-data/"
}
},
"g16": "",
"file": "icons/purpose.governance.svg"
},
{
"id": "basis.consent",
"cat": "basis",
"name": "Consent",
"desc": "You have given clear, specific, informed and freely given consent, which you can withdraw at any time.",
"snippet": "We rely on your consent for [purpose]. You can withdraw consent at any time by [method]; this does not affect processing carried out before withdrawal.",
"law": "GDPR Arts 4(11), 6(1)(a), 7, Recitals 32, 42-43",
"clause": "We rely on your consent for [purposes].{if consent_how} We ask for it [consent_how].{/if}",
"vars": [
{
"name": "purposes",
"type": "multi",
"label": "Which purposes rely on consent?",
"options": "@purpose",
"required": true
},
{
"name": "consent_how",
"type": "choice",
"label": "How do you ask for consent?",
"required": true,
"options": [
{
"value": "tick",
"label": "An unticked box the person ticks",
"text": "by asking you to tick a box"
},
{
"value": "button",
"label": "A clear opt-in button or choice",
"text": "by asking you to choose a clear opt-in option"
},
{
"value": "settings",
"label": "A setting the person switches on",
"text": "by asking you to switch on the setting in your account"
},
{
"value": "banner",
"label": "A cookie or consent banner",
"text": "through our consent banner"
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
}
],
"conditions": {
"anyBasis": "basis.consent"
},
"asks": {
"step": 6,
"q": "How do you ask people for their consent?",
"why": "The GDPR requires consent to be a clear, specific, informed, and freely given opt-in that you can show you obtained.",
"links": {
"gdpr": "https://gdpr-info.eu/art-7-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.consent.svg"
},
{
"id": "basis.explicit-consent",
"cat": "basis",
"name": "Explicit consent",
"desc": "An express, affirmative statement of consent, required for special category data and certain automated decisions or transfers.",
"snippet": "We rely on your explicit consent for [processing of [special category data] / automated decision-making / transfer to [country]]. You can withdraw it at any time by [method].",
"law": "GDPR Arts 9(2)(a), 22(2)(c), 49(1)(a); UK GDPR Art 22B(2) (Arts 22A to 22D substituted by DUAA 2025: explicit consent is the first condition for a significant decision based solely on automated processing of special category data)",
"clause": "We rely on your explicit consent for [explicit_scope].{if explicit_how} We ask for it [explicit_how].{/if}",
"vars": [
{
"name": "explicit_scope",
"type": "choice",
"label": "What does the explicit consent cover?",
"required": true,
"options": [
{
"value": "special",
"label": "Special category data",
"text": "processing your special category data (Article 9(2)(a) GDPR)"
},
{
"value": "adm",
"label": "Automated decisions with significant effects",
"text": "making decisions about you based solely on automated processing that have legal or similarly significant effects"
}
]
},
{
"name": "explicit_how",
"type": "choice",
"label": "How do you ask for explicit consent?",
"required": true,
"options": [
{
"value": "statement",
"label": "A written or typed statement",
"text": "in a written statement that you sign or type"
},
{
"value": "tick",
"label": "A separate, specific tick box",
"text": "by asking you to tick a separate box for this purpose"
},
{
"value": "oral",
"label": "An oral statement that is recorded",
"text": "in a recorded oral statement"
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
}
],
"conditions": {
"any": [
{
"any": [
{
"is": {
"art9.data.biometric": "basis.explicit-consent"
}
},
{
"is": {
"art9.data.health": "basis.explicit-consent"
}
},
{
"is": {
"art9.data.genetic": "basis.explicit-consent"
}
},
{
"in": {
"art9.data.special": [
"basis.explicit-consent"
]
}
},
{
"is": {
"art9.data.children": "basis.explicit-consent"
}
}
]
},
{
"anyBasis": "basis.explicit-consent"
}
]
},
"asks": {
"step": 3,
"q": "How do you ask for explicit consent?",
"why": "The GDPR requires an express statement of consent for special category data and some automated decisions.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-conditions-for-processing/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.explicit-consent.svg"
},
{
"id": "basis.contract",
"cat": "basis",
"name": "Contract",
"desc": "Processing is necessary to perform a contract with you, or to take steps at your request before entering into one.",
"snippet": "We rely on the performance of our contract with you (or steps taken at your request before entering into it) for [purpose].",
"law": "GDPR Art 6(1)(b), Recital 44; EDPB Guidelines 2/2019",
"clause": "We rely on our contract with you for [purposes].{if precontract} [precontract]{/if}{if consequence} If you do not give us this data, we cannot [consequence].{/if}",
"vars": [
{
"name": "purposes",
"type": "multi",
"label": "Which purposes rely on the contract?",
"options": "@purpose",
"required": true
},
{
"name": "precontract",
"type": "choice",
"label": "Does this include steps before the contract, such as a quote or trial?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes",
"text": "This includes steps you ask us to take before we enter into a contract."
},
{
"value": "none",
"label": "No",
"text": ""
}
]
},
{
"name": "consequence",
"type": "choice",
"label": "What happens if the person does not give the data?",
"required": true,
"options": [
{
"value": "service",
"label": "We cannot provide the service",
"text": "provide the service"
},
{
"value": "order",
"label": "We cannot complete the order",
"text": "complete your order"
},
{
"value": "account",
"label": "We cannot open the account",
"text": "open or run your account"
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
}
],
"conditions": {
"anyBasis": "basis.contract"
},
"asks": {
"step": 6,
"q": null,
"why": "The GDPR allows processing needed to perform a contract, and requires you to say what happens if the data is not given.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/contract/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.contract.svg"
},
{
"id": "basis.legal-obligation",
"cat": "basis",
"name": "Legal obligation",
"desc": "Processing is necessary to comply with a legal obligation to which we are subject under EU or Member State (or UK) law.",
"snippet": "We rely on our legal obligations under [name of law] for [purpose].",
"law": "GDPR Art 6(1)(c), 6(3), Recital 45",
"clause": "We rely on our legal obligations for [purposes]. We do this to comply with [law_name].",
"vars": [
{
"name": "purposes",
"type": "multi",
"label": "Which purposes rely on a legal obligation?",
"options": "@purpose",
"required": true
},
{
"name": "law_name",
"type": "choice",
"label": "Which law requires the processing?",
"required": true,
"options": [
{
"value": "tax",
"label": "Tax and accounting law",
"text": "tax and accounting law"
},
{
"value": "aml",
"label": "Anti-money-laundering law",
"text": "anti-money-laundering law"
},
{
"value": "consumer",
"label": "Consumer protection law",
"text": "consumer protection law"
},
{
"value": "employment",
"label": "Employment law",
"text": "employment law"
},
{
"value": "safety",
"label": "Product safety law",
"text": "product safety law"
},
{
"value": "online",
"label": "Online safety or platform law",
"text": "online safety and platform law"
},
{
"value": "court",
"label": "Court orders and legally binding demands from authorities",
"text": "court orders and legally binding demands from authorities"
},
{
"value": "other",
"label": "Other (name it)",
"text": "[law_other]"
}
]
},
{
"name": "law_other",
"type": "text",
"label": "Name the law",
"required": false,
"validation": {
"max": 120
},
"hint": "For example 'the Companies Act 2006'. It must be EU or Member State law (EU GDPR) or UK law (UK GDPR), not a contract or a foreign law."
}
],
"conditions": {
"anyBasis": "basis.legal-obligation"
},
"asks": {
"step": 6,
"q": "Which law requires you to process this data?",
"why": "The GDPR requires the obligation to be laid down in EU, Member State, or UK law, so the policy should name it.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/legal-obligation/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.legal-obligation.svg"
},
{
"id": "basis.vital-interests",
"cat": "basis",
"name": "Vital interests",
"desc": "Processing is necessary to protect someone's life or physical safety.",
"snippet": "We rely on the protection of vital interests where processing is necessary to protect [your / another person's] life, for example in an emergency.",
"law": "GDPR Art 6(1)(d), 9(2)(c), Recital 46",
"clause": "We rely on the protection of vital interests for [purposes]. This applies only where processing is necessary to protect [whose] life, for example in an emergency.{if vital_special} [vital_special]{/if}",
"vars": [
{
"name": "purposes",
"type": "multi",
"label": "Which purposes rely on vital interests?",
"options": "@purpose",
"required": true
},
{
"name": "whose",
"type": "choice",
"label": "Whose life?",
"required": true,
"options": [
{
"value": "you",
"label": "The person's own life",
"text": "your"
},
{
"value": "other",
"label": "Another person's life",
"text": "another person's"
},
{
"value": "either",
"label": "Either",
"text": "your or another person's"
}
]
},
{
"name": "vital_special",
"type": "choice",
"label": "Does this cover special category data?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes",
"text": "Where this involves special category data, we rely on it only if you are physically or legally unable to consent (Article 9(2)(c) GDPR)."
},
{
"value": "none",
"label": "No",
"text": ""
}
]
}
],
"conditions": {
"any": [
{
"anyBasis": "basis.vital-interests"
},
{
"any": [
{
"is": {
"art9.data.biometric": "basis.vital-interests"
}
},
{
"is": {
"art9.data.health": "basis.vital-interests"
}
},
{
"is": {
"art9.data.genetic": "basis.vital-interests"
}
},
{
"in": {
"art9.data.special": [
"basis.vital-interests"
]
}
},
{
"is": {
"art9.data.children": "basis.vital-interests"
}
}
]
}
]
},
"asks": {
"step": 6,
"q": null,
"why": "The GDPR allows processing needed to protect someone's life, and for special category data only where the person cannot consent.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/vital-interests/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.vital-interests.svg"
},
{
"id": "basis.public-task",
"cat": "basis",
"name": "Public task",
"desc": "Processing is necessary for a task carried out in the public interest or in the exercise of official authority.",
"snippet": "We rely on our public task under [name of law / function] for [purpose].",
"law": "GDPR Art 6(1)(e), 6(3), Recital 45",
"clause": "We rely on our public task for [purposes]. We carry out this task under [task_law].{if task_desc} The task is [task_desc].{/if}",
"vars": [
{
"name": "purposes",
"type": "multi",
"label": "Which purposes rely on a public task?",
"options": "@purpose",
"required": true
},
{
"name": "task_law",
"type": "text",
"label": "Which law or official function gives you this task?",
"required": true,
"validation": {
"max": 150
},
"hint": "For example 'the Local Government Act 1972' or 'our statutory functions as a regulator'."
},
{
"name": "task_desc",
"type": "text",
"label": "Describe the task in a few words, if you want to",
"required": false,
"validation": {
"max": 150
}
}
],
"conditions": {
"anyBasis": "basis.public-task"
},
"asks": {
"step": 6,
"q": "Which law or official function gives you this public task?",
"why": "The GDPR allows processing for a task in the public interest or official authority only where the task is laid down in law.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/public-task/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.public-task.svg"
},
{
"id": "basis.legitimate-interests",
"cat": "basis",
"name": "Legitimate interests",
"desc": "Processing is necessary for our or a third party's legitimate interests, and those interests are not overridden by your rights. Requires a documented balancing test.",
"snippet": "We rely on our legitimate interests in [interest, for example running and improving our business / marketing to existing customers / keeping our systems secure] for [purpose]. We have balanced these interests against your rights and you can object at any time; contact us for details of our assessment.",
"law": "GDPR Art 6(1)(f), 13(1)(d), 21(1), Recitals 47 to 50; UK GDPR Art 6(1)(f) and 6(11) (examples: direct marketing, intra-group transmission for internal administration, network and information security), inserted by DUAA 2025 s 70(4)",
"clause": "We rely on our legitimate interests for [purposes]. Our interest is [interest]. We have balanced this interest against your interests, rights, and freedoms and conclude that they do not override it.",
"vars": [
{
"name": "purposes",
"type": "multi",
"label": "Which purposes rely on legitimate interests?",
"options": "@purpose",
"required": true
},
{
"name": "interest",
"type": "choice",
"label": "What is the interest?",
"required": true,
"options": [
{
"value": "fraud",
"label": "Preventing fraud and abuse",
"text": "preventing fraud and abuse of our service"
},
{
"value": "security",
"label": "Network and information security",
"text": "keeping our systems and your data secure"
},
{
"value": "marketing_existing",
"label": "Marketing to existing customers",
"text": "telling existing customers about similar products and services"
},
{
"value": "group_admin",
"label": "Group administration",
"text": "sharing data within our group for internal administration"
},
{
"value": "improve",
"label": "Understanding and improving the service",
"text": "understanding how our service is used and improving it"
},
{
"value": "personalise",
"label": "Personalising the service",
"text": "personalising the service and remembering your preferences"
},
{
"value": "records",
"label": "Customer service and record keeping",
"text": "handling enquiries and complaints and keeping records"
},
{
"value": "claims",
"label": "Legal claims and enforcing terms",
"text": "establishing, exercising, or defending legal claims and enforcing our terms"
},
{
"value": "identity",
"label": "Verifying identity or age",
"text": "verifying identity or age and preventing under-age use"
},
{
"value": "premises",
"label": "Physical security of premises",
"text": "keeping our premises and staff safe"
},
{
"value": "hr",
"label": "HR and staff administration",
"text": "managing our staff"
},
{
"value": "transaction",
"label": "Merger, acquisition, or financing",
"text": "carrying out due diligence in a sale, merger, or financing"
},
{
"value": "research",
"label": "Research and statistics",
"text": "producing research and statistics about our users"
},
{
"value": "reporting",
"label": "Reporting crime or threats",
"text": "reporting criminal acts or threats to public security"
},
{
"value": "third_party",
"label": "A third party's interest",
"text": "[third_party_interest]"
},
{
"value": "other",
"label": "Other",
"text": "[other_interest]"
}
],
"hint": "Suggested per purpose: security → Network and information security; improvement or analytics → Understanding and improving the service; support → Customer service and record keeping; legal-claims → Legal claims and enforcing terms; returns-fraud → Preventing fraud and abuse; personalisation → Personalising the service; research → Research and statistics; marketing → Marketing to existing customers; volunteers → HR and staff administration."
},
{
"name": "third_party_interest",
"type": "text",
"label": "Whose interest, and what is it?",
"required": false,
"validation": {
"max": 200
},
"hint": "Name the organisation and its interest, for example 'our advertising partners' interest in measuring their campaigns'. Needed where a recipient's own interest is relied on (Art 13(1)(d))."
},
{
"name": "other_interest",
"type": "text",
"label": "Describe the interest in one sentence",
"required": false,
"validation": {
"max": 200
}
}
],
"conditions": {
"anyBasis": "basis.legitimate-interests"
},
"asks": {
"step": 6,
"q": "Which of these interests explains why you need the data for this purpose?",
"why": "The GDPR requires the policy to name the legitimate interest, which must not be overridden by the person's interests, rights, and freedoms.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.legitimate-interests.svg"
},
{
"id": "basis.recognised-li",
"cat": "basis",
"name": "Recognised legitimate interest (UK)",
"desc": "A UK-only basis inserted by the Data (Use and Access) Act 2025: listed interests (for example crime prevention, safeguarding, emergencies, disclosures to public bodies) that need no balancing test.",
"snippet": "[UK only] We rely on a recognised legitimate interest under Annex 1 of the UK GDPR, namely [detecting or preventing crime / safeguarding vulnerable individuals / responding to an emergency / disclosure to a public body], for [purpose].",
"law": "UK GDPR Art 6(1)(ea), 6(5) and Annex 1 paras 1 to 8, inserted by Data (Use and Access) Act 2025 s 70(2), (4), (6) and Sch 4, in force 5 February 2026 (SI 2026/82); no EU equivalent",
"clause": "Under UK law we rely on a recognised legitimate interest for [purposes]. The interest is [recognised_interest].",
"vars": [
{
"name": "purposes",
"type": "multi",
"label": "Which purposes rely on a recognised legitimate interest?",
"options": "@purpose",
"required": true
},
{
"name": "recognised_interest",
"type": "choice",
"label": "Which recognised legitimate interest applies?",
"required": true,
"options": [
{
"value": "public_body",
"label": "Disclosure at the request of a person carrying out a public task",
"text": "disclosing data to a person who has asked for it to carry out a public task"
},
{
"value": "security",
"label": "National security, public security, or defence",
"text": "protecting national security, public security, or defence"
},
{
"value": "emergency",
"label": "Responding to an emergency",
"text": "responding to an emergency"
},
{
"value": "crime",
"label": "Detecting, investigating, or preventing crime",
"text": "detecting, investigating, or preventing crime, or apprehending or prosecuting offenders"
},
{
"value": "safeguarding",
"label": "Safeguarding vulnerable people",
"text": "safeguarding children and adults at risk"
}
]
}
],
"conditions": {
"all": [
"jurisdiction.uk",
{
"anyBasis": "basis.recognised-li"
}
]
},
"asks": {
"step": 6,
"q": "Which recognised legitimate interest applies to this purpose?",
"why": "UK law lists recognised legitimate interests that need no balancing test, and the policy must state the legal basis, so it names the condition.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/recognised-legitimate-interest-detailed/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.recognised-li.svg"
},
{
"id": "basis.art9-employment",
"cat": "basis",
"name": "Employment & social security law (Art 9(2)(b))",
"desc": "Processing of special category data necessary for obligations or rights under employment, social security or social protection law.",
"snippet": "We process [special category data] where necessary to meet our obligations under [employment / social security] law, as permitted by Article 9(2)(b) [and [national law / DPA 2018 Sch 1 para 1]].",
"law": "GDPR Art 9(2)(b); UK DPA 2018 s 10(2) and Sch 1 Part 1 para 1 (appropriate policy document required, para 1(1)(b) and para 39)",
"clause": "We process [special_categories] where necessary for rights or obligations (ours or yours). These arise under [employment_law_area] (Article 9(2)(b) GDPR).{if apd} [apd]{/if}{if condition_law} The law that permits this is [condition_law].{/if}",
"vars": [
{
"name": "special_categories",
"type": "multi",
"label": "Which special category data does this cover?",
"options": "@data",
"required": true,
"hint": "Tick only the special category data items this condition applies to."
},
{
"name": "employment_law_area",
"type": "choice",
"label": "Which area of law?",
"required": true,
"options": [
{
"value": "employment",
"label": "Employment law",
"text": "employment law"
},
{
"value": "social_security",
"label": "Social security law",
"text": "social security law"
},
{
"value": "social_protection",
"label": "Social protection law",
"text": "social protection law"
},
{
"value": "all",
"label": "Employment, social security, and social protection law",
"text": "employment, social security, and social protection law"
}
]
},
{
"name": "apd",
"when": "jurisdiction.uk",
"type": "choice",
"label": "Do you have an appropriate policy document in place?",
"required": true,
"hint": "Required by UK law for this condition (DPA 2018 Sch 1 para 1(1)(b); contents in para 39). Choose 'Not stated' if none, or outside the UK.",
"options": [
{
"value": "yes",
"label": "Yes",
"text": "We have an appropriate policy document in place for this processing."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
},
{
"name": "condition_law",
"type": "text",
"label": "Which law permits this processing, if you want to name it?",
"required": false,
"validation": {
"max": 150
},
"hint": "UK: 'the Data Protection Act 2018, Schedule 1, paragraph 1'. EU: the national law or collective agreement that applies."
}
],
"conditions": {
"any": [
{
"is": {
"art9.data.biometric": "basis.art9-employment"
}
},
{
"is": {
"art9.data.health": "basis.art9-employment"
}
},
{
"is": {
"art9.data.genetic": "basis.art9-employment"
}
},
{
"in": {
"art9.data.special": [
"basis.art9-employment"
]
}
}
]
},
"asks": {
"step": 3,
"q": null,
"why": "The GDPR permits special category data processing needed to meet obligations under employment, social security, or social protection law.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-conditions-for-processing/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.art9-employment.svg"
},
{
"id": "basis.art9-not-for-profit",
"cat": "basis",
"name": "Not-for-profit body's members (Art 9(2)(d))",
"desc": "Processing by a foundation, association or other not-for-profit body with a political, philosophical, religious or trade-union aim, relating to its members or regular contacts.",
"snippet": "As a not-for-profit body with a [political / philosophical / religious / trade-union] aim, we process [special category data] about our members and regular contacts in the course of our legitimate activities, as permitted by Article 9(2)(d). We do not disclose it outside the organisation without consent.",
"law": "GDPR Art 9(2)(d)",
"clause": "We are a not-for-profit body with a [nfp_aim] aim. We process [special_categories] about our members, former members, and people in regular contact with us. We do this only for our own purposes, with appropriate safeguards, as part of our legitimate activities (Article 9(2)(d) GDPR). We do not disclose it outside our organisation without your consent.",
"vars": [
{
"name": "nfp_aim",
"type": "choice",
"label": "What is the body's aim?",
"required": true,
"options": [
{
"value": "political",
"label": "Political",
"text": "political"
},
{
"value": "philosophical",
"label": "Philosophical",
"text": "philosophical"
},
{
"value": "religious",
"label": "Religious",
"text": "religious"
},
{
"value": "trade_union",
"label": "Trade union",
"text": "trade union"
}
]
},
{
"name": "special_categories",
"type": "multi",
"label": "Which special category data does this cover?",
"options": "@data",
"required": true,
"hint": "Tick only the special category data items this condition applies to."
}
],
"conditions": {
"all": [
"org.not_for_profit",
{
"any": [
{
"is": {
"art9.data.biometric": "basis.art9-not-for-profit"
}
},
{
"is": {
"art9.data.health": "basis.art9-not-for-profit"
}
},
{
"is": {
"art9.data.genetic": "basis.art9-not-for-profit"
}
},
{
"in": {
"art9.data.special": [
"basis.art9-not-for-profit"
]
}
}
]
}
]
},
"asks": {
"step": 3,
"q": null,
"why": "The GDPR permits a not-for-profit body with a political, philosophical, religious, or trade union aim to process its members' special category data.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-conditions-for-processing/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.art9-not-for-profit.svg"
},
{
"id": "basis.art9-public",
"cat": "basis",
"name": "Data manifestly made public (Art 9(2)(e))",
"desc": "Processing of special category data that the individual has manifestly made public.",
"snippet": "We process [special category data] that you have manifestly made public, for example [in your public profile], as permitted by Article 9(2)(e).",
"law": "GDPR Art 9(2)(e)",
"clause": "We process [special_categories] that you have yourself clearly made public, for example [public_example] (Article 9(2)(e) GDPR).",
"vars": [
{
"name": "special_categories",
"type": "multi",
"label": "Which special category data does this cover?",
"options": "@data",
"required": true,
"hint": "Tick only the special category data items this condition applies to."
},
{
"name": "public_example",
"type": "choice",
"label": "Where has the person made it public?",
"required": true,
"options": [
{
"value": "profile",
"label": "In their public profile on our service",
"text": "in your public profile"
},
{
"value": "post",
"label": "In a public post or comment on our service",
"text": "in a public post or comment"
},
{
"value": "social",
"label": "On a public website or social media",
"text": "on a public website or social media account"
},
{
"value": "other",
"label": "Other (describe)",
"text": "[public_other]"
}
]
},
{
"name": "public_other",
"type": "text",
"label": "Describe where it was made public",
"required": false,
"validation": {
"max": 120
}
}
],
"conditions": {
"any": [
{
"is": {
"art9.data.biometric": "basis.art9-public"
}
},
{
"is": {
"art9.data.health": "basis.art9-public"
}
},
{
"is": {
"art9.data.genetic": "basis.art9-public"
}
},
{
"in": {
"art9.data.special": [
"basis.art9-public"
]
}
},
{
"is": {
"art9.data.children": "basis.art9-public"
}
}
]
},
"asks": {
"step": 3,
"q": null,
"why": "The GDPR permits processing of special category data that the person has manifestly made public themselves.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-conditions-for-processing/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.art9-public.svg"
},
{
"id": "basis.art9-legal-claims",
"cat": "basis",
"name": "Legal claims (Art 9(2)(f))",
"desc": "Processing of special category data necessary to establish, exercise or defend legal claims.",
"snippet": "We process [special category data] where necessary to establish, exercise or defend legal claims, as permitted by Article 9(2)(f).",
"law": "GDPR Art 9(2)(f), Recital 52; no additional UK condition (DPA 2018 s 10 does not apply to Art 9(2)(f)); for criminal offence data the parallel condition is DPA 2018 Sch 1 para 33",
"clause": "We process [special_categories] where necessary to establish, exercise, or defend legal claims (Article 9(2)(f) GDPR).{if claims_context} This includes [claims_context].{/if}",
"vars": [
{
"name": "special_categories",
"type": "multi",
"label": "Which special category data does this cover?",
"options": "@data",
"required": true,
"hint": "Tick only the special category data items this condition applies to."
},
{
"name": "claims_context",
"type": "multi",
"label": "What kinds of claims?",
"required": false,
"options": [
{
"value": "complaints",
"label": "Complaints and disputes",
"text": "complaints and disputes"
},
{
"value": "court",
"label": "Court or tribunal proceedings",
"text": "court or tribunal proceedings"
},
{
"value": "insurance",
"label": "Insurance claims",
"text": "insurance claims"
},
{
"value": "terms",
"label": "Enforcing our terms",
"text": "enforcing our terms"
}
]
}
],
"conditions": {
"any": [
{
"is": {
"art9.data.biometric": "basis.art9-legal-claims"
}
},
{
"is": {
"art9.data.health": "basis.art9-legal-claims"
}
},
{
"is": {
"art9.data.genetic": "basis.art9-legal-claims"
}
},
{
"in": {
"art9.data.special": [
"basis.art9-legal-claims"
]
}
},
{
"is": {
"art9.data.children": "basis.art9-legal-claims"
}
}
]
},
"asks": {
"step": 3,
"q": null,
"why": "The GDPR permits special category data processing needed to establish, exercise, or defend legal claims, in or out of court.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-conditions-for-processing/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.art9-legal-claims.svg"
},
{
"id": "basis.art9-public-interest",
"cat": "basis",
"name": "Substantial public interest (Art 9(2)(g))",
"desc": "Processing of special category data necessary for reasons of substantial public interest under EU, Member State or UK law.",
"snippet": "We process [special category data] for reasons of substantial public interest under [name of law / DPA 2018 Sch 1 Part 2 condition [x]], namely [purpose], as permitted by Article 9(2)(g).",
"law": "GDPR Art 9(2)(g) and (i); UK DPA 2018 s 10(2), (3), Sch 1 Part 2 paras 6 to 28 (substantial public interest, 23 conditions, appropriate policy document required by para 5 except paras 10(2), 13(3), 27(3)) and Sch 1 para 3 (public health, no policy document)",
"clause": "We process [special_categories] [spi_ground]. The law that permits this is [spi_law]. Our purpose is [spi_purpose].{if apd} [apd]{/if}{if spi_professional} [spi_professional]{/if}",
"vars": [
{
"name": "special_categories",
"type": "multi",
"label": "Which special category data does this cover?",
"options": "@data",
"required": true,
"hint": "Tick only the special category data items this condition applies to."
},
{
"name": "spi_ground",
"type": "choice",
"label": "Which ground?",
"required": true,
"default": "g",
"options": [
{
"value": "g",
"label": "Substantial public interest (Article 9(2)(g))",
"text": "for reasons of substantial public interest (Article 9(2)(g) GDPR)"
},
{
"value": "i",
"label": "Public health (Article 9(2)(i))",
"text": "for reasons of public interest in the area of public health (Article 9(2)(i) GDPR)"
}
]
},
{
"name": "spi_law",
"type": "text",
"label": "Which law permits it?",
"required": true,
"validation": {
"max": 150
},
"hint": "UK, substantial public interest: 'the Data Protection Act 2018, Schedule 1, Part 2, paragraph N'. UK, public health: 'the Data Protection Act 2018, Schedule 1, paragraph 3'. EU: the national law that applies."
},
{
"name": "spi_purpose",
"type": "choice",
"label": "What is the purpose?",
"required": true,
"options": [
{
"value": "equality",
"label": "Equal opportunities monitoring",
"text": "monitoring equality of opportunity or treatment"
},
{
"value": "fraud",
"label": "Preventing fraud",
"text": "preventing fraud"
},
{
"value": "unlawful",
"label": "Preventing or detecting unlawful acts",
"text": "preventing or detecting unlawful acts"
},
{
"value": "safeguarding",
"label": "Safeguarding children and adults at risk",
"text": "safeguarding children and adults at risk"
},
{
"value": "regulatory",
"label": "Meeting regulatory requirements",
"text": "meeting regulatory requirements about dishonesty, malpractice, or improper conduct"
},
{
"value": "support",
"label": "Support for people with a disability or medical condition",
"text": "providing support to people with a particular disability or medical condition"
},
{
"value": "counselling",
"label": "Counselling and support services",
"text": "providing confidential counselling, advice, or support services"
},
{
"value": "insurance",
"label": "Insurance",
"text": "arranging or administering insurance"
},
{
"value": "journalism",
"label": "Journalism about unlawful acts or dishonesty",
"text": "journalism about unlawful acts, dishonesty, malpractice, or seriously improper conduct"
},
{
"value": "statutory",
"label": "Statutory or government purposes",
"text": "carrying out our statutory or government functions"
},
{
"value": "public_health",
"label": "Public health",
"text": "protecting public health"
},
{
"value": "other",
"label": "Other (describe)",
"text": "[spi_other]"
}
]
},
{
"name": "spi_other",
"type": "text",
"label": "Describe the purpose in a few words",
"required": false,
"validation": {
"max": 150
}
},
{
"name": "apd",
"when": "jurisdiction.uk",
"type": "choice",
"label": "Do you have an appropriate policy document in place?",
"required": true,
"hint": "Required by UK law for Sch 1 Part 2 conditions (DPA 2018 Sch 1 para 5; contents in para 39), except paras 10(2), 13(3), 27(3). Not required for public health (para 3). Choose 'Not stated' if none, or outside the UK.",
"options": [
{
"value": "yes",
"label": "Yes",
"text": "We have an appropriate policy document in place for this processing."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
},
{
"name": "spi_professional",
"type": "choice",
"label": "Public health only: is the processing done by or under a health professional or someone bound by confidentiality?",
"required": false,
"options": [
{
"value": "yes",
"label": "Yes",
"text": "This is done by or under the responsibility of a health professional or a person bound by a duty of confidentiality."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none",
"hint": "UK: required for the public health condition (DPA 2018 Sch 1 para 3(b)). Leave as not stated for the substantial public interest ground."
}
],
"conditions": {
"any": [
{
"is": {
"art9.data.biometric": "basis.art9-public-interest"
}
},
{
"is": {
"art9.data.health": "basis.art9-public-interest"
}
},
{
"is": {
"art9.data.genetic": "basis.art9-public-interest"
}
},
{
"in": {
"art9.data.special": [
"basis.art9-public-interest"
]
}
},
{
"is": {
"art9.data.children": "basis.art9-public-interest"
}
}
]
},
"asks": {
"step": 3,
"q": "Which public interest condition and law do you rely on?",
"why": "The GDPR permits special category data processing for substantial public interest or public health only under a specific EU, Member State, or UK law.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-conditions-for-processing/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.art9-public-interest.svg"
},
{
"id": "basis.art9-health",
"cat": "basis",
"name": "Health or social care (Art 9(2)(h))",
"desc": "Processing necessary for preventive or occupational medicine, diagnosis, care or treatment, or management of health systems, under professional secrecy.",
"snippet": "We process [health data] for [medical diagnosis / care and treatment / occupational medicine / management of health services] as permitted by Article 9(2)(h), by or under the responsibility of a professional bound by an obligation of secrecy.",
"law": "GDPR Art 9(2)(h), 9(3); UK DPA 2018 s 10(2), s 11(1), Sch 1 Part 1 para 2 (no appropriate policy document required)",
"clause": "We process [health_categories] for [health_purpose] (Article 9(2)(h) GDPR). This is done by or under the responsibility of a professional, or by another person, bound by a duty of confidentiality.{if apd} [apd]{/if}{if condition_law} The law that permits this is [condition_law].{/if}",
"vars": [
{
"name": "health_categories",
"type": "multi",
"label": "Which special category data does this cover?",
"options": "@data",
"required": true,
"hint": "Tick only the special category data items this condition applies to."
},
{
"name": "health_purpose",
"type": "choice",
"label": "For which purpose?",
"required": true,
"options": [
{
"value": "preventive",
"label": "Preventive or occupational medicine",
"text": "preventive or occupational medicine"
},
{
"value": "capacity",
"label": "Assessing working capacity",
"text": "assessing your working capacity"
},
{
"value": "diagnosis",
"label": "Medical diagnosis",
"text": "medical diagnosis"
},
{
"value": "care",
"label": "Health or social care or treatment",
"text": "providing health or social care or treatment"
},
{
"value": "management",
"label": "Managing health or social care services",
"text": "managing health or social care systems and services"
}
]
},
{
"name": "apd",
"when": "jurisdiction.uk",
"type": "choice",
"label": "Do you have an appropriate policy document in place?",
"required": true,
"hint": "Not required by UK law for this condition (DPA 2018 Sch 1 para 2 has no policy document requirement). Choose 'Yes' only if you keep one anyway.",
"options": [
{
"value": "yes",
"label": "Yes",
"text": "We have an appropriate policy document in place for this processing."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
},
{
"name": "condition_law",
"type": "text",
"label": "Which law permits this processing, if you want to name it?",
"required": false,
"validation": {
"max": 150
},
"hint": "UK: 'the Data Protection Act 2018, Schedule 1, paragraph 2'. EU: the national law that applies, or the contract with a health professional."
}
],
"conditions": {
"any": [
{
"is": {
"art9.data.biometric": "basis.art9-health"
}
},
{
"is": {
"art9.data.health": "basis.art9-health"
}
},
{
"is": {
"art9.data.genetic": "basis.art9-health"
}
},
{
"in": {
"art9.data.special": [
"basis.art9-health"
]
}
},
{
"is": {
"art9.data.children": "basis.art9-health"
}
}
]
},
"asks": {
"step": 3,
"q": null,
"why": "The GDPR permits health data processing for care, diagnosis, or health service management by or under a professional bound by secrecy.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-conditions-for-processing/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.art9-health.svg"
},
{
"id": "basis.art9-research",
"cat": "basis",
"name": "Archiving, research or statistics (Art 9(2)(j))",
"desc": "Processing of special category data necessary for archiving in the public interest, scientific or historical research, or statistics, with safeguards.",
"snippet": "We process [special category data] for [scientific research / statistical] purposes as permitted by Article 9(2)(j), subject to the safeguards in Article 89(1), including [pseudonymisation and access controls].",
"law": "GDPR Arts 9(2)(j), 89(1); UK DPA 2018 s 10(2) and Sch 1 Part 1 para 4, which requires compliance with UK GDPR Art 84B (inserted by DUAA 2025 s 86(2); DPA 2018 s 19 repealed by DUAA 2025 s 86(6) from 5 February 2026)",
"clause": "We process [special_categories] for [research_purpose] (Article 9(2)(j) GDPR). We apply safeguards, including [research_safeguards].{if condition_law} The law that permits this is [condition_law].{/if}",
"vars": [
{
"name": "special_categories",
"type": "multi",
"label": "Which special category data does this cover?",
"options": "@data",
"required": true,
"hint": "Tick only the special category data items this condition applies to."
},
{
"name": "research_purpose",
"type": "choice",
"label": "For which purpose?",
"required": true,
"options": [
{
"value": "scientific",
"label": "Scientific research",
"text": "scientific research"
},
{
"value": "historical",
"label": "Historical research",
"text": "historical research"
},
{
"value": "statistics",
"label": "Statistical purposes",
"text": "statistical purposes"
},
{
"value": "archiving",
"label": "Archiving in the public interest",
"text": "archiving in the public interest"
}
]
},
{
"name": "research_safeguards",
"type": "multi",
"label": "Which safeguards do you apply?",
"required": true,
"options": [
{
"value": "pseudonymisation",
"label": "Pseudonymisation",
"text": "pseudonymisation"
},
{
"value": "minimisation",
"label": "Using only the data the research needs",
"text": "using only the data the research needs"
},
{
"value": "access",
"label": "Access limited to the research team",
"text": "limiting access to the research team"
},
{
"value": "aggregate",
"label": "Publishing results only in aggregate form",
"text": "publishing results only in aggregate form"
},
{
"value": "no_decisions",
"label": "No decisions about individuals",
"text": "not using the data to make decisions about you"
},
{
"value": "ethics",
"label": "Ethics committee approval",
"text": "approval by an ethics committee"
}
]
},
{
"name": "condition_law",
"type": "text",
"label": "Which law permits this processing, if you want to name it?",
"required": false,
"validation": {
"max": 150
},
"hint": "UK: 'the Data Protection Act 2018, Schedule 1, paragraph 4'. EU: the national law that applies."
}
],
"conditions": {
"any": [
{
"is": {
"art9.data.biometric": "basis.art9-research"
}
},
{
"is": {
"art9.data.health": "basis.art9-research"
}
},
{
"is": {
"art9.data.genetic": "basis.art9-research"
}
},
{
"in": {
"art9.data.special": [
"basis.art9-research"
]
}
},
{
"is": {
"art9.data.children": "basis.art9-research"
}
}
]
},
"asks": {
"step": 3,
"q": null,
"why": "The GDPR permits special category data processing for research, statistics, or archiving where safeguards such as pseudonymisation are in place.",
"links": {
"gdpr": "https://gdpr-info.eu/art-89-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-conditions-for-processing/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.art9-research.svg"
},
{
"id": "basis.art10",
"cat": "basis",
"name": "Criminal offence data condition (Art 10)",
"desc": "Processing of criminal conviction and offence data under the control of official authority or as authorised by law.",
"snippet": "We process data about criminal convictions and offences [under official authority / as authorised by [name of law / DPA 2018 Sch 1 Part 3 condition [x]]], for [purpose].",
"law": "GDPR Art 10; UK DPA 2018 s 10(4), (5), s 11(2) and Sch 1 Parts 1 to 3 (Part 3 paras 29 to 37)",
"clause": "We process data about criminal convictions and offences for [purposes]. We do this [art10_authority] (Article 10 GDPR).{if apd} [apd]{/if}",
"vars": [
{
"name": "purposes",
"type": "multi",
"label": "Which purposes use criminal offence data?",
"options": "@purpose",
"required": true
},
{
"name": "art10_authority",
"type": "choice",
"label": "What authorises this processing?",
"required": true,
"options": [
{
"value": "official",
"label": "Official authority",
"text": "under official authority"
},
{
"value": "law",
"label": "A law that authorises it (name it)",
"text": "as authorised by [art10_law]"
}
]
},
{
"name": "art10_law",
"type": "text",
"label": "Which law authorises it?",
"required": false,
"validation": {
"max": 150
},
"hint": "UK: 'the Data Protection Act 2018, Schedule 1' plus the condition number. EU: the national law that applies."
},
{
"name": "apd",
"when": "jurisdiction.uk",
"type": "choice",
"label": "Do you have an appropriate policy document in place?",
"required": true,
"hint": "Required by UK law only where the Sch 1 condition relied on requires one: para 1 (employment) and the Part 2 conditions, including those applied by para 36 (DPA 2018 Sch 1 paras 5 and 39). Choose 'Not stated' if none, or outside the UK.",
"options": [
{
"value": "yes",
"label": "Yes",
"text": "We have an appropriate policy document in place for this processing."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
}
],
"conditions": {
"is": {
"art10": "basis.art10"
}
},
"asks": {
"step": 3,
"q": "What authorises you to process criminal offence data?",
"why": "The GDPR allows criminal conviction and offence data to be processed only under official authority or where a law authorises it.",
"links": {
"gdpr": "https://gdpr-info.eu/art-10-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/criminal-offence-data/"
}
},
"multiple": true,
"g16": "",
"file": "icons/basis.art10.svg"
},
{
"id": "processing.storage",
"cat": "processing",
"name": "Storage",
"desc": "Recording and holding data in our systems, databases or those of our hosting providers.",
"snippet": "We store your data on [our own servers / servers operated by [hosting provider]] located in [country/region].",
"law": "GDPR Arts 4(2), 32; APP 11",
"clause": "We store your personal data on [storage_where]. The servers are in [storage_location].",
"vars": [
{
"name": "storage_where",
"type": "choice",
"label": "Whose servers hold the data?",
"required": true,
"options": [
{
"value": "own",
"label": "Our own servers",
"text": "our own servers"
},
{
"value": "hosting",
"label": "A hosting provider's servers",
"text": "servers run for us by our hosting provider"
},
{
"value": "hosting_named",
"label": "A named hosting provider's servers",
"text": "servers run for us by [hosting_provider]"
},
{
"value": "both",
"label": "Our own servers and a hosting provider's",
"text": "our own servers and on servers run for us by our hosting provider"
}
]
},
{
"name": "hosting_provider",
"type": "text",
"label": "Hosting provider name",
"required": false,
"validation": {
"max": 100
}
},
{
"name": "storage_location",
"type": "choice",
"label": "Where are the servers?",
"required": true,
"options": [
{
"value": "eea",
"label": "EEA",
"text": "the EEA"
},
{
"value": "uk",
"label": "UK",
"text": "the UK"
},
{
"value": "eea_uk",
"label": "EEA and UK",
"text": "the EEA and the UK"
},
{
"value": "us",
"label": "United States",
"text": "the United States"
},
{
"value": "other",
"label": "Other countries",
"text": "[storage_countries]"
}
],
"hint": "Servers outside the EEA and UK, or in the other of the two, are an international transfer. Step 9 asks about the safeguards."
},
{
"name": "storage_countries",
"type": "multi",
"label": "Which countries?",
"required": false,
"options": "@country"
}
],
"conditions": "processing.storage",
"asks": {
"step": 7,
"q": "Do you store personal data on your own servers or with a hosting provider?",
"why": "The GDPR requires you to keep data secure and to say whether you transfer it outside the EEA or UK.",
"links": {
"gdpr": "https://gdpr-info.eu/art-32-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/"
}
},
"g16": "",
"file": "icons/processing.storage.svg"
},
{
"id": "processing.profiling",
"cat": "processing",
"name": "Profiling",
"desc": "Automated evaluation of personal aspects, such as interests, behaviour, reliability or location, to analyse or predict.",
"snippet": "We profile you by [analysing your [behaviour/purchases/interests] to [predict your preferences / assess [risk]]]. [This profiling does not produce legal or similarly significant effects.] You can object at any time.",
"law": "GDPR Arts 4(4), 13(2)(f), 21(1)-(2), 22, Recitals 71-72",
"clause": "We profile you by analysing [profiling_inputs] to [profiling_aims].{if profiling_inputs_more} We may use other data for this in future.{/if} [profiling_logic]{if profiling_logic_text} [profiling_logic_text]{/if} [profiling_effect]",
"vars": [
{
"name": "profiling_inputs",
"type": "multi",
"label": "Which data do you analyse?",
"required": true,
"extensible": true,
"options": [
{
"value": "usage",
"label": "How people use the service",
"text": "how you use our service"
},
{
"value": "purchases",
"label": "Purchases",
"text": "your purchases"
},
{
"value": "interests",
"label": "Stated interests",
"text": "the interests you tell us about"
},
{
"value": "location",
"label": "Location",
"text": "your location"
},
{
"value": "device",
"label": "Device and browsing data",
"text": "your device and browsing data"
},
{
"value": "demographic",
"label": "Age and other details given",
"text": "your age and other details you give us"
}
]
},
{
"name": "profiling_aims",
"type": "multi",
"label": "What is the profiling for?",
"required": true,
"options": [
{
"value": "predict",
"label": "Predict interests",
"text": "predict what you are likely to be interested in"
},
{
"value": "recommend",
"label": "Recommend content or products",
"text": "recommend content and products"
},
{
"value": "segment",
"label": "Group similar customers",
"text": "group you with similar customers"
},
{
"value": "risk",
"label": "Assess fraud or misuse risk",
"text": "assess the risk of fraud or misuse"
},
{
"value": "credit",
"label": "Assess creditworthiness",
"text": "assess your creditworthiness"
},
{
"value": "offers",
"label": "Decide which offers or prices to show",
"text": "decide which offers or prices to show you"
}
]
},
{
"name": "profiling_logic",
"type": "choice",
"label": "How does it work, in plain words?",
"required": true,
"options": [
{
"value": "rules",
"label": "Rules we set ourselves",
"text": "We apply rules we set ourselves to this data."
},
{
"value": "model",
"label": "A statistical model trained on past data",
"text": "We use a statistical model trained on past data to score you."
},
{
"value": "mixed",
"label": "Both rules and a model",
"text": "We use rules we set ourselves and a statistical model trained on past data."
},
{
"value": "none",
"label": "Describe it yourself",
"text": ""
}
]
},
{
"name": "profiling_logic_text",
"type": "text",
"label": "Describe the logic in one or two short sentences",
"required": false,
"validation": {
"max": 300
},
"hint": "Say which data counts most and how the result is reached. Keep each sentence under 25 words."
},
{
"name": "profiling_effect",
"type": "choice",
"label": "What effect does the profiling have on people?",
"required": true,
"options": [
{
"value": "none",
"label": "No legal or similarly significant effect",
"text": "This profiling has no legal or similarly significant effect on you."
},
{
"value": "content",
"label": "It affects content and offers shown",
"text": "It affects which content and offers you see, but not your access to our service or its price."
},
{
"value": "adm",
"label": "It feeds automated decisions",
"text": "It is used in the automated decisions we describe in this policy."
}
],
"default": "none"
}
],
"conditions": "processing.profiling",
"asks": {
"step": 7,
"q": "Do you analyse or predict people's interests, behaviour, or reliability from their data?",
"why": "The GDPR requires you to tell people that profiling happens and, where it has significant effects, its logic and consequences.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/automated-decision-making-and-profiling/"
}
},
"g16": "",
"file": "icons/processing.profiling.svg"
},
{
"id": "processing.adm",
"cat": "processing",
"name": "Automated decision-making",
"desc": "Decisions made solely by automated means that have legal or similarly significant effects on you.",
"snippet": "We make automated decisions about [credit / eligibility / pricing / fraud] using [logic in plain terms]. Such decisions [may [affect you by]].",
"law": "GDPR Arts 13(2)(f), 22, 22(4), Recital 71; UK GDPR Arts 22A to 22D (DUAA 2025 s 80) and 13(2)(f) (DUAA 2025 Sch 6 para 3), in force 5 February 2026; CPPA regulations on automated decisionmaking technology (2025)",
"clause": "We make decisions about [adm_subjects] solely by automated means, with no person involved. [adm_logic] [adm_consequence]{if adm_consequence_text} [adm_consequence_text]{/if}{if adm_exception} We do this [adm_exception].{/if}{if adm_special} [adm_special]{/if}",
"vars": [
{
"name": "adm_subjects",
"type": "multi",
"label": "What do the decisions concern?",
"required": true,
"free": true,
"options": [
{
"value": "credit",
"label": "Credit or lending",
"text": "credit or lending"
},
{
"value": "eligibility",
"label": "Eligibility for the service or an offer",
"text": "your eligibility for our service or an offer"
},
{
"value": "pricing",
"label": "Price or terms offered",
"text": "the price or terms you are offered"
},
{
"value": "fraud",
"label": "Blocking suspected fraud",
"text": "blocking a transaction or account as suspected fraud"
},
{
"value": "recruitment",
"label": "Job applications",
"text": "whether a job application progresses"
},
{
"value": "content",
"label": "Removing or restricting content or accounts",
"text": "removing or restricting your content or account"
}
]
},
{
"name": "adm_logic",
"type": "text",
"label": "How is the decision reached, in plain words?",
"required": true,
"validation": {
"max": 300
},
"hint": "One or two sentences of up to 25 words. Say which data counts most and how the outcome is reached."
},
{
"name": "adm_consequence",
"type": "choice",
"label": "What happens to the person as a result?",
"required": true,
"options": [
{
"value": "refusal",
"label": "They may be refused the service or offer",
"text": "If the outcome is negative, we refuse you the service or the offer."
},
{
"value": "block",
"label": "Their account or transaction is blocked",
"text": "If the outcome is negative, we block the transaction or account."
},
{
"value": "pricing",
"label": "It sets the price or terms",
"text": "The outcome sets the price or terms you are offered."
},
{
"value": "rejection",
"label": "Their application does not progress",
"text": "If the outcome is negative, your application does not progress."
},
{
"value": "none",
"label": "Describe it yourself",
"text": ""
}
]
},
{
"name": "adm_consequence_text",
"type": "text",
"label": "Describe the consequences in one short sentence",
"required": false,
"validation": {
"max": 200
}
},
{
"name": "adm_exception",
"type": "choice",
"label": "What allows this decision under EU law (Article 22(2))?",
"required": false,
"options": [
{
"value": "basis.contract",
"label": "Necessary for a contract with the person (Art 22(2)(a))",
"text": "because it is necessary to enter into or perform our contract with you"
},
{
"value": "basis.legal-obligation",
"label": "Authorised by law (Art 22(2)(b))",
"text": "because [adm_law] authorises it"
},
{
"value": "basis.explicit-consent",
"label": "The person's explicit consent (Art 22(2)(c))",
"text": "with your explicit consent"
}
],
"hint": "EU: required, Art 22(2). UK only: not required unless the decision uses special category data, when Art 22B needs explicit consent, or contract or law plus Art 9(2)(g)."
},
{
"name": "adm_law",
"type": "text",
"label": "Which law authorises the decision?",
"required": false,
"validation": {
"max": 150
}
},
{
"name": "adm_special",
"type": "choice",
"label": "Does the decision use special category data?",
"required": false,
"options": [
{
"value": "not_used",
"label": "No",
"text": "This decision does not use special category data."
},
{
"value": "explicit_consent",
"label": "Yes, with explicit consent (Art 9(2)(a))",
"text": "This decision uses your [adm_special_kinds] with your explicit consent (Article 9(2)(a) GDPR)."
},
{
"value": "public_interest",
"label": "Yes, for substantial public interest set out in law (Art 9(2)(g))",
"text": "This decision uses your [adm_special_kinds] for reasons of substantial public interest set out in law (Article 9(2)(g) GDPR)."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"hint": "Answer this if you collect any special category data. Article 22(4) allows such decisions only under Article 9(2)(a) or (g), with suitable safeguards in place."
},
{
"name": "adm_special_kinds",
"type": "multi",
"label": "Which special category data does the decision use?",
"required": false,
"options": [
{
"value": "health",
"label": "Health data",
"text": "health data"
},
{
"value": "genetic",
"label": "Genetic data",
"text": "genetic data"
},
{
"value": "biometric",
"label": "Biometric data",
"text": "biometric data"
},
{
"value": "ethnicity",
"label": "Racial or ethnic origin",
"text": "racial or ethnic origin"
},
{
"value": "politics",
"label": "Political opinions",
"text": "political opinions"
},
{
"value": "religion",
"label": "Religious or philosophical beliefs",
"text": "religious or philosophical beliefs"
},
{
"value": "union",
"label": "Trade union membership",
"text": "trade union membership"
},
{
"value": "sex_life",
"label": "Sex life or sexual orientation",
"text": "sex life or sexual orientation"
}
]
}
],
"conditions": "processing.adm",
"asks": {
"step": 7,
"q": "Do you make decisions with legal or similar effects on people solely by automated means?",
"why": "The GDPR restricts solely automated decisions with significant effects and requires you to explain the logic and consequences.",
"links": {
"gdpr": "https://gdpr-info.eu/art-22-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/automated-decision-making-and-profiling/",
"uk": "https://www.legislation.gov.uk/eur/2016/679/article/22A"
}
},
"g16": "",
"file": "icons/processing.adm.svg"
},
{
"id": "processing.pseudonymisation",
"cat": "processing",
"name": "Pseudonymisation",
"desc": "Replacing identifying fields with a key or token so the data cannot be attributed to you without additional information held separately.",
"snippet": "We pseudonymise data used for [purpose] by replacing [names and contact details] with a code; the key is kept separately and access to it is restricted.",
"law": "GDPR Arts 4(5), 25(1), 32(1)(a), Recital 28",
"clause": "We pseudonymise personal data used for [pseudo_purposes]. We replace [pseudo_fields] with a code. We keep the key separately and limit who can access it.",
"vars": [
{
"name": "pseudo_purposes",
"type": "multi",
"label": "Which purposes use pseudonymised data?",
"required": true,
"options": "@purpose"
},
{
"name": "pseudo_fields",
"type": "multi",
"label": "Which fields do you replace?",
"required": true,
"free": true,
"options": [
{
"value": "names",
"label": "Names",
"text": "your name"
},
{
"value": "contact",
"label": "Contact details",
"text": "your contact details"
},
{
"value": "account",
"label": "Account identifiers",
"text": "your account identifiers"
},
{
"value": "device",
"label": "Device identifiers",
"text": "your device identifiers"
},
{
"value": "ids",
"label": "Government identifiers",
"text": "your government identifiers"
}
]
}
],
"conditions": "processing.pseudonymisation",
"asks": {
"step": 7,
"q": "Do you replace names or other identifiers with a code before using data?",
"why": "The GDPR names pseudonymisation as a privacy-by-design and security measure, so saying you use it shows how you protect data.",
"links": {
"gdpr": "https://gdpr-info.eu/art-25-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/"
}
},
"g16": "",
"file": "icons/processing.pseudonymisation.svg"
},
{
"id": "processing.anonymisation",
"cat": "processing",
"name": "Anonymisation",
"desc": "Irreversibly removing the ability to identify you, so the data is no longer personal data.",
"snippet": "We anonymise data [for [purpose] / after [period]] so that it can no longer be linked to you; anonymised data is not personal data and may be retained and used [for statistics].",
"law": "GDPR Recital 26; APP 2, APP 11.2; CCPA §1798.140(m) (deidentified)",
"clause": "We anonymise [anon_scope] [anon_when] so that it can no longer be linked to you. Anonymised data is not personal data. We keep it and use it for [anon_uses].",
"vars": [
{
"name": "anon_scope",
"type": "multi",
"label": "Which data do you anonymise?",
"required": true,
"options": "@data"
},
{
"name": "anon_when",
"type": "choice",
"label": "When do you anonymise it?",
"required": true,
"options": [
{
"value": "period",
"label": "After a set period",
"text": "after [anon_period]"
},
{
"value": "account",
"label": "When the account closes",
"text": "when your account closes"
},
{
"value": "need",
"label": "When we no longer need to identify the person",
"text": "when we no longer need to identify you"
},
{
"value": "analysis",
"label": "Before analysing it",
"text": "before we analyse it"
}
],
"hint": "Data is anonymous only if no one can identify people by means reasonably likely to be used. Data you can relink with a key you hold is not anonymous."
},
{
"name": "anon_period",
"type": "period",
"label": "Period before anonymisation",
"required": false
},
{
"name": "anon_uses",
"type": "multi",
"label": "What do you use anonymised data for?",
"required": true,
"free": true,
"options": [
{
"value": "statistics",
"label": "Statistics",
"text": "statistics"
},
{
"value": "research",
"label": "Research",
"text": "research"
},
{
"value": "improvement",
"label": "Improving our service",
"text": "improving our service"
},
{
"value": "training",
"label": "Training models",
"text": "training models"
}
]
}
],
"conditions": "processing.anonymisation",
"asks": {
"step": 7,
"q": "Do you strip data of anything that could identify people and keep it as statistics?",
"why": "Once data is anonymised the GDPR no longer applies, so the policy should say when this happens and what the data is then used for.",
"links": {
"gdpr": "https://gdpr-info.eu/recitals/no-26/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/"
}
},
"g16": "",
"neg": true,
"file": "icons/processing.anonymisation.svg"
},
{
"id": "processing.aggregation",
"cat": "processing",
"name": "Aggregation",
"desc": "Combining data from many people into statistical summaries that do not identify individuals.",
"snippet": "We aggregate data about many users to produce statistics [about [topic]] which do not identify you.",
"law": "GDPR Recital 26, Art 89; CCPA §1798.140(b) (aggregate consumer information)",
"clause": "We combine data about many people into statistics about [agg_topics]. These do not identify you.{if agg_share} [agg_share]{/if}",
"vars": [
{
"name": "agg_topics",
"type": "multi",
"label": "What are the statistics about?",
"required": true,
"free": true,
"options": [
{
"value": "usage",
"label": "How the service is used",
"text": "how our service is used"
},
{
"value": "sales",
"label": "Sales and orders",
"text": "sales and orders"
},
{
"value": "audience",
"label": "The audience",
"text": "our audience"
},
{
"value": "content",
"label": "Content performance",
"text": "the performance of our content"
},
{
"value": "campaigns",
"label": "Marketing campaigns",
"text": "our marketing campaigns"
}
]
},
{
"name": "agg_share",
"type": "choice",
"label": "Do you share or publish the statistics?",
"required": true,
"options": [
{
"value": "none",
"label": "Internal use only",
"text": ""
},
{
"value": "publish",
"label": "We publish some",
"text": "We publish some of these statistics."
},
{
"value": "partners",
"label": "We share some with business partners",
"text": "We share some of these statistics with business partners."
},
{
"value": "both",
"label": "We publish some and share some with partners",
"text": "We publish some of these statistics and share some with business partners."
}
],
"default": "none"
}
],
"conditions": "processing.aggregation",
"asks": {
"step": 7,
"q": "Do you produce statistics that combine data from many people?",
"why": "Statistics that identify no one fall outside the GDPR, and saying so explains a common use of the data you collect.",
"links": {
"gdpr": "https://gdpr-info.eu/recitals/no-26/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/"
}
},
"g16": "",
"file": "icons/processing.aggregation.svg"
},
{
"id": "processing.combining",
"cat": "processing",
"name": "Combining & enrichment",
"desc": "Linking data from different sources or services into a single profile or record.",
"snippet": "We combine data we collect from [our different services / third parties] to [build a single view of you / verify your details / improve our services].",
"law": "GDPR Arts 5(1)(b), 6(4), Recital 50 (compatibility); APP 6",
"clause": "We combine data about you from [combine_sources] into a single record.{if combine_sources_more} We may add other sources in future.{/if} We do this to [combine_aims].",
"vars": [
{
"name": "combine_sources",
"type": "multi",
"label": "Which sources do you combine?",
"required": true,
"extensible": true,
"free": true,
"options": [
{
"value": "services",
"label": "Our different services",
"text": "our different services"
},
{
"value": "devices",
"label": "The devices a person uses",
"text": "the different devices you use"
},
{
"value": "group",
"label": "Other companies in our group",
"text": "other companies in our group"
},
{
"value": "partners",
"label": "Business partners",
"text": "business partners"
},
{
"value": "brokers",
"label": "Data brokers",
"text": "data brokers"
},
{
"value": "public",
"label": "Public sources",
"text": "public sources"
},
{
"value": "social",
"label": "Social media platforms",
"text": "social media platforms"
}
]
},
{
"name": "combine_aims",
"type": "multi",
"label": "Why do you combine it?",
"required": true,
"options": [
{
"value": "single_view",
"label": "Build a single view of the person",
"text": "build a single view of you"
},
{
"value": "verify",
"label": "Verify details",
"text": "verify your details"
},
{
"value": "personalise",
"label": "Personalise the service",
"text": "personalise our service"
},
{
"value": "improve",
"label": "Improve the service",
"text": "improve our service"
},
{
"value": "fraud",
"label": "Detect fraud",
"text": "detect fraud"
},
{
"value": "marketing",
"label": "Target marketing",
"text": "target our marketing"
}
]
}
],
"conditions": "processing.combining",
"asks": {
"step": 7,
"q": "Do you link data from different sources or services into one profile or record?",
"why": "The GDPR requires a new use to be compatible with the original purpose and told to people, so combining datasets must be disclosed.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/the-principles/purpose-limitation/"
}
},
"g16": "",
"file": "icons/processing.combining.svg"
},
{
"id": "processing.monitoring",
"cat": "processing",
"name": "Monitoring & tracking",
"desc": "Systematic observation of behaviour, including across websites, devices or over time.",
"snippet": "We track your activity [across our services / across third-party websites and apps / across devices] [using [cookies, pixels, SDKs]] to [purpose]. [You can opt out by [method].]",
"law": "GDPR Arts 3(2)(b), 35(1), Recital 24; ePrivacy Directive Art 5(3); PECR reg 6 and Sch A1 (UK, from 5 February 2026); CCPA §1798.140(k)",
"clause": "We track your activity across [track_scope]. We use [track_tech] to [track_aims].{if track_tech_more} We may use other methods in future.{/if} [track_basis]",
"vars": [
{
"name": "track_scope",
"type": "multi",
"label": "Where do you track people?",
"required": true,
"options": [
{
"value": "own",
"label": "Across our own service",
"text": "our own service"
},
{
"value": "third",
"label": "Across other websites and apps",
"text": "other websites and apps"
},
{
"value": "devices",
"label": "Across the devices a person uses",
"text": "the devices you use"
}
]
},
{
"name": "track_tech",
"type": "multi",
"label": "Which technologies do you use?",
"required": true,
"extensible": true,
"options": [
{
"value": "cookies",
"label": "Cookies",
"text": "cookies"
},
{
"value": "pixels",
"label": "Tracking pixels",
"text": "tracking pixels"
},
{
"value": "sdks",
"label": "SDKs in apps",
"text": "software kits in our apps"
},
{
"value": "ids",
"label": "Advertising identifiers",
"text": "advertising identifiers"
},
{
"value": "fingerprint",
"label": "Device fingerprinting",
"text": "device fingerprinting"
},
{
"value": "logs",
"label": "Server logs",
"text": "server logs"
}
]
},
{
"name": "track_aims",
"type": "multi",
"label": "What is the tracking for?",
"required": true,
"options": [
{
"value": "advertising",
"label": "Personalised advertising",
"text": "show you personalised advertising"
},
{
"value": "measure",
"label": "Measuring advertising",
"text": "measure our advertising"
},
{
"value": "analytics",
"label": "Understanding use of the service",
"text": "understand how our service is used"
},
{
"value": "personalise",
"label": "Personalising the service",
"text": "personalise our service"
},
{
"value": "security",
"label": "Detecting fraud and abuse",
"text": "detect fraud and abuse"
}
]
},
{
"name": "track_basis",
"type": "choice",
"label": "On what basis?",
"required": true,
"options": [
{
"value": "consent",
"label": "Consent (ePrivacy default)",
"text": "We do this only with your consent."
},
{
"value": "li",
"label": "Legitimate interests, within our own service only",
"text": "We do this on the basis of our legitimate interests."
},
{
"value": "pecr_stats",
"label": "UK statistics exemption, first-party only (PECR Sch A1 para 5)",
"text": "In the UK we do this without asking for consent, under the exception for statistics about how our service is used."
}
],
"default": "consent",
"hint": "Tracking across other sites, apps, or devices needs consent. Legitimate interests is arguable only for first-party tracking. In the UK, PECR Schedule A1 allows first-party statistics without consent if people are told and can object."
}
],
"conditions": "processing.monitoring",
"asks": {
"step": 7,
"q": "Do you track people's activity across websites, apps, devices, or over time?",
"why": "Tracking with cookies or similar needs consent under the ePrivacy rules, and tracking behaviour may need a data protection impact assessment.",
"links": {
"gdpr": "https://gdpr-info.eu/art-35-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/"
}
},
"g16": "",
"file": "icons/processing.monitoring.svg"
},
{
"id": "processing.human-review",
"cat": "processing",
"name": "Human review",
"desc": "Decisions or content are reviewed by a person rather than made solely by automated means.",
"snippet": "Decisions about [subject] are reviewed by a member of our staff before they take effect; we do not make decisions about you solely by automated means.",
"law": "GDPR Art 22 (does not apply where meaningful human involvement); UK GDPR Art 22A; Recital 71",
"clause": "We do not make decisions about [review_subjects] solely by automated means.",
"vars": [
{
"name": "review_subjects",
"type": "multi",
"label": "Which decisions does a person review?",
"required": true,
"free": true,
"options": [
{
"value": "credit",
"label": "Credit or lending",
"text": "credit or lending"
},
{
"value": "eligibility",
"label": "Eligibility for the service or an offer",
"text": "your eligibility for our service or an offer"
},
{
"value": "pricing",
"label": "Price or terms offered",
"text": "the price or terms you are offered"
},
{
"value": "fraud",
"label": "Blocking suspected fraud",
"text": "blocking a transaction or account as suspected fraud"
},
{
"value": "recruitment",
"label": "Job applications",
"text": "whether a job application progresses"
},
{
"value": "content",
"label": "Removing or restricting content or accounts",
"text": "removing or restricting your content or account"
}
],
"hint": "Tick a decision only if a person considers each case and has the authority to change the outcome."
}
],
"conditions": "processing.human-review",
"asks": {
"step": 7,
"q": "Does a person review automated decisions before they take effect?",
"why": "A decision with meaningful human involvement is not solely automated, so the GDPR's Article 22 restrictions do not apply to it.",
"links": {
"gdpr": "https://gdpr-info.eu/art-22-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/automated-decision-making-and-profiling/"
}
},
"g16": "",
"file": "icons/processing.human-review.svg"
},
{
"id": "processing.no-adm",
"cat": "processing",
"name": "No automated decisions",
"desc": "We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.",
"snippet": "We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.",
"law": "GDPR Arts 13(2)(f), 22",
"clause": "We do not make solely automated decisions that have legal or similarly significant effects on you. This includes decisions based on profiling.",
"vars": [],
"conditions": "declined.processing.adm",
"asks": {
"step": 7,
"q": null,
"why": "The GDPR requires the notice to state the existence of solely automated decisions with significant effects, so the policy states plainly that there are none.",
"links": {
"gdpr": "https://gdpr-info.eu/art-22-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/automated-decision-making-and-profiling/"
}
},
"g16": "",
"neg": true,
"file": "icons/processing.no-adm.svg"
},
{
"id": "processing.session-replay",
"cat": "processing",
"name": "Session recording & heatmaps",
"desc": "Recording mouse movements, clicks, scrolling and keystrokes on the site to replay sessions or build heatmaps.",
"snippet": "We use [session-recording / heatmap] tools ([provider]) that record how you interact with pages, [masking text you type into forms]. This runs only with your consent.",
"law": "ePrivacy Directive Art 5(3); GDPR Art 6(1)(a), Art 35 (DPIA where systematic)",
"clause": "We use [replay_kind] tools{if replay_provider} provided by [replay_provider]{/if} that record how you interact with our pages.{if replay_masking} [replay_masking]{/if} [replay_basis]",
"vars": [
{
"name": "replay_kind",
"type": "multi",
"label": "Which tools do you use?",
"required": true,
"options": [
{
"value": "recording",
"label": "Session recording",
"text": "session recording"
},
{
"value": "heatmap",
"label": "Heatmaps",
"text": "heatmap"
}
]
},
{
"name": "replay_provider",
"type": "multi",
"label": "Name the provider, if you want to",
"required": false,
"free": true,
"options": [
{
"value": "hotjar",
"label": "Hotjar"
},
{
"value": "clarity",
"label": "Microsoft Clarity"
},
{
"value": "fullstory",
"label": "FullStory"
},
{
"value": "contentsquare",
"label": "Contentsquare"
},
{
"value": "mouseflow",
"label": "Mouseflow"
},
{
"value": "posthog",
"label": "PostHog"
}
]
},
{
"name": "replay_masking",
"type": "choice",
"label": "Is text typed into forms recorded?",
"required": true,
"options": [
{
"value": "masked",
"label": "No, it is masked",
"text": "Text you type into forms is masked and not recorded."
},
{
"value": "recorded",
"label": "Yes, it is recorded",
"text": "Text you type into forms is recorded."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "masked"
},
{
"name": "replay_basis",
"type": "choice",
"label": "On what basis?",
"required": true,
"options": [
{
"value": "consent",
"label": "Consent (ePrivacy default)",
"text": "This runs only with your consent."
},
{
"value": "li",
"label": "Legitimate interests",
"text": "We do this on the basis of our legitimate interests in improving our service."
}
],
"default": "consent"
}
],
"conditions": "processing.session-replay",
"asks": {
"step": 7,
"q": "Do you record how visitors move, click, or type on your pages?",
"why": "Session recording reads information from the device, which needs consent under the ePrivacy rules, and it can capture what people type.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/"
}
},
"g16": "",
"file": "icons/processing.session-replay.svg"
},
{
"id": "processing.ab-testing",
"cat": "processing",
"name": "A/B testing & experiments",
"desc": "Showing different versions of pages or features to different users and measuring the effect.",
"snippet": "We run experiments that show different versions of [pages/features] to different users and measure the results [in aggregate], to improve our services.",
"law": "GDPR Art 6(1)(f); ePrivacy Directive Art 5(3) where cookies are used",
"clause": "We run experiments that show different versions of [ab_scope] to different people. [ab_measure] We do this to improve our service.{if ab_cookie} [ab_cookie]{/if}",
"vars": [
{
"name": "ab_scope",
"type": "multi",
"label": "What do you test?",
"required": true,
"free": true,
"options": [
{
"value": "pages",
"label": "Pages",
"text": "pages"
},
{
"value": "features",
"label": "Features",
"text": "features"
},
{
"value": "emails",
"label": "Emails",
"text": "emails"
},
{
"value": "offers",
"label": "Offers",
"text": "offers"
}
]
},
{
"name": "ab_measure",
"type": "choice",
"label": "How do you measure the results?",
"required": true,
"options": [
{
"value": "aggregate",
"label": "In aggregate only",
"text": "We measure the results in aggregate only."
},
{
"value": "individual",
"label": "At the level of individual accounts",
"text": "We measure the results at the level of individual accounts."
}
],
"default": "aggregate"
},
{
"name": "ab_cookie",
"type": "choice",
"label": "Do you use a cookie to remember which version a person saw?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes",
"text": "We use a cookie to remember which version you saw."
},
{
"value": "none",
"label": "No",
"text": ""
}
],
"default": "none"
}
],
"conditions": "processing.ab-testing",
"asks": {
"step": 7,
"q": "Do you show different versions of pages or features to different people and compare results?",
"why": "Experiments are a use of personal data that must be explained, and a cookie used to assign versions normally needs consent under ePrivacy rules.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/"
}
},
"g16": "",
"file": "icons/processing.ab-testing.svg"
},
{
"id": "processing.chatbot",
"cat": "processing",
"name": "AI assistant / chatbot",
"desc": "Using an AI-powered assistant to answer questions; conversations may be stored and may be processed by an AI provider.",
"snippet": "Our [chatbot / AI assistant] is provided by [provider]. Your conversations are [stored for [period] / not stored] and [are / are not] used to improve the model. Do not enter sensitive information. [A human can be requested at any time.]",
"law": "GDPR Arts 6, 13(2)(f), 22, 28; EU AI Act Art 50(1), (5) (transparency for AI interaction, applies from 2 August 2026)",
"clause": "Our [bot_kind] is an automated system{if bot_provider} provided by [bot_provider]{/if}. You are talking to software, not a person.{if ai_purposes} We use it to help with [ai_purposes].{/if} [bot_storage] [bot_training]{if bot_advice} [bot_advice]{/if}{if bot_human} [bot_human]{/if}",
"vars": [
{
"name": "bot_kind",
"type": "choice",
"label": "What do you call it?",
"required": true,
"options": [
{
"value": "chatbot",
"label": "Chatbot",
"text": "chatbot"
},
{
"value": "assistant",
"label": "AI assistant",
"text": "AI assistant"
}
]
},
{
"name": "bot_provider",
"type": "multi",
"label": "Which AI provider runs it, if not you?",
"required": false,
"free": true,
"options": [
{
"value": "openai",
"label": "OpenAI"
},
{
"value": "anthropic",
"label": "Anthropic"
},
{
"value": "google",
"label": "Google"
},
{
"value": "microsoft",
"label": "Microsoft"
},
{
"value": "intercom",
"label": "Intercom"
},
{
"value": "zendesk",
"label": "Zendesk"
}
],
"hint": "Leave blank if you run the model yourself."
},
{
"name": "ai_purposes",
"type": "multi",
"label": "Which of your purposes does the assistant help with?",
"required": false,
"options": "@purpose",
"hint": "AI assistance is a means, not a purpose. Tick the purposes it serves, for example Customer support. Training models is a separate purpose."
},
{
"name": "bot_storage",
"type": "choice",
"label": "How long do you keep conversations?",
"required": true,
"options": [
{
"value": "period",
"label": "For a set period",
"text": "We keep your conversations for [bot_period]."
},
{
"value": "account",
"label": "While the person has an account",
"text": "We keep your conversations while you have an account with us."
},
{
"value": "not",
"label": "Not kept after the session",
"text": "We do not keep your conversations after the session ends."
}
]
},
{
"name": "bot_period",
"type": "period",
"label": "Period",
"required": false
},
{
"name": "bot_training",
"type": "choice",
"label": "Are conversations used to train or improve a model?",
"required": true,
"options": [
{
"value": "no",
"label": "No",
"text": "We do not use your conversations to train or improve the model."
},
{
"value": "own",
"label": "Yes, our own model",
"text": "We use your conversations to improve our own model."
},
{
"value": "provider",
"label": "Yes, the provider's model",
"text": "Our provider uses your conversations to train its models."
},
{
"value": "both",
"label": "Yes, ours and the provider's",
"text": "We and our provider use your conversations to train and improve our models."
}
],
"default": "no"
},
{
"name": "bot_advice",
"type": "choice",
"label": "Do you ask people not to enter sensitive information?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes",
"text": "Please do not enter special category data, card numbers, or passwords."
},
{
"value": "none",
"label": "No",
"text": ""
}
],
"default": "yes"
},
{
"name": "bot_human",
"type": "choice",
"label": "Can a person switch to a member of staff?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes, during the conversation",
"text": "You can switch to a member of our staff during the conversation."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
}
],
"conditions": "processing.chatbot",
"asks": {
"step": 7,
"q": "Do you offer an AI chatbot or assistant?",
"why": "The AI Act requires people to be told they are talking to AI, and the GDPR requires you to say who holds the conversations.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/"
}
},
"g16": "",
"file": "icons/processing.chatbot.svg"
},
{
"id": "processing.cctv",
"cat": "processing",
"name": "CCTV & premises recording",
"desc": "Video (and possibly audio) recording of premises for security and safety.",
"snippet": "Our premises at [location] are monitored by CCTV for [security and safety]. Recordings are kept for [30 days] unless needed for an incident, and are shared with [police / insurers] where necessary.",
"law": "GDPR Art 6(1)(f), Art 13, Art 35(3)(c); EDPB Guidelines 3/2019 on video devices; ICO video surveillance guidance; UK Surveillance Camera Code (Protection of Freedoms Act 2012 s 33, duty to have regard binds relevant authorities only)",
"clause": "We record [cctv_kind] at [cctv_location] for [cctv_aims]. We keep recordings for [cctv_period] unless we need them for an incident.{if cctv_recipients} We share recordings with [cctv_recipients] when an incident requires it.{/if}",
"vars": [
{
"name": "cctv_kind",
"type": "choice",
"label": "What do the cameras record?",
"required": true,
"options": [
{
"value": "video",
"label": "Video only",
"text": "video"
},
{
"value": "audio",
"label": "Video and audio",
"text": "video and audio"
}
],
"default": "video",
"hint": "Audio recording is rarely proportionate and needs its own justification."
},
{
"name": "cctv_location",
"type": "choice",
"label": "Where?",
"required": true,
"options": [
{
"value": "premises",
"label": "Our premises",
"text": "our premises"
},
{
"value": "named",
"label": "Named premises",
"text": "our premises at [cctv_place]"
},
{
"value": "vehicles",
"label": "Premises and vehicles",
"text": "our premises and in our vehicles"
}
]
},
{
"name": "cctv_place",
"type": "text",
"label": "Premises address or name",
"required": false,
"validation": {
"max": 150
}
},
{
"name": "cctv_aims",
"type": "multi",
"label": "What is the recording for?",
"required": true,
"options": [
{
"value": "security",
"label": "Security of premises",
"text": "the security of our premises"
},
{
"value": "safety",
"label": "Safety of staff and visitors",
"text": "the safety of staff and visitors"
},
{
"value": "crime",
"label": "Preventing and detecting crime",
"text": "preventing and detecting crime"
},
{
"value": "incidents",
"label": "Investigating incidents and claims",
"text": "investigating incidents and claims"
}
]
},
{
"name": "cctv_period",
"type": "period",
"label": "How long do you keep recordings?",
"required": true,
"default": {
"n": 30,
"unit": "days"
}
},
{
"name": "cctv_recipients",
"type": "multi",
"label": "Who do you share recordings with, if anyone?",
"required": false,
"free": true,
"options": [
{
"value": "police",
"label": "The police",
"text": "the police"
},
{
"value": "insurers",
"label": "Insurers",
"text": "our insurers"
},
{
"value": "lawyers",
"label": "Legal advisers",
"text": "our legal advisers"
}
]
}
],
"conditions": "processing.cctv",
"asks": {
"step": 7,
"q": "Do you record your premises with CCTV or similar cameras?",
"why": "CCTV recordings are personal data, so the GDPR requires you to explain the purpose, retention, and recipients, with signs at the premises.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/"
}
},
"g16": "",
"file": "icons/processing.cctv.svg"
},
{
"id": "processing.employee-monitoring",
"cat": "processing",
"name": "Staff monitoring",
"desc": "Monitoring of staff systems, communications or location, proportionate and with prior notice.",
"snippet": "We monitor [use of our IT systems / work communications / vehicle location] for [security, compliance and performance] purposes. Monitoring is proportionate, staff are informed in advance and [private use is / is not] permitted.",
"law": "GDPR Art 6(1)(f), Art 88; Article 29 Working Party Opinion 2/2017 on data processing at work (WP249); ICO employment practices guidance, monitoring workers (2023, updated 2026)",
"clause": "We monitor [monitor_what] of our staff for [monitor_aims].{if monitor_what_more} We may monitor other systems in future.{/if} We limit monitoring to what these purposes need. [monitor_notice]{if monitor_private} [monitor_private]{/if}",
"vars": [
{
"name": "monitor_what",
"type": "multi",
"label": "What do you monitor?",
"required": true,
"extensible": true,
"options": [
{
"value": "it",
"label": "Use of IT systems",
"text": "the use of our IT systems"
},
{
"value": "email",
"label": "Work email and messages",
"text": "work email and messages"
},
{
"value": "internet",
"label": "Internet use",
"text": "internet use"
},
{
"value": "calls",
"label": "Work telephone calls",
"text": "work telephone calls"
},
{
"value": "location",
"label": "Vehicle and device location",
"text": "the location of work vehicles and devices"
},
{
"value": "access",
"label": "Building access",
"text": "building access"
}
]
},
{
"name": "monitor_aims",
"type": "multi",
"label": "What is the monitoring for?",
"required": true,
"options": [
{
"value": "security",
"label": "Security",
"text": "security"
},
{
"value": "compliance",
"label": "Compliance with law and policies",
"text": "compliance with the law and our policies"
},
{
"value": "safety",
"label": "Health and safety",
"text": "health and safety"
},
{
"value": "performance",
"label": "Performance management",
"text": "performance management"
},
{
"value": "quality",
"label": "Quality control",
"text": "quality control"
}
]
},
{
"name": "monitor_notice",
"type": "choice",
"label": "How are staff told?",
"required": true,
"options": [
{
"value": "policy",
"label": "A written monitoring policy",
"text": "Our monitoring policy tells staff what we monitor and why before monitoring starts."
},
{
"value": "told",
"label": "Told before monitoring starts",
"text": "We tell staff what we monitor and why before monitoring starts."
}
],
"default": "told"
},
{
"name": "monitor_private",
"type": "choice",
"label": "Is private use of work systems allowed?",
"required": true,
"options": [
{
"value": "allowed",
"label": "Yes, reasonable private use",
"text": "Reasonable private use of our systems is allowed."
},
{
"value": "not",
"label": "No",
"text": "Private use of our systems is not allowed."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"default": "none"
}
],
"conditions": "processing.employee-monitoring",
"asks": {
"step": 7,
"q": "Do you monitor staff systems, communications, or location?",
"why": "Monitoring workers must be necessary, proportionate, and told to them in advance, and is likely to need a data protection impact assessment.",
"links": {
"gdpr": "https://gdpr-info.eu/art-88-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/"
}
},
"g16": "",
"file": "icons/processing.employee-monitoring.svg"
},
{
"id": "processing.age-inference",
"cat": "processing",
"name": "Age estimation & assurance",
"desc": "Estimating or verifying age from provided documents, facial analysis or behavioural signals.",
"snippet": "We [estimate / verify] your age using [ID documents / facial age estimation by [provider] / behavioural signals]. [Images are deleted immediately after the check.]",
"law": "GDPR Art 8, Art 9 (biometric where used), Recital 51, Art 35; UK Online Safety Act 2023 s 12(4) to (6); Digital Services Act Art 28",
"clause": "We [age_mode] your age using [age_methods].{if age_methods_more} We may use other methods in future.{/if}{if age_provider} The check is run for us by [age_provider].{/if}{if age_images} [age_images]{/if}",
"vars": [
{
"name": "age_mode",
"type": "choice",
"label": "Do you estimate or verify age?",
"required": true,
"options": [
{
"value": "estimate",
"label": "Estimate",
"text": "estimate"
},
{
"value": "verify",
"label": "Verify",
"text": "verify"
},
{
"value": "both",
"label": "Estimate or verify",
"text": "estimate or verify"
}
]
},
{
"name": "age_methods",
"type": "multi",
"label": "Which methods do you use?",
"required": true,
"extensible": true,
"options": [
{
"value": "id",
"label": "Identity documents",
"text": "identity documents"
},
{
"value": "face",
"label": "Facial age estimation",
"text": "facial age estimation"
},
{
"value": "card",
"label": "Payment card checks",
"text": "payment card checks"
},
{
"value": "mobile",
"label": "Mobile network checks",
"text": "mobile network checks"
},
{
"value": "banking",
"label": "Open banking",
"text": "open banking"
},
{
"value": "email",
"label": "Email address analysis",
"text": "email address analysis"
},
{
"value": "signals",
"label": "Behavioural signals",
"text": "behavioural signals"
}
]
},
{
"name": "age_provider",
"type": "multi",
"label": "Name the provider, if you want to",
"required": false,
"free": true,
"options": [
{
"value": "yoti",
"label": "Yoti"
},
{
"value": "veriff",
"label": "Veriff"
},
{
"value": "onfido",
"label": "Onfido"
},
{
"value": "persona",
"label": "Persona"
},
{
"value": "jumio",
"label": "Jumio"
}
]
},
{
"name": "age_images",
"type": "choice",
"label": "What happens to images and documents after the check?",
"required": true,
"options": [
{
"value": "deleted",
"label": "Deleted immediately, result kept",
"text": "We delete images and documents immediately after the check and keep only the result."
},
{
"value": "kept",
"label": "Kept for a period",
"text": "We keep images and documents for [age_period]."
},
{
"value": "none",
"label": "Not applicable or not stated",
"text": ""
}
],
"default": "deleted"
},
{
"name": "age_period",
"type": "period",
"label": "How long?",
"required": false
}
],
"conditions": "processing.age-inference",
"asks": {
"step": 7,
"q": "Do you estimate or verify people's ages?",
"why": "Age checks can involve identity documents or facial analysis, and the GDPR and online safety laws require the method and retention to be explained.",
"links": {
"gdpr": "https://gdpr-info.eu/art-8-gdpr/",
"ico": "https://ico.org.uk/about-the-ico/what-we-do/information-commissioners-opinions/age-assurance-for-the-children-s-code/"
}
},
"g16": "",
"file": "icons/processing.age-inference.svg"
},
{
"id": "sharing.none",
"cat": "sharing",
"name": "Not shared with third parties",
"desc": "Personal data is not disclosed to anyone outside the organisation (other than processors acting on its instructions).",
"snippet": "We do not share your personal data with third parties, other than service providers who process it on our behalf and under our instructions.",
"law": "GDPR Art 13(1)(e); APP 1.4(c), APP 6",
"clause": "We do not share your personal data with third parties for their own commercial purposes.{if @sharing.processors} Service providers who process it for us under our instructions receive it only to provide their services.{/if}",
"vars": [],
"conditions": {
"all": [
"sharing.none",
{
"not": {
"any": [
"sharing.group",
"sharing.advertising",
"sharing.sold",
"sharing.cross-context",
"sharing.public",
"sharing.social-platforms",
"sharing.payment-processors",
"sharing.counterparties"
]
}
}
]
},
"asks": {
"step": 8,
"q": "Do you keep personal data within your organisation, apart from service providers working for you?",
"why": "The GDPR requires you to name recipients or categories of recipients, and a plain statement that there are none is the clearest notice.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/sharing.none.svg"
},
{
"id": "sharing.processors",
"cat": "sharing",
"name": "Service providers (processors)",
"desc": "Suppliers that process data on our behalf and under our written instructions: hosting, email delivery, payment, analytics, support tools.",
"snippet": "We share data with service providers who process it on our behalf under contract, including [hosting, email delivery, payment processing, customer-support and analytics providers]. [A list of our current providers is available [at link / on request].]",
"law": "GDPR Arts 4(8), 13(1)(e), 28; APP 6, APP 8; CCPA §1798.140(ag) (service provider), §1798.140(j) (contractor)",
"clause": "We share your personal data with service providers who process it for us.{if processor_types} They provide [processor_types].{/if}{if processor_names} They include [processor_names].{/if}{if processor_types_more} We may use other providers in future.{/if}{if processor_terms} [processor_terms]{/if}{if processor_list} [processor_list]{/if}",
"vars": [
{
"name": "processor_types",
"type": "multi",
"label": "What kinds of service providers do you use?",
"required": false,
"extensible": true,
"options": [
{
"value": "hosting",
"label": "Web hosting"
},
{
"value": "cloud",
"label": "Cloud storage and computing"
},
{
"value": "email",
"label": "Email and messaging delivery"
},
{
"value": "payment",
"label": "Payment processing"
},
{
"value": "support",
"label": "Customer support tools"
},
{
"value": "analytics",
"label": "Analytics and search services"
},
{
"value": "ai",
"label": "AI platforms"
},
{
"value": "crm",
"label": "CRM and marketing tools"
},
{
"value": "security",
"label": "Security and fraud prevention"
},
{
"value": "delivery",
"label": "Delivery and logistics"
},
{
"value": "hr",
"label": "HR and payroll services"
},
{
"value": "backoffice",
"label": "Accounting and back-office software"
}
]
},
{
"name": "processor_names",
"type": "multi",
"label": "Name specific providers, if you want to",
"required": false,
"free": true,
"options": [
{
"value": "aws",
"label": "Amazon Web Services"
},
{
"value": "google_cloud",
"label": "Google Cloud"
},
{
"value": "microsoft",
"label": "Microsoft Azure or 365"
},
{
"value": "google_analytics",
"label": "Google Analytics"
},
{
"value": "stripe",
"label": "Stripe"
},
{
"value": "mailchimp",
"label": "Mailchimp"
},
{
"value": "openai",
"label": "OpenAI"
},
{
"value": "anthropic",
"label": "Anthropic"
}
]
},
{
"name": "processor_terms",
"type": "choice",
"label": "What contract terms bind your providers?",
"required": true,
"options": [
{
"value": "dpa",
"label": "A written data processing agreement",
"text": "Each provider is bound by a written data processing agreement that limits how it may use your data."
},
{
"value": "contract",
"label": "Contract terms that restrict use",
"text": "Each provider is bound by contract terms that restrict how it may use your data."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
},
{
"name": "processor_list",
"type": "choice",
"label": "Do you publish or supply a list of providers?",
"required": true,
"options": [
{
"value": "url",
"label": "Published at a link",
"text": "A current list is at [processor_list_url]."
},
{
"value": "request",
"label": "Available on request",
"text": "We can supply a list on request."
},
{
"value": "none",
"label": "No list",
"text": ""
}
]
},
{
"name": "processor_list_url",
"type": "url",
"label": "Link to the list",
"required": false,
"validation": {
"https": true
}
}
],
"conditions": "sharing.processors",
"asks": {
"step": 8,
"q": "Do other companies process personal data on your behalf, for example hosting or email providers?",
"why": "The GDPR requires you to name recipients or categories of recipients, and processors must be bound by a written contract.",
"links": {
"gdpr": "https://gdpr-info.eu/art-28-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/contracts/"
}
},
"g16": "",
"file": "icons/sharing.processors.svg"
},
{
"id": "sharing.group",
"cat": "sharing",
"name": "Group companies",
"desc": "Parent, subsidiary and affiliated companies in the same corporate group.",
"snippet": "We share data within our corporate group, [list of entities / see [link]], for [internal administration, providing shared services and [purpose]].",
"law": "GDPR Art 13(1)(e), Recital 48; UK GDPR Arts 6(1)(f) and 6(11) to (12) (inserted by DUAA 2025 s 70, intra-group transmission listed as an example legitimate interest); APP 1.4(c), APP 6",
"clause": "We share your personal data with other companies in our group for [group_purposes].{if group_purposes_more} We may share it for other group purposes in future.{/if}{if group_entities} These companies are [group_entities].{/if}{if group_list} [group_list]{/if}",
"vars": [
{
"name": "group_purposes",
"type": "multi",
"label": "What do group companies use the data for?",
"required": true,
"extensible": true,
"options": [
{
"value": "admin",
"label": "Internal administration",
"text": "internal administration"
},
{
"value": "shared_services",
"label": "Shared services (IT, HR, finance)",
"text": "providing shared IT, HR, and finance services"
},
{
"value": "support",
"label": "Customer support across the group",
"text": "handling customer support across the group"
},
{
"value": "security",
"label": "Security and fraud prevention",
"text": "security and fraud prevention"
},
{
"value": "reporting",
"label": "Group reporting and management",
"text": "group reporting and management"
},
{
"value": "marketing",
"label": "Marketing by group companies",
"text": "marketing by group companies"
}
]
},
{
"name": "group_entities",
"type": "text",
"label": "Name the group companies that receive data",
"required": false,
"validation": {
"max": 300
},
"hint": "Legal names, separated by commas. Leave blank if you publish a list at a link instead."
},
{
"name": "group_list",
"type": "choice",
"label": "Do you publish a list of group companies?",
"required": true,
"options": [
{
"value": "url",
"label": "Published at a link",
"text": "A current list of our group companies is at [group_list_url]."
},
{
"value": "request",
"label": "Available on request",
"text": "We can supply a list of our group companies on request."
},
{
"value": "none",
"label": "No list",
"text": ""
}
]
},
{
"name": "group_list_url",
"type": "url",
"label": "Link to the list",
"required": false,
"validation": {
"https": true
}
}
],
"conditions": "sharing.group",
"asks": {
"step": 8,
"q": "Do you share personal data with parent, subsidiary, or sister companies in your group?",
"why": "The GDPR treats each group company as a separate recipient, so the policy must name them or describe them as a category.",
"links": {
"gdpr": "https://gdpr-info.eu/recitals/no-48/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/"
}
},
"g16": "",
"file": "icons/sharing.group.svg"
},
{
"id": "sharing.advertising",
"cat": "sharing",
"name": "Advertising partners",
"desc": "Ad networks, exchanges, measurement and attribution providers that receive identifiers or activity data.",
"snippet": "We share [identifiers and activity data] with advertising partners, including [names / categories], to [deliver and measure advertising]. [Under the CCPA this may be a 'sale' or 'sharing' of personal information; you can opt out via ['Do Not Sell or Share My Personal Information'].]",
"law": "GDPR Arts 13(1)(e), 26 (joint controllership, C-40/17 Fashion ID); ePrivacy Directive Art 5(3); CCPA §§1798.115, 1798.120, 1798.140(ah)",
"clause": "We share [ad_data] with advertising partners to [ad_purposes]. Our partners are [ad_partner_categories].{if ad_partners} They include [ad_partners].{/if}{if ad_partners_more} We may work with other partners in future.{/if}{if ad_partner_role} [ad_partner_role]{/if}{if @ccpa.sale_or_share} Under the California Consumer Privacy Act, this is a sale or sharing of personal information.{/if}",
"vars": [
{
"name": "ad_data",
"type": "multi",
"label": "What data do advertising partners receive?",
"required": true,
"options": [
{
"value": "cookie_ids",
"label": "Cookie and online identifiers",
"text": "cookie and online identifiers"
},
{
"value": "device_ids",
"label": "Device and advertising identifiers",
"text": "device and advertising identifiers"
},
{
"value": "activity",
"label": "Pages and content viewed",
"text": "the pages and content you view"
},
{
"value": "conversions",
"label": "Purchases and conversions",
"text": "your purchases and other actions on our service"
},
{
"value": "location",
"label": "Approximate location",
"text": "your approximate location"
},
{
"value": "hashed_email",
"label": "Hashed email address",
"text": "a hashed version of your email address"
}
]
},
{
"name": "ad_purposes",
"type": "multi",
"label": "What are the partners used for?",
"required": true,
"options": [
{
"value": "deliver",
"label": "Show ads on other sites and apps",
"text": "show you our advertising on other sites and apps"
},
{
"value": "measure",
"label": "Measure whether ads work",
"text": "measure whether our advertising works"
},
{
"value": "frequency",
"label": "Limit how often you see an ad",
"text": "limit how often you see the same ad"
},
{
"value": "audiences",
"label": "Build audiences of similar people",
"text": "find other people with similar interests"
}
]
},
{
"name": "ad_partner_categories",
"type": "multi",
"label": "What kinds of partners are they?",
"required": true,
"options": [
{
"value": "networks",
"label": "Advertising networks and exchanges",
"text": "advertising networks and exchanges"
},
{
"value": "social",
"label": "Social media advertising platforms",
"text": "social media advertising platforms"
},
{
"value": "measurement",
"label": "Measurement and attribution providers",
"text": "measurement and attribution providers"
},
{
"value": "retail",
"label": "Retail media and affiliate networks",
"text": "retail media and affiliate networks"
}
]
},
{
"name": "ad_partners",
"type": "multi",
"label": "Name specific partners, if you want to",
"required": false,
"free": true,
"extensible": true,
"options": [
{
"value": "google_ads",
"label": "Google Ads"
},
{
"value": "meta",
"label": "Meta (Facebook and Instagram)"
},
{
"value": "microsoft_ads",
"label": "Microsoft Advertising"
},
{
"value": "amazon_ads",
"label": "Amazon Ads"
},
{
"value": "tiktok",
"label": "TikTok for Business"
},
{
"value": "linkedin",
"label": "LinkedIn Marketing"
},
{
"value": "criteo",
"label": "Criteo"
},
{
"value": "trade_desk",
"label": "The Trade Desk"
},
{
"value": "appsflyer",
"label": "AppsFlyer"
},
{
"value": "adjust",
"label": "Adjust"
}
]
},
{
"name": "ad_partner_role",
"type": "choice",
"label": "How do the partners use the data?",
"required": true,
"options": [
{
"value": "independent",
"label": "For their own purposes as independent controllers",
"text": "Our partners also use this data for their own purposes under their own privacy policies."
},
{
"value": "joint",
"label": "Joint controllers for collection, then their own purposes",
"text": "We and our partners are joint controllers for collecting and sending this data. They then use it under their own privacy policies."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
}
],
"conditions": "sharing.advertising",
"asks": {
"step": 8,
"q": "Do advertising partners receive identifiers or activity data from your website or app?",
"why": "The GDPR requires you to name advertising recipients, and ePrivacy rules require consent before their identifiers are set or read.",
"links": {
"gdpr": "https://gdpr-info.eu/art-26-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/",
"ca": "https://oag.ca.gov/privacy/ccpa"
}
},
"g16": "",
"file": "icons/sharing.advertising.svg"
},
{
"id": "sharing.sold",
"cat": "sharing",
"name": "Personal information sold",
"desc": "Personal information is disclosed to third parties for money or other valuable consideration (a CCPA concept).",
"snippet": "We sell the following categories of personal information to [categories of third parties]: [categories]. You have the right to opt out of the sale of your personal information via ['Do Not Sell or Share My Personal Information' link]. [We do not knowingly sell the personal information of consumers under 16.]",
"law": "CCPA §§1798.115(c), 1798.120, 1798.135, 1798.140(ad); GDPR Art 13(1)(e) and, for consent, Art 6(1)(a)",
"clause": "In the preceding 12 months we sold [sold_categories] to [sold_recipients]. We do this to [sold_purpose]. Under the California Consumer Privacy Act, this is a sale of personal information.{if minors} [minors]{/if}",
"vars": [
{
"name": "sold_categories",
"type": "multi",
"label": "Which categories of personal information do you sell?",
"required": true,
"extensible": true,
"options": [
{
"value": "identifiers",
"label": "Identifiers (name, email, IP address, device IDs)",
"text": "identifiers such as your name, email address, IP address, and device identifiers"
},
{
"value": "commercial",
"label": "Commercial information (purchases, transactions)",
"text": "records of your purchases and transactions"
},
{
"value": "activity",
"label": "Internet or network activity",
"text": "your browsing and app activity"
},
{
"value": "geolocation",
"label": "Geolocation data",
"text": "your location data"
},
{
"value": "demographic",
"label": "Protected characteristics (demographic information)",
"text": "demographic information"
},
{
"value": "inferences",
"label": "Inferences and profiles",
"text": "inferences we draw about your preferences and characteristics"
},
{
"value": "customer_records",
"label": "Customer records (name, address, account or card details)",
"text": "customer records such as your name, address, and account details"
},
{
"value": "biometric",
"label": "Biometric information",
"text": "biometric information"
},
{
"value": "sensory",
"label": "Audio, electronic, visual, or similar sensory information",
"text": "audio, electronic, visual, or similar information"
},
{
"value": "professional",
"label": "Professional or employment information",
"text": "professional or employment information"
},
{
"value": "education",
"label": "Education information",
"text": "education information"
},
{
"value": "sensitive",
"label": "Sensitive personal information",
"text": "sensitive personal information"
}
]
},
{
"name": "sold_recipients",
"type": "multi",
"label": "Which kinds of third parties buy it?",
"required": true,
"free": true,
"options": [
{
"value": "brokers",
"label": "Data brokers",
"text": "data brokers"
},
{
"value": "ad_networks",
"label": "Advertising networks",
"text": "advertising networks"
},
{
"value": "analytics",
"label": "Analytics providers",
"text": "analytics providers"
},
{
"value": "partners",
"label": "Business partners",
"text": "business partners"
},
{
"value": "affiliates",
"label": "Affiliates not under common branding",
"text": "affiliated companies that do not share our branding"
}
]
},
{
"name": "sold_purpose",
"type": "choice",
"label": "Why do you sell it?",
"required": true,
"options": [
{
"value": "revenue",
"label": "To earn revenue",
"text": "earn revenue"
},
{
"value": "services",
"label": "In exchange for services, discounts, or other benefits",
"text": "receive services, discounts, or other benefits in return"
}
]
},
{
"name": "minors",
"type": "choice",
"label": "What is your position on people under 16?",
"required": true,
"options": [
{
"value": "not_knowingly",
"label": "We do not do this for under-16s",
"text": "We do not do this with the personal information of people under 16."
},
{
"value": "opt_in",
"label": "Only with the required opt-in consent for under-16s",
"text": "For people under 16 we do this only with the opt-in consent that California law requires."
}
]
}
],
"conditions": {
"all": [
"sharing.sold",
"jurisdiction.us_ca",
"ccpa.sale_or_share"
]
},
"asks": {
"step": 8,
"q": "Do you disclose personal information to third parties for money or other value?",
"why": "The California Consumer Privacy Act requires a business that sells personal information to list the categories sold and the buyers.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/",
"ca": "https://oag.ca.gov/privacy/ccpa"
}
},
"g16": "",
"file": "icons/sharing.sold.svg"
},
{
"id": "sharing.not-sold",
"cat": "sharing",
"name": "Personal information not sold",
"desc": "Personal information is not sold or shared for cross-context behavioural advertising.",
"snippet": "We do not sell your personal information, and we do not share it for cross-context behavioural advertising. [We have not done so in the preceding 12 months.]",
"law": "CCPA §§1798.115(c)(1), 1798.130(a)(5)(C)(i)",
"clause": "We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months.",
"vars": [],
"conditions": {
"all": [
"jurisdiction.us_ca",
{
"is": {
"ccpa.sale_or_share": false
}
}
]
},
"asks": {
"step": 8,
"q": "Do you sell personal information, or share it for advertising based on activity across other sites?",
"why": "The California Consumer Privacy Act requires a business to say whether it sells or shares personal information, including in the past 12 months.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/",
"ca": "https://oag.ca.gov/privacy/ccpa"
}
},
"g16": "",
"file": "icons/sharing.not-sold.svg"
},
{
"id": "sharing.cross-context",
"cat": "sharing",
"name": "Shared for cross-context behavioural advertising",
"desc": "Data is shared with third parties for advertising based on your activity across different businesses, sites or apps (CCPA 'sharing').",
"snippet": "We share [categories] with [categories of third parties] for cross-context behavioural advertising. You can opt out via ['Do Not Sell or Share My Personal Information' link].",
"law": "CCPA §§1798.120, 1798.140(ah), (k); GDPR Art 6(1)(a) via ePrivacy Directive Art 5(3)",
"clause": "In the preceding 12 months we shared [cc_categories] with [cc_recipients] for cross-context behavioural advertising. This means ads based on what you do with other sites, apps, and businesses. We do this to [cc_purpose].{if minors} [minors]{/if}",
"vars": [
{
"name": "cc_categories",
"type": "multi",
"label": "Which categories of personal information do you share?",
"required": true,
"extensible": true,
"options": [
{
"value": "identifiers",
"label": "Identifiers (name, email, IP address, device IDs)",
"text": "identifiers such as your name, email address, IP address, and device identifiers"
},
{
"value": "commercial",
"label": "Commercial information (purchases, transactions)",
"text": "records of your purchases and transactions"
},
{
"value": "activity",
"label": "Internet or network activity",
"text": "your browsing and app activity"
},
{
"value": "geolocation",
"label": "Geolocation data",
"text": "your location data"
},
{
"value": "demographic",
"label": "Protected characteristics (demographic information)",
"text": "demographic information"
},
{
"value": "inferences",
"label": "Inferences and profiles",
"text": "inferences we draw about your preferences and characteristics"
},
{
"value": "customer_records",
"label": "Customer records (name, address, account or card details)",
"text": "customer records such as your name, address, and account details"
},
{
"value": "biometric",
"label": "Biometric information",
"text": "biometric information"
},
{
"value": "sensory",
"label": "Audio, electronic, visual, or similar sensory information",
"text": "audio, electronic, visual, or similar information"
},
{
"value": "professional",
"label": "Professional or employment information",
"text": "professional or employment information"
},
{
"value": "education",
"label": "Education information",
"text": "education information"
},
{
"value": "sensitive",
"label": "Sensitive personal information",
"text": "sensitive personal information"
}
]
},
{
"name": "cc_recipients",
"type": "multi",
"label": "Who receives it?",
"required": true,
"free": true,
"options": [
{
"value": "ad_networks",
"label": "Advertising networks and exchanges",
"text": "advertising networks and exchanges"
},
{
"value": "social",
"label": "Social media platforms",
"text": "social media platforms"
},
{
"value": "measurement",
"label": "Measurement and attribution providers",
"text": "measurement and attribution providers"
},
{
"value": "dmp",
"label": "Data management platforms",
"text": "data management platforms"
}
]
},
{
"name": "cc_purpose",
"type": "multi",
"label": "Why do you share it?",
"required": true,
"options": [
{
"value": "deliver",
"label": "Show our advertising on other sites and apps",
"text": "show you our advertising on other sites and apps"
},
{
"value": "measure",
"label": "Measure whether our advertising works",
"text": "measure whether our advertising works"
},
{
"value": "audiences",
"label": "Find other people with similar interests",
"text": "find other people with similar interests"
}
]
},
{
"name": "minors",
"type": "choice",
"label": "What is your position on people under 16?",
"required": true,
"options": [
{
"value": "not_knowingly",
"label": "We do not do this for under-16s",
"text": "We do not do this with the personal information of people under 16."
},
{
"value": "opt_in",
"label": "Only with the required opt-in consent for under-16s",
"text": "For people under 16 we do this only with the opt-in consent that California law requires."
}
]
}
],
"conditions": {
"all": [
"sharing.cross-context",
"jurisdiction.us_ca",
"ccpa.sale_or_share"
]
},
"asks": {
"step": 8,
"q": "Do you share personal information for advertising based on activity across other businesses, sites, or apps?",
"why": "The California Consumer Privacy Act treats this as sharing, which must be disclosed and which people can opt out of.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/",
"ca": "https://oag.ca.gov/privacy/ccpa"
}
},
"g16": "",
"file": "icons/sharing.cross-context.svg"
},
{
"id": "sharing.authorities",
"cat": "sharing",
"name": "Authorities & law enforcement",
"desc": "Courts, regulators, police, tax and other public authorities, when legally required or permitted.",
"snippet": "We disclose data to [courts, regulators, law-enforcement and other public authorities] where required by law, to respond to lawful requests or to protect our rights.",
"law": "GDPR Arts 4(9), 6(1)(c), (f), 13(1)(e), Recital 31; APP 6.2(b), (e); CCPA §1798.145(a)",
"clause": "We disclose personal data to [authority_types] where the law requires it.{if authority_reasons} We also disclose it [authority_reasons].{/if}",
"vars": [
{
"name": "authority_types",
"type": "multi",
"label": "Which authorities might receive data?",
"required": true,
"options": [
{
"value": "courts",
"label": "Courts",
"text": "courts"
},
{
"value": "regulators",
"label": "Regulators",
"text": "regulators"
},
{
"value": "police",
"label": "Police and law-enforcement agencies",
"text": "the police and other law-enforcement agencies"
},
{
"value": "tax",
"label": "Tax authorities",
"text": "tax authorities"
},
{
"value": "other",
"label": "Other public authorities",
"text": "other public authorities"
}
],
"default": [
"courts",
"regulators",
"police",
"tax"
]
},
{
"name": "authority_reasons",
"type": "multi",
"label": "Do you also disclose when the law permits but does not require it?",
"required": false,
"options": [
{
"value": "request",
"label": "To respond to a lawful request",
"text": "to respond to a lawful request from an authority"
},
{
"value": "rights",
"label": "To protect our rights, property, or safety",
"text": "to protect our rights, property, or safety"
},
{
"value": "others",
"label": "To protect the safety of other people",
"text": "to protect the safety of other people"
},
{
"value": "crime",
"label": "To report or prevent crime",
"text": "to report or prevent crime"
}
]
}
],
"conditions": "sharing.authorities",
"asks": {
"step": 8,
"q": "Do you disclose data to courts, regulators, the police, or other public authorities when required?",
"why": "The GDPR requires a basis for each disclosure, such as a legal obligation or legitimate interests, though authorities conducting a particular inquiry are not recipients.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/law-enforcement-processing/"
}
},
"g16": "",
"file": "icons/sharing.authorities.svg"
},
{
"id": "sharing.business-transfer",
"cat": "sharing",
"name": "Business transfers",
"desc": "Disclosure to a buyer, investor or successor in a merger, acquisition, financing or insolvency.",
"snippet": "If we [sell, merge or reorganise] our business, or in the event of insolvency, we may disclose your data to the [prospective buyer, investor or successor] and their advisers. [Your data will remain subject to this policy.]",
"law": "GDPR Arts 6(1)(f), 13(1)(e); CCPA §1798.140(ad)(2)(C)",
"clause": "If we sell, merge, or reorganise our business, or become insolvent, we may disclose your personal data to the other party. This includes a prospective buyer, investor, or successor and their advisers.{if transfer_confidential} [transfer_confidential]{/if}{if transfer_policy} [transfer_policy]{/if}",
"vars": [
{
"name": "transfer_confidential",
"type": "choice",
"label": "What do you share during negotiations?",
"required": true,
"options": [
{
"value": "limited",
"label": "Only what is needed, under confidentiality terms",
"text": "During negotiations we share only what the other party needs, under confidentiality terms."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
},
{
"name": "transfer_policy",
"type": "choice",
"label": "What happens to the data after a transfer?",
"required": true,
"options": [
{
"value": "same_terms",
"label": "We require the recipient to keep it on terms as protective as this policy",
"text": "We will require the recipient to protect your personal data on terms at least as protective as this policy."
},
{
"value": "tell",
"label": "We will tell people before a different policy applies",
"text": "We will tell you before your personal data becomes subject to a different privacy policy."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
}
],
"conditions": "sharing.business-transfer",
"asks": {
"step": 8,
"q": "Might you disclose data to a buyer, investor, or successor if your business is sold or restructured?",
"why": "The GDPR requires you to name this category of recipient in advance, since a buyer or successor is a new controller of the data.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/"
}
},
"g16": "",
"file": "icons/sharing.business-transfer.svg"
},
{
"id": "sharing.advisers",
"cat": "sharing",
"name": "Professional advisers",
"desc": "Lawyers, auditors, accountants, insurers and consultants who need the data to provide their services.",
"snippet": "We share data with our professional advisers, including [lawyers, auditors, accountants and insurers], where necessary for them to advise us.",
"law": "GDPR Arts 6(1)(f), 13(1)(e)",
"clause": "We share personal data with our professional advisers where they need it to advise or act for us. They include [adviser_types].{if adviser_types_more} We may use other advisers in future.{/if} They are independent controllers of the personal data they receive.",
"vars": [
{
"name": "adviser_types",
"type": "multi",
"label": "Which advisers might receive personal data?",
"required": true,
"extensible": true,
"options": [
{
"value": "lawyers",
"label": "Lawyers",
"text": "lawyers"
},
{
"value": "accountants",
"label": "Accountants",
"text": "accountants"
},
{
"value": "auditors",
"label": "Auditors",
"text": "auditors"
},
{
"value": "insurers",
"label": "Insurers and insurance brokers",
"text": "insurers and insurance brokers"
},
{
"value": "consultants",
"label": "Consultants",
"text": "consultants"
}
],
"default": [
"lawyers",
"accountants",
"auditors",
"insurers"
],
"hint": "Consultants who work only on your instructions are processors and belong under service providers."
}
],
"conditions": "sharing.advisers",
"asks": {
"step": 8,
"q": "Do you share personal data with lawyers, accountants, auditors, insurers, or similar advisers?",
"why": "The GDPR treats advisers as recipients, and lawyers, accountants, and auditors are normally independent controllers rather than processors.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/"
}
},
"g16": "",
"file": "icons/sharing.advisers.svg"
},
{
"id": "sharing.payment-processors",
"cat": "sharing",
"name": "Payment processors & banks",
"desc": "Payment service providers, card networks, banks and fraud-screening services that handle payments.",
"snippet": "Your payment data is shared with [payment provider], card schemes and banks to process transactions. [They act as independent controllers of your payment data.]",
"law": "GDPR Arts 6(1)(b), 13(1)(e); PSD2 (Directive (EU) 2015/2366) Art 94",
"clause": "We share your payment details with [payment_providers] to [payment_purposes].{if payment_providers_more} We may use other payment providers in future.{/if} Card schemes and banks also receive the details needed to process each transaction.{if card_storage} [card_storage]{/if}{if payment_role} [payment_role]{/if}",
"vars": [
{
"name": "payment_providers",
"type": "multi",
"label": "Which payment providers do you use?",
"required": true,
"free": true,
"extensible": true,
"options": [
{
"value": "stripe",
"label": "Stripe"
},
{
"value": "paypal",
"label": "PayPal"
},
{
"value": "adyen",
"label": "Adyen"
},
{
"value": "braintree",
"label": "Braintree"
},
{
"value": "square",
"label": "Square"
},
{
"value": "gocardless",
"label": "GoCardless"
},
{
"value": "worldpay",
"label": "Worldpay"
},
{
"value": "klarna",
"label": "Klarna"
},
{
"value": "apple_pay",
"label": "Apple Pay"
},
{
"value": "google_pay",
"label": "Google Pay"
}
]
},
{
"name": "payment_purposes",
"type": "multi",
"label": "What do they do with it?",
"required": true,
"options": [
{
"value": "take",
"label": "Take payments",
"text": "take payments"
},
{
"value": "fraud",
"label": "Screen for fraud",
"text": "screen for fraud"
},
{
"value": "refunds",
"label": "Handle refunds and chargebacks",
"text": "handle refunds and chargebacks"
},
{
"value": "recurring",
"label": "Run subscriptions and repeat payments",
"text": "run subscriptions and repeat payments"
}
],
"default": [
"take"
]
},
{
"name": "card_storage",
"type": "choice",
"label": "Do you see or store full card numbers?",
"required": true,
"options": [
{
"value": "no",
"label": "No, the provider handles them",
"text": "We do not see or store your full card number."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
},
{
"name": "payment_role",
"type": "choice",
"label": "How do your payment providers act?",
"required": true,
"options": [
{
"value": "independent",
"label": "As independent controllers",
"text": "Our payment providers are independent controllers of your payment data and handle it under their own privacy policies."
},
{
"value": "mixed",
"label": "As processors for us, and as controllers for fraud screening and their own legal duties",
"text": "Our payment providers act as processors for us, and as independent controllers for fraud screening and their own legal duties."
},
{
"value": "processor",
"label": "As processors only",
"text": "Our payment providers act as processors on our instructions."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
}
],
"conditions": "sharing.payment-processors",
"asks": {
"step": 8,
"q": "Do you take payments through a payment provider, card scheme, or bank?",
"why": "The GDPR requires you to name payment recipients, and disclosure to them is necessary to perform your contract with the customer.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/"
}
},
"g16": "",
"file": "icons/sharing.payment-processors.svg"
},
{
"id": "sharing.public",
"cat": "sharing",
"name": "Public or other users",
"desc": "Information made visible to other users or to anyone, such as public profiles, posts or reviews.",
"snippet": "Information you [post publicly / include in your profile / share with other users] is visible to [other users / anyone on the internet] and may be [indexed by search engines].",
"law": "GDPR Art 13(1)(e); Digital Services Act; APP 1.4(c), APP 6",
"clause": "Information you [public_content] is visible to [public_audience].{if public_indexed} [public_indexed]{/if}{if public_copies} [public_copies]{/if}{if public_controls} [public_controls]{/if}",
"vars": [
{
"name": "public_content",
"type": "multi",
"label": "What can people make visible to others?",
"required": true,
"options": [
{
"value": "posts",
"label": "Public posts",
"text": "post publicly"
},
{
"value": "profile",
"label": "Public profile",
"text": "include in your public profile"
},
{
"value": "shared",
"label": "Content shared with other users",
"text": "share with other users"
},
{
"value": "reviews",
"label": "Reviews and ratings",
"text": "leave in reviews and ratings"
},
{
"value": "groups",
"label": "Posts in groups or forums",
"text": "post in groups or forums"
}
]
},
{
"name": "public_audience",
"type": "choice",
"label": "Who can see it?",
"required": true,
"options": [
{
"value": "anyone",
"label": "Anyone on the internet",
"text": "anyone on the internet"
},
{
"value": "users",
"label": "Other users of the service",
"text": "other users of [service_name]"
},
{
"value": "members",
"label": "Other members of the group or community",
"text": "other members of the group or community you post in"
}
]
},
{
"name": "service_name",
"type": "text",
"label": "Name of the service",
"required": true,
"shared": true,
"validation": {
"max": 100
}
},
{
"name": "public_indexed",
"type": "choice",
"label": "Can search engines index it?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes, it can appear in search results",
"text": "Search engines can index it and show it in their results."
},
{
"value": "no",
"label": "No, we ask search engines not to index it",
"text": "We ask search engines not to index it."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
},
{
"name": "public_copies",
"type": "choice",
"label": "Do you warn that others can copy public content?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes",
"text": "Other people can copy and reshare what you make public, and we cannot control what they do with it."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
},
{
"name": "public_controls",
"type": "choice",
"label": "Can people control visibility in settings?",
"required": true,
"options": [
{
"value": "settings",
"label": "Yes, in privacy settings",
"text": "Your privacy settings{if privacy_settings_url} at [privacy_settings_url]{/if} control who can see it."
},
{
"value": "none",
"label": "No settings",
"text": ""
}
]
},
{
"name": "privacy_settings_url",
"type": "url",
"label": "Link to your privacy settings page, if you have one",
"required": false,
"shared": true,
"validation": {
"https": true
}
}
],
"conditions": "sharing.public",
"asks": {
"step": 8,
"q": "Can people make information visible to other users or to the public, such as profiles, posts, or reviews?",
"why": "The GDPR requires you to tell people who will see their data, and public content can be copied and indexed beyond your control.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/sharing.public.svg"
},
{
"id": "sharing.social-platforms",
"cat": "sharing",
"name": "Social media platforms",
"desc": "Social networks that receive data through plug-ins, pixels, login integrations or when you share content.",
"snippet": "When you [use social login / interact with social media plug-ins / share content to social media], data is sent to [platform names], which process it as [independent / joint] controllers under their own privacy policies.",
"law": "GDPR Art 26, C-210/16 Wirtschaftsakademie, C-40/17 Fashion ID; ePrivacy Directive Art 5(3)",
"clause": "When you [social_triggers], we send data to [social_platforms].{if social_platforms_more} We may add other platforms in future.{/if}{if social_data} This includes [social_data].{/if}{if social_role} [social_role]{/if} The platforms handle that data under their own privacy policies.",
"vars": [
{
"name": "social_triggers",
"type": "multi",
"label": "When is data sent to social media platforms?",
"required": true,
"options": [
{
"value": "login",
"label": "Social login",
"text": "sign in with a social media account"
},
{
"value": "plugins",
"label": "Share buttons or plug-ins",
"text": "use social media share buttons or plug-ins on our service"
},
{
"value": "share",
"label": "Sharing our content",
"text": "share our content to social media"
},
{
"value": "pixel",
"label": "Pages with a social media pixel",
"text": "visit pages that carry a social media pixel"
}
]
},
{
"name": "social_platforms",
"type": "multi",
"label": "Which platforms?",
"required": true,
"free": true,
"extensible": true,
"options": [
{
"value": "meta",
"label": "Meta (Facebook and Instagram)"
},
{
"value": "x",
"label": "X"
},
{
"value": "linkedin",
"label": "LinkedIn"
},
{
"value": "tiktok",
"label": "TikTok"
},
{
"value": "google",
"label": "Google and YouTube"
},
{
"value": "apple",
"label": "Apple"
},
{
"value": "pinterest",
"label": "Pinterest"
},
{
"value": "snap",
"label": "Snapchat"
}
]
},
{
"name": "social_data",
"type": "multi",
"label": "What data is sent?",
"required": false,
"options": [
{
"value": "ip_browser",
"label": "IP address and browser details",
"text": "your IP address and browser details"
},
{
"value": "page",
"label": "The page you are on",
"text": "the page you are on"
},
{
"value": "platform_id",
"label": "Your identifier on the platform",
"text": "your account identifier on the platform"
},
{
"value": "actions",
"label": "Actions you take",
"text": "the actions you take on our service"
}
]
},
{
"name": "social_role",
"type": "choice",
"label": "What is your relationship with the platforms for this data?",
"required": true,
"options": [
{
"value": "independent",
"label": "They are independent controllers",
"text": "The platforms are independent controllers of that data."
},
{
"value": "joint",
"label": "We are joint controllers for collecting and sending it",
"text": "We and the platforms are joint controllers for collecting and sending that data."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
}
],
"conditions": "sharing.social-platforms",
"asks": {
"step": 8,
"q": "Does data reach social media platforms through login, share buttons, pixels, or sharing?",
"why": "The GDPR requires you to name these recipients, and Fashion ID makes a site embedding a platform plug-in a joint controller for collection and transmission.",
"links": {
"gdpr": "https://gdpr-info.eu/art-26-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-does-it-mean-if-you-are-joint-controllers/"
}
},
"g16": "",
"file": "icons/sharing.social-platforms.svg"
},
{
"id": "sharing.counterparties",
"cat": "sharing",
"name": "Independent recipients",
"desc": "Organisations such as couriers, sellers, credit reference agencies and insurers that receive data and decide for themselves how to use it.",
"snippet": "We share your data with [couriers / sellers you buy from through us / credit reference agencies / insurers] so that they can [deliver your order / check your credit]. They are independent controllers of the data they receive.",
"law": "GDPR Arts 6(1)(b), (f), 13(1)(e)",
"clause": "We share your personal data with [counterparty_types] so that they can [counterparty_purpose].{if counterparty_types_more} We may share it with other such organisations in future.{/if} They are independent controllers of the personal data they receive.",
"vars": [
{
"name": "counterparty_types",
"type": "multi",
"label": "Which organisations receive data for their own use?",
"required": true,
"extensible": true,
"free": true,
"options": [
{
"value": "couriers",
"label": "Couriers and postal services",
"text": "couriers and postal services"
},
{
"value": "sellers",
"label": "Sellers or providers you buy from through us",
"text": "the sellers or providers you buy from through us"
},
{
"value": "venues",
"label": "Venues and event organisers",
"text": "venues and event organisers"
},
{
"value": "cras",
"label": "Credit reference agencies",
"text": "credit reference agencies"
},
{
"value": "debt",
"label": "Debt collection agencies",
"text": "debt collection agencies"
},
{
"value": "insurers",
"label": "Insurers",
"text": "insurers"
}
],
"hint": "Choose only organisations that decide for themselves how to use the data. Couriers that act only on your instructions are service providers."
},
{
"name": "counterparty_purpose",
"type": "multi",
"label": "What do they use it for?",
"required": true,
"options": [
{
"value": "deliver",
"label": "Deliver the order",
"text": "deliver your order"
},
{
"value": "complete",
"label": "Complete the purchase or booking",
"text": "complete your purchase or booking"
},
{
"value": "credit",
"label": "Check identity and credit",
"text": "check your identity and credit"
},
{
"value": "recover",
"label": "Recover money owed",
"text": "recover money owed"
}
]
}
],
"conditions": "sharing.counterparties",
"asks": {
"step": 8,
"q": "Do you pass data to organisations that use it for their own purposes?",
"why": "The GDPR requires you to name who receives personal data, including organisations that decide for themselves how to use it.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/sharing.counterparties.svg"
},
{
"id": "transfer.none",
"cat": "transfer",
"name": "No international transfer",
"desc": "Data is stored and processed only within the EEA (or the UK).",
"snippet": "Your personal data is stored and processed only within the [European Economic Area / United Kingdom] and is not transferred to other countries.",
"law": "GDPR Art 13(1)(f), Chapter V; APP 1.4(f)",
"clause": "We store and process your personal data only within {if @jurisdiction.au}Australia{else}the [region]{/if}. We do not transfer it to other countries.{if @jurisdiction.au} We are not likely to disclose your personal information to overseas recipients.{/if}",
"vars": [
{
"name": "region",
"type": "choice",
"label": "Which region does your policy cover?",
"required": true,
"shared": true,
"default": "eea",
"options": [
{
"value": "eea",
"label": "EEA",
"text": "EEA"
},
{
"value": "uk",
"label": "UK",
"text": "UK"
},
{
"value": "both",
"label": "EEA and UK",
"text": "EEA and the UK"
}
]
}
],
"conditions": {
"all": [
"transfer.stated",
{
"not": "transfer.adequacy"
},
{
"not": "transfer.sccs"
},
{
"not": "transfer.bcr"
},
{
"not": "transfer.derogation"
},
{
"not": "transfer.dpf"
},
{
"not": "transfer.overseas"
}
]
},
"asks": {
"step": 9,
"q": null,
"why": "The GDPR requires you to say whether personal data leaves the EEA or UK, so a policy with no transfers says so plainly.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/a-brief-guide-to-international-transfers/",
"oaic": "https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-8-app-8-cross-border-disclosure-of-personal-information"
}
},
"g16": "",
"file": "icons/transfer.none.svg"
},
{
"id": "transfer.adequacy",
"cat": "transfer",
"name": "Adequacy decision",
"desc": "Transfers to countries the European Commission (or UK Secretary of State) has found to provide adequate protection.",
"snippet": "We transfer data to [country], which the [European Commission / UK Government] has decided provides an adequate level of data protection.",
"law": "GDPR Arts 13(1)(f), 45; UK GDPR Arts 13(1)(f), 45A (adequacy regulations, inserted by the Data (Use and Access) Act 2025 from 5 February 2026)",
"clause": "We transfer your personal data to [adequacy_recipient] in [adequacy_country]. We do this for [transfer_reason]. [transfer_when] This transfer is covered by [adequacy_body]. This means [adequacy_country] is recognised as providing an adequate level of data protection.",
"vars": [
{
"name": "adequacy_recipient",
"type": "choice",
"label": "Who receives the data there?",
"required": true,
"options": [
{
"value": "processors",
"label": "Service providers who process data for us",
"text": "service providers who process it for us"
},
{
"value": "group",
"label": "Companies in our group",
"text": "companies in our group"
},
{
"value": "partners",
"label": "Business partners",
"text": "business partners"
},
{
"value": "authorities",
"label": "Public authorities",
"text": "public authorities"
},
{
"value": "own_staff",
"label": "Our own staff working in that country",
"text": "our own staff working there",
"hint": "Staff of the same legal entity. The ICO treats this as no restricted transfer, so no transfer mechanism is needed."
},
{
"value": "recipients",
"label": "Not specified",
"text": "recipients"
}
]
},
{
"name": "adequacy_country",
"type": "country",
"label": "Which country?",
"required": true,
"hint": "Only countries covered by an adequacy decision, for example Japan, Switzerland, Canada (commercial organisations), or the UK from the EEA."
},
{
"name": "transfer_reason",
"type": "multi",
"label": "What will this recipient do with the personal data?",
"required": true,
"free": true,
"hint": "Include storing it, receiving it, or accessing it remotely from that country. Choose the activities that actually happen. Add your own if none fits.",
"options": "@transfer_activity"
},
{
"name": "identity_check_kinds",
"type": "multi",
"label": "Which checks does this recipient carry out?",
"required": false,
"options": [
{
"value": "identity",
"label": "Identity",
"text": "your identity"
},
{
"value": "age",
"label": "Age",
"text": "your age"
},
{
"value": "eligibility",
"label": "Eligibility",
"text": "your eligibility"
}
],
"hint": "Answer only if you chose identity, age, or eligibility checks."
},
{
"name": "personnel_admin_detail",
"type": "text",
"label": "Which personnel task does this recipient carry out?",
"required": false,
"validation": {
"max": 120
},
"hint": "Answer only for personnel administration. It reads after 'for', for example 'keeping personnel files'."
},
{
"name": "ai_feature_detail",
"type": "text",
"label": "Which AI-assisted feature does this recipient provide?",
"required": false,
"validation": {
"max": 120
},
"hint": "Answer only for AI-assisted features. It reads after 'for', for example 'transcribing calls'. It never covers model training."
},
{
"name": "exceptional_detail",
"type": "text",
"label": "In which circumstances does this happen?",
"required": false,
"validation": {
"max": 160
},
"hint": "Answer only for regulatory reporting, legal proceedings, or a business sale."
},
{
"name": "transfer_when",
"type": "choice",
"label": "When does this transfer happen?",
"required": true,
"options": "@transfer_when",
"hint": "Choose what actually happens. There is no default and the answer is never derived from the activity."
},
{
"name": "transfer_feature",
"type": "text",
"label": "Which feature, if the transfer happens when someone uses it?",
"required": false,
"validation": {
"max": 80
},
"hint": "Answer only if you chose 'When someone uses a named feature'."
},
{
"name": "adequacy_body",
"type": "choice",
"label": "Whose adequacy finding applies?",
"required": true,
"options": [
{
"value": "ec",
"label": "European Commission adequacy decision",
"text": "an adequacy decision of the European Commission"
},
{
"value": "uk",
"label": "UK adequacy regulations",
"text": "UK adequacy regulations"
},
{
"value": "both",
"label": "Both",
"text": "an adequacy decision of the European Commission and by UK adequacy regulations"
}
],
"hint": "The EU and UK adequacy lists differ. The engine proposes the body from your region and the country."
}
],
"conditions": "transfer.adequacy",
"asks": {
"step": 9,
"q": null,
"why": "A transfer to a country with an adequacy decision needs no further safeguard, but the GDPR requires you to say the decision exists.",
"links": {
"gdpr": "https://gdpr-info.eu/art-45-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/a-brief-guide-to-international-transfers/"
}
},
"multiple": true,
"g16": "",
"file": "icons/transfer.adequacy.svg"
},
{
"id": "transfer.sccs",
"cat": "transfer",
"name": "Standard contractual clauses / IDTA",
"desc": "Transfers protected by the European Commission's standard contractual clauses, or the UK International Data Transfer Agreement or Addendum.",
"snippet": "We transfer data to [country/recipient] under the [European Commission's Standard Contractual Clauses / UK International Data Transfer Agreement or Addendum], supplemented by [transfer risk assessment and additional safeguards]. You can obtain a copy by [method].",
"law": "GDPR Arts 13(1)(f), 46(2)(c); Commission Implementing Decision (EU) 2021/914 (Annex, Clauses 8 and 14); UK GDPR Art 46(2)(d) and DPA 2018 s 119A; UK IDTA and Addendum (in force 21 March 2022); C-311/18 Schrems II (16 July 2020)",
"clause": "We transfer your personal data to [scc_recipient] in [scc_country]. We do this for [transfer_reason]. [transfer_when] [scc_country] is not covered by [adequacy_body]. This transfer is protected by [scc_instrument]. [scc_assessment] [scc_copy]",
"vars": [
{
"name": "scc_recipient",
"type": "choice",
"label": "Who receives the data there?",
"required": true,
"options": [
{
"value": "processors",
"label": "Service providers who process data for us",
"text": "service providers who process it for us"
},
{
"value": "group",
"label": "Companies in our group",
"text": "companies in our group"
},
{
"value": "partners",
"label": "Business partners",
"text": "business partners"
},
{
"value": "authorities",
"label": "Public authorities",
"text": "public authorities"
},
{
"value": "own_staff",
"label": "Our own staff working in that country",
"text": "our own staff working there",
"hint": "Staff of the same legal entity. The ICO treats this as no restricted transfer, so no transfer mechanism is needed."
},
{
"value": "recipients",
"label": "Not specified",
"text": "recipients"
}
]
},
{
"name": "scc_country",
"type": "country",
"label": "Which country?",
"required": true
},
{
"name": "transfer_reason",
"type": "multi",
"label": "What will this recipient do with the personal data?",
"required": true,
"free": true,
"hint": "Include storing it, receiving it, or accessing it remotely from that country. Choose the activities that actually happen. Add your own if none fits.",
"options": "@transfer_activity"
},
{
"name": "identity_check_kinds",
"type": "multi",
"label": "Which checks does this recipient carry out?",
"required": false,
"options": [
{
"value": "identity",
"label": "Identity",
"text": "your identity"
},
{
"value": "age",
"label": "Age",
"text": "your age"
},
{
"value": "eligibility",
"label": "Eligibility",
"text": "your eligibility"
}
],
"hint": "Answer only if you chose identity, age, or eligibility checks."
},
{
"name": "personnel_admin_detail",
"type": "text",
"label": "Which personnel task does this recipient carry out?",
"required": false,
"validation": {
"max": 120
},
"hint": "Answer only for personnel administration. It reads after 'for', for example 'keeping personnel files'."
},
{
"name": "ai_feature_detail",
"type": "text",
"label": "Which AI-assisted feature does this recipient provide?",
"required": false,
"validation": {
"max": 120
},
"hint": "Answer only for AI-assisted features. It reads after 'for', for example 'transcribing calls'. It never covers model training."
},
{
"name": "exceptional_detail",
"type": "text",
"label": "In which circumstances does this happen?",
"required": false,
"validation": {
"max": 160
},
"hint": "Answer only for regulatory reporting, legal proceedings, or a business sale."
},
{
"name": "transfer_when",
"type": "choice",
"label": "When does this transfer happen?",
"required": true,
"options": "@transfer_when",
"hint": "Choose what actually happens. There is no default and the answer is never derived from the activity."
},
{
"name": "transfer_feature",
"type": "text",
"label": "Which feature, if the transfer happens when someone uses it?",
"required": false,
"validation": {
"max": 80
},
"hint": "Answer only if you chose 'When someone uses a named feature'."
},
{
"name": "adequacy_body",
"type": "choice",
"label": "Whose adequacy finding is absent for this country?",
"required": true,
"options": [
{
"value": "ec",
"label": "European Commission adequacy decision",
"text": "an adequacy decision of the European Commission"
},
{
"value": "uk",
"label": "UK adequacy regulations",
"text": "UK adequacy regulations"
},
{
"value": "both",
"label": "Both",
"text": "an adequacy decision of the European Commission or by UK adequacy regulations"
}
],
"hint": "The engine proposes the body from your region. The GDPR requires the policy to say that no adequacy decision covers this transfer."
},
{
"name": "scc_instrument",
"type": "choice",
"label": "Which transfer instrument do you use?",
"required": true,
"options": [
{
"value": "eu_scc",
"label": "EU standard contractual clauses (2021)",
"text": "the European Commission's standard contractual clauses"
},
{
"value": "uk_idta",
"label": "UK International Data Transfer Agreement",
"text": "the UK International Data Transfer Agreement"
},
{
"value": "uk_addendum",
"label": "EU clauses with the UK Addendum",
"text": "the European Commission's standard contractual clauses with the UK Addendum"
},
{
"value": "eu_scc_uk_addendum",
"label": "EU clauses for EEA data and the UK Addendum for UK data",
"text": "the European Commission's standard contractual clauses, with the UK Addendum for transfers from the UK"
}
],
"hint": "From the UK, use the IDTA or the Addendum. From the EEA, use the 2021 EU clauses."
},
{
"name": "scc_assessment",
"type": "choice",
"label": "Have you assessed the risks of this transfer?",
"required": true,
"options": [
{
"value": "measures",
"label": "Assessed, with extra safeguards",
"text": "We have assessed the laws of [scc_country] and put extra safeguards in place."
},
{
"value": "assessed",
"label": "Assessed, no extra safeguards needed",
"text": "We have assessed the laws of [scc_country] and concluded that the clauses give enough protection."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"hint": "A transfer risk assessment is required for every transfer on these clauses. Choose 'Not stated' only if it is not done yet."
},
{
"name": "scc_copy",
"type": "choice",
"label": "Can people get a copy of the clauses?",
"required": true,
"options": [
{
"value": "request",
"label": "On request by email",
"text": "A copy is available free of charge on request from [contact_email]."
},
{
"value": "url",
"label": "Published at a link",
"text": "A copy is available at [scc_copy_url]."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
},
{
"name": "scc_copy_url",
"type": "url",
"label": "Link to the copy",
"required": false,
"validation": {
"https": true
}
},
{
"name": "contact_email",
"type": "email",
"label": "Contact email address for privacy matters",
"required": true,
"shared": true
}
],
"conditions": "transfer.sccs",
"asks": {
"step": 9,
"q": null,
"why": "Transfers to countries without an adequacy decision need approved contractual safeguards, and the GDPR requires you to say how a copy can be obtained.",
"links": {
"gdpr": "https://gdpr-info.eu/art-46-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/appropriate-safeguards/what-are-standard-data-protection-clauses-the-uk-idta-and-the-addendum/"
}
},
"multiple": true,
"g16": "",
"file": "icons/transfer.sccs.svg"
},
{
"id": "transfer.bcr",
"cat": "transfer",
"name": "Binding corporate rules",
"desc": "Intra-group transfers governed by binding corporate rules approved by a supervisory authority.",
"snippet": "Transfers within our corporate group are governed by our Binding Corporate Rules, approved by [supervisory authority]. You can obtain a copy by [method].",
"law": "GDPR Arts 13(1)(f), 46(2)(b), 47; UK GDPR Art 47",
"clause": "We transfer your personal data to companies in our group in [bcr_countries]. We do this for [transfer_reason]. [transfer_when]{if bcr_countries_more} We may add group companies in other countries in future.{/if} These countries are not covered by [adequacy_body]. These transfers are governed by our binding corporate rules, approved by [bcr_authority]. [bcr_copy]",
"vars": [
{
"name": "bcr_countries",
"type": "multi",
"label": "In which countries outside the EEA or UK are your group companies?",
"required": true,
"options": "@country",
"extensible": true
},
{
"name": "transfer_reason",
"type": "multi",
"label": "What will this recipient do with the personal data?",
"required": true,
"free": true,
"hint": "Include storing it, receiving it, or accessing it remotely from that country. Choose the activities that actually happen. Add your own if none fits.",
"options": "@transfer_activity"
},
{
"name": "identity_check_kinds",
"type": "multi",
"label": "Which checks does this recipient carry out?",
"required": false,
"options": [
{
"value": "identity",
"label": "Identity",
"text": "your identity"
},
{
"value": "age",
"label": "Age",
"text": "your age"
},
{
"value": "eligibility",
"label": "Eligibility",
"text": "your eligibility"
}
],
"hint": "Answer only if you chose identity, age, or eligibility checks."
},
{
"name": "personnel_admin_detail",
"type": "text",
"label": "Which personnel task does this recipient carry out?",
"required": false,
"validation": {
"max": 120
},
"hint": "Answer only for personnel administration. It reads after 'for', for example 'keeping personnel files'."
},
{
"name": "ai_feature_detail",
"type": "text",
"label": "Which AI-assisted feature does this recipient provide?",
"required": false,
"validation": {
"max": 120
},
"hint": "Answer only for AI-assisted features. It reads after 'for', for example 'transcribing calls'. It never covers model training."
},
{
"name": "exceptional_detail",
"type": "text",
"label": "In which circumstances does this happen?",
"required": false,
"validation": {
"max": 160
},
"hint": "Answer only for regulatory reporting, legal proceedings, or a business sale."
},
{
"name": "transfer_when",
"type": "choice",
"label": "When does this transfer happen?",
"required": true,
"options": "@transfer_when",
"hint": "Choose what actually happens. There is no default and the answer is never derived from the activity."
},
{
"name": "transfer_feature",
"type": "text",
"label": "Which feature, if the transfer happens when someone uses it?",
"required": false,
"validation": {
"max": 80
},
"hint": "Answer only if you chose 'When someone uses a named feature'."
},
{
"name": "adequacy_body",
"type": "choice",
"label": "Whose adequacy finding is absent for these countries?",
"required": true,
"options": [
{
"value": "ec",
"label": "European Commission adequacy decision",
"text": "an adequacy decision of the European Commission"
},
{
"value": "uk",
"label": "UK adequacy regulations",
"text": "UK adequacy regulations"
},
{
"value": "both",
"label": "Both",
"text": "an adequacy decision of the European Commission or by UK adequacy regulations"
}
],
"hint": "The engine proposes the body from your region. The GDPR requires the policy to say that no adequacy decision covers this transfer."
},
{
"name": "bcr_authority",
"type": "text",
"label": "Which supervisory authority approved the rules?",
"required": true,
"validation": {
"max": 120
},
"hint": "For example 'the Irish Data Protection Commission' or 'the Information Commissioner's Office'."
},
{
"name": "bcr_copy",
"type": "choice",
"label": "Can people get a copy of the rules?",
"required": true,
"options": [
{
"value": "request",
"label": "On request by email",
"text": "A copy is available free of charge on request from [contact_email]."
},
{
"value": "url",
"label": "Published at a link",
"text": "A copy is available at [bcr_copy_url]."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
},
{
"name": "bcr_copy_url",
"type": "url",
"label": "Link to the copy",
"required": false,
"validation": {
"https": true
}
},
{
"name": "contact_email",
"type": "email",
"label": "Contact email address for privacy matters",
"required": true,
"shared": true
}
],
"conditions": "transfer.bcr",
"asks": {
"step": 9,
"q": "Do you rely on approved binding corporate rules for transfers within your group?",
"why": "Binding corporate rules are a safeguard for transfers inside a group only after a supervisory authority has approved them.",
"links": {
"gdpr": "https://gdpr-info.eu/art-47-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/appropriate-safeguards/what-are-binding-corporate-rules/"
}
},
"g16": "",
"file": "icons/transfer.bcr.svg"
},
{
"id": "transfer.derogation",
"cat": "transfer",
"name": "Transfer on a derogation",
"desc": "Occasional transfers without an adequacy decision or safeguard, relying on an Article 49 derogation such as explicit consent or contract necessity.",
"snippet": "In limited cases we transfer data to [country] on the basis of [your explicit consent / the necessity of the transfer for our contract with you / [other Art 49 ground]]. Such transfers are not protected by an adequacy decision or appropriate safeguards and [describe risks].",
"law": "GDPR Arts 13(1)(f), 49, Recital 111; UK GDPR Art 49 (as substituted from 5 February 2026); EDPB Guidelines 2/2018",
"clause": "In limited cases we transfer your personal data to [derog_recipient] in [derog_country]. We do this for [transfer_reason]. [transfer_when] We rely on [derog_ground]. This transfer is not covered by an adequacy decision{if @jurisdiction.uk}, adequacy regulations,{/if} or other safeguards. [derog_risk]",
"vars": [
{
"name": "derog_recipient",
"type": "choice",
"label": "Who receives the data there?",
"required": true,
"options": [
{
"value": "processors",
"label": "Service providers who process data for us",
"text": "service providers who process it for us"
},
{
"value": "group",
"label": "Companies in our group",
"text": "companies in our group"
},
{
"value": "partners",
"label": "Business partners",
"text": "business partners"
},
{
"value": "authorities",
"label": "Public authorities",
"text": "public authorities"
},
{
"value": "own_staff",
"label": "Our own staff working in that country",
"text": "our own staff working there",
"hint": "Staff of the same legal entity. The ICO treats this as no restricted transfer, so no transfer mechanism is needed."
},
{
"value": "recipients",
"label": "Not specified",
"text": "recipients"
}
]
},
{
"name": "derog_country",
"type": "country",
"label": "Which country?",
"required": true
},
{
"name": "transfer_reason",
"type": "multi",
"label": "What will this recipient do with the personal data?",
"required": true,
"free": true,
"hint": "Include storing it, receiving it, or accessing it remotely from that country. Choose the activities that actually happen. Add your own if none fits.",
"options": "@transfer_activity"
},
{
"name": "identity_check_kinds",
"type": "multi",
"label": "Which checks does this recipient carry out?",
"required": false,
"options": [
{
"value": "identity",
"label": "Identity",
"text": "your identity"
},
{
"value": "age",
"label": "Age",
"text": "your age"
},
{
"value": "eligibility",
"label": "Eligibility",
"text": "your eligibility"
}
],
"hint": "Answer only if you chose identity, age, or eligibility checks."
},
{
"name": "personnel_admin_detail",
"type": "text",
"label": "Which personnel task does this recipient carry out?",
"required": false,
"validation": {
"max": 120
},
"hint": "Answer only for personnel administration. It reads after 'for', for example 'keeping personnel files'."
},
{
"name": "ai_feature_detail",
"type": "text",
"label": "Which AI-assisted feature does this recipient provide?",
"required": false,
"validation": {
"max": 120
},
"hint": "Answer only for AI-assisted features. It reads after 'for', for example 'transcribing calls'. It never covers model training."
},
{
"name": "exceptional_detail",
"type": "text",
"label": "In which circumstances does this happen?",
"required": false,
"validation": {
"max": 160
},
"hint": "Answer only for regulatory reporting, legal proceedings, or a business sale."
},
{
"name": "transfer_when",
"type": "choice",
"label": "When does this transfer happen?",
"required": true,
"options": "@transfer_when",
"hint": "Choose what actually happens. There is no default and the answer is never derived from the activity."
},
{
"name": "transfer_feature",
"type": "text",
"label": "Which feature, if the transfer happens when someone uses it?",
"required": false,
"validation": {
"max": 80
},
"hint": "Answer only if you chose 'When someone uses a named feature'."
},
{
"name": "derog_ground",
"type": "choice",
"label": "Which ground do you rely on?",
"required": true,
"options": [
{
"value": "consent",
"label": "The person's explicit consent",
"text": "your explicit consent, given after we told you of the possible risks (Article 49(1)(a) GDPR)"
},
{
"value": "contract",
"label": "Necessary for our contract with the person",
"text": "the transfer being necessary to perform our contract with you, or to take steps you asked for before a contract (Article 49(1)(b) GDPR)"
},
{
"value": "contract_interest",
"label": "Necessary for a contract in the person's interest",
"text": "the transfer being necessary for a contract between us and another person, made in your interest (Article 49(1)(c) GDPR)"
},
{
"value": "public_interest",
"label": "Important reasons of public interest",
"text": "important reasons of public interest (Article 49(1)(d) GDPR)"
},
{
"value": "claims",
"label": "Legal claims",
"text": "the transfer being necessary to establish, exercise, or defend legal claims (Article 49(1)(e) GDPR)"
},
{
"value": "vital",
"label": "Protecting someone's vital interests",
"text": "the transfer being necessary to protect your vital interests or those of another person, where you cannot give consent (Article 49(1)(f) GDPR)"
}
],
"hint": "Derogations are for occasional transfers only. They are not a substitute for an adequacy decision or contractual safeguards."
},
{
"name": "derog_risk",
"type": "choice",
"label": "How do you describe the risks?",
"required": true,
"options": [
{
"value": "standard",
"label": "Standard risk statement",
"text": "The laws of [derog_country] may give your personal data less protection than the laws of the [region]. You may find it harder to enforce your rights there."
},
{
"value": "custom",
"label": "Own wording",
"text": "[derog_risk_text]"
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"hint": "For explicit consent the GDPR requires you to tell the person of the possible risks."
},
{
"name": "derog_risk_text",
"type": "text",
"label": "Describe the risks in one or two sentences",
"required": false,
"validation": {
"max": 300
}
},
{
"name": "region",
"type": "choice",
"label": "Which region does your policy cover?",
"required": true,
"shared": true,
"default": "eea",
"options": [
{
"value": "eea",
"label": "EEA",
"text": "EEA"
},
{
"value": "uk",
"label": "UK",
"text": "UK"
},
{
"value": "both",
"label": "EEA and UK",
"text": "EEA and the UK"
}
]
}
],
"conditions": "transfer.derogation",
"asks": {
"step": 9,
"q": "Do you make occasional transfers without an adequacy decision or safeguards, for example with the person's explicit consent?",
"why": "The GDPR allows occasional transfers on narrow grounds only, and requires the ground and, for consent, the risks to be stated.",
"links": {
"gdpr": "https://gdpr-info.eu/art-49-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/a-brief-guide-to-international-transfers/"
}
},
"multiple": true,
"g16": "",
"file": "icons/transfer.derogation.svg"
},
{
"id": "transfer.dpf",
"cat": "transfer",
"name": "EU-US Data Privacy Framework",
"desc": "Transfers to US organisations certified under the EU-US Data Privacy Framework (and the UK Extension).",
"snippet": "We transfer data to [recipient], which is certified under the [EU-US Data Privacy Framework / UK Extension to the Data Privacy Framework].",
"law": "Commission Implementing Decision (EU) 2023/1795 (10 July 2023); GDPR Arts 13(1)(f), 45; UK Data Protection (Adequacy) (United States of America) Regulations 2023, SI 2023/1028 (in force 12 October 2023); T-553/23 Latombe v Commission (3 September 2025), on appeal as C-703/25 P",
"clause": "We transfer your personal data to [dpf_recipient] in the United States. We do this for [transfer_reason]. [transfer_when]{if dpf_names} They include [dpf_names].{/if} [dpf_scheme]",
"vars": [
{
"name": "dpf_recipient",
"type": "choice",
"label": "Who receives the data in the United States?",
"required": true,
"options": [
{
"value": "processors",
"label": "Service providers who process data for us",
"text": "service providers who process it for us"
},
{
"value": "group",
"label": "Companies in our group",
"text": "companies in our group"
},
{
"value": "partners",
"label": "Business partners",
"text": "business partners"
},
{
"value": "authorities",
"label": "Public authorities",
"text": "public authorities"
},
{
"value": "own_staff",
"label": "Our own staff working in that country",
"text": "our own staff working there",
"hint": "Staff of the same legal entity. The ICO treats this as no restricted transfer, so no transfer mechanism is needed."
},
{
"value": "recipients",
"label": "Not specified",
"text": "recipients"
}
]
},
{
"name": "dpf_names",
"type": "multi",
"label": "Name specific certified recipients, if you want to",
"required": false,
"free": true,
"options": [
{
"value": "google",
"label": "Google"
},
{
"value": "microsoft",
"label": "Microsoft"
},
{
"value": "aws",
"label": "Amazon Web Services"
},
{
"value": "meta",
"label": "Meta"
},
{
"value": "salesforce",
"label": "Salesforce"
},
{
"value": "openai",
"label": "OpenAI"
}
],
"hint": "Check each name on the Data Privacy Framework list before relying on it."
},
{
"name": "transfer_reason",
"type": "multi",
"label": "What will this recipient do with the personal data?",
"required": true,
"free": true,
"hint": "Include storing it, receiving it, or accessing it remotely from that country. Choose the activities that actually happen. Add your own if none fits.",
"options": "@transfer_activity"
},
{
"name": "identity_check_kinds",
"type": "multi",
"label": "Which checks does this recipient carry out?",
"required": false,
"options": [
{
"value": "identity",
"label": "Identity",
"text": "your identity"
},
{
"value": "age",
"label": "Age",
"text": "your age"
},
{
"value": "eligibility",
"label": "Eligibility",
"text": "your eligibility"
}
],
"hint": "Answer only if you chose identity, age, or eligibility checks."
},
{
"name": "personnel_admin_detail",
"type": "text",
"label": "Which personnel task does this recipient carry out?",
"required": false,
"validation": {
"max": 120
},
"hint": "Answer only for personnel administration. It reads after 'for', for example 'keeping personnel files'."
},
{
"name": "ai_feature_detail",
"type": "text",
"label": "Which AI-assisted feature does this recipient provide?",
"required": false,
"validation": {
"max": 120
},
"hint": "Answer only for AI-assisted features. It reads after 'for', for example 'transcribing calls'. It never covers model training."
},
{
"name": "exceptional_detail",
"type": "text",
"label": "In which circumstances does this happen?",
"required": false,
"validation": {
"max": 160
},
"hint": "Answer only for regulatory reporting, legal proceedings, or a business sale."
},
{
"name": "transfer_when",
"type": "choice",
"label": "When does this transfer happen?",
"required": true,
"options": "@transfer_when",
"hint": "Choose what actually happens. There is no default and the answer is never derived from the activity."
},
{
"name": "transfer_feature",
"type": "text",
"label": "Which feature, if the transfer happens when someone uses it?",
"required": false,
"validation": {
"max": 80
},
"hint": "Answer only if you chose 'When someone uses a named feature'."
},
{
"name": "dpf_scheme",
"type": "choice",
"label": "Under which scheme are they certified?",
"required": true,
"options": [
{
"value": "eu",
"label": "EU-US Data Privacy Framework",
"text": "They are certified under the EU-US Data Privacy Framework, which the European Commission has found to provide adequate protection."
},
{
"value": "uk",
"label": "UK Extension to the Data Privacy Framework",
"text": "They are certified under the UK Extension to the EU-US Data Privacy Framework, which the UK Government has found to provide adequate protection."
},
{
"value": "both",
"label": "Both",
"text": "They are certified under the EU-US Data Privacy Framework and its UK Extension. The European Commission and the UK Government have found these to provide adequate protection."
}
],
"hint": "The engine proposes the scheme from your region. A recipient must be certified for each scheme you rely on."
}
],
"conditions": "transfer.dpf",
"asks": {
"step": 9,
"q": "Are your recipients in the United States certified under the Data Privacy Framework?",
"why": "Transfers to certified US organisations rest on an adequacy decision, so the GDPR requires you to say the recipient is certified.",
"links": {
"gdpr": "https://gdpr-info.eu/art-45-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/a-brief-guide-to-international-transfers/"
}
},
"multiple": true,
"review": "Owner, 3 October 2026 (BACKLOG E-ST-16): keep open. Decision (EU) 2023/1795 Art 1 read (text supplied by the owner; audit/transfer.md addendum): the clause is consistent. Before launch, re-read the status of C-703/25 P (Latombe appeal) and SI 2023/1028 with any DUAA 2025 saving. No SCC fallback for now. The Clause 8.2 SCC redaction sentence stays deferred (transfer.sccs).",
"g16": "",
"file": "icons/transfer.dpf.svg"
},
{
"id": "transfer.countries",
"cat": "transfer",
"name": "Countries of overseas recipients",
"desc": "The specific countries in which overseas recipients are located (required by Australian APP 1.4(g) where practicable).",
"snippet": "Overseas recipients of your personal data are located in [list of countries]. [A current list is maintained at [link].]",
"law": "APP 1.4(f)-(g), APP 8; GDPR Art 13(1)(f)",
"clause": "Recipients of your personal data {if @jurisdiction.au}outside Australia{else}outside the [region]{/if} are located in [transfer_countries].{if transfer_countries_more} We may transfer data to other countries in future.{/if} [countries_list]{if @jurisdiction.au} [app8_steps]{/if}",
"vars": [
{
"name": "region",
"type": "choice",
"label": "Which region does your policy cover?",
"required": true,
"shared": true,
"default": "eea",
"options": [
{
"value": "eea",
"label": "EEA",
"text": "EEA"
},
{
"value": "uk",
"label": "UK",
"text": "UK"
},
{
"value": "both",
"label": "EEA and UK",
"text": "EEA and the UK"
}
]
},
{
"name": "transfer_countries",
"type": "multi",
"label": "In which countries outside the EEA or UK are your recipients located?",
"required": true,
"options": "@country",
"extensible": true,
"hint": "With the Australian module on, list every country outside Australia where recipients other than your own organisation are located, including any in the EEA or the UK."
},
{
"name": "countries_list",
"type": "choice",
"label": "Do you publish or supply a current list of countries?",
"required": true,
"options": [
{
"value": "url",
"label": "Published at a link",
"text": "A current list is at [countries_list_url]."
},
{
"value": "request",
"label": "Available on request",
"text": "We can supply a current list on request."
},
{
"value": "none",
"label": "No list",
"text": ""
}
]
},
{
"name": "countries_list_url",
"type": "url",
"label": "Link to the list",
"required": false,
"validation": {
"https": true
}
},
{
"name": "app8_steps",
"type": "choice",
"label": "Australia: how do you comply with APP 8 for overseas disclosures?",
"required": false,
"options": [
{
"value": "steps",
"label": "We take reasonable steps to ensure APP compliance",
"text": "We take reasonable steps to make sure overseas recipients handle your personal information in line with the Australian Privacy Principles (APP 8.1)."
},
{
"value": "consent",
"label": "The person consents after being told APP 8.1 will not apply",
"text": "We disclose to overseas recipients only with your consent, after telling you that we will not take steps under APP 8.1 (APP 8.2(b))."
},
{
"value": "similar_law",
"label": "The recipient is bound by a similar law",
"text": "Each overseas recipient is bound by a law or binding scheme that protects your personal information in a way substantially similar to the Australian Privacy Principles, and that you can enforce (APP 8.2(a))."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
],
"hint": "Only shown when the Australian module is on."
}
],
"conditions": {
"any": [
"transfer.adequacy",
"transfer.sccs",
"transfer.bcr",
"transfer.derogation",
"transfer.dpf",
{
"all": [
"jurisdiction.au",
"transfer.overseas"
]
}
]
},
"asks": {
"step": 9,
"q": "In which countries are your service providers and other recipients located?",
"why": "The GDPR requires you to say that data leaves the EEA or UK, and Australian APP 1.4(g) requires the countries to be listed where practicable.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/a-brief-guide-to-international-transfers/",
"oaic": "https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-8-app-8-cross-border-disclosure-of-personal-information"
}
},
"g16": "",
"file": "icons/transfer.countries.svg"
},
{
"id": "retention.relationship",
"cat": "retention",
"name": "While your account is active",
"desc": "Data is kept for as long as you have an account or an ongoing relationship with us.",
"snippet": "We keep [categories] for as long as you have an account with us [and for [period] afterwards].",
"law": "GDPR Arts 5(1)(e), 13(2)(a); APP 11.2; CCPA §1798.100(a)(3)",
"clause": "We keep [categories] for as long as you have [relationship] with us{if after_period}, and for [after_period] afterwards{/if}. We then [disposal].{if backup_period} Copies may remain in our backups for up to [backup_period] afterwards.{/if}",
"vars": [
{
"name": "categories",
"type": "multi",
"label": "Which data does this apply to?",
"options": "@data",
"required": true
},
{
"name": "relationship",
"type": "choice",
"label": "What kind of relationship?",
"required": true,
"default": "account",
"options": [
{
"value": "account",
"label": "An account",
"text": "an account"
},
{
"value": "contract",
"label": "A contract",
"text": "a contract"
},
{
"value": "membership",
"label": "A membership",
"text": "a membership"
},
{
"value": "relationship",
"label": "An ongoing relationship",
"text": "an ongoing relationship"
}
]
},
{
"name": "after_period",
"type": "period",
"label": "How long after the relationship ends, if at all?",
"required": false,
"hint": "Leave blank if the data is dealt with as soon as the relationship ends.",
"default": {
"n": 6,
"unit": "years"
}
},
{
"name": "disposal",
"type": "choice",
"label": "What happens to the data at the end of the period?",
"required": true,
"default": "delete",
"options": [
{
"value": "delete",
"label": "Deleted",
"text": "delete them"
},
{
"value": "anonymise",
"label": "Anonymised",
"text": "anonymise them"
}
]
},
{
"name": "backup_period",
"type": "period",
"label": "How long may copies remain in your backups afterwards, if at all?",
"required": false,
"hint": "Leave blank if backups are purged at the same time."
}
],
"conditions": {
"in": {
"retention.any": [
"retention.relationship"
]
}
},
"asks": {
"step": 10,
"q": "Do you keep any data for as long as the person has an account or relationship with you?",
"why": "The GDPR requires you to say how long you keep each kind of data, and the storage limitation principle limits it to what is needed.",
"links": {
"gdpr": "https://gdpr-info.eu/art-5-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/"
}
},
"multiple": true,
"g16": "",
"file": "icons/retention.relationship.svg"
},
{
"id": "retention.fixed",
"cat": "retention",
"name": "Fixed retention period",
"desc": "Data is kept for a defined period after collection or after the relationship ends, then deleted or anonymised.",
"snippet": "We keep [categories] for [period] after [collection / the end of our relationship], after which they are [deleted / anonymised].",
"law": "GDPR Arts 5(1)(e), 13(2)(a); APP 11.2; CCPA §1798.100(a)(3)",
"clause": "We keep [categories] for [period] after [trigger]. We then [disposal].{if backup_period} Copies may remain in our backups for up to [backup_period] afterwards.{/if}",
"vars": [
{
"name": "categories",
"type": "multi",
"label": "Which data does this apply to?",
"options": "@data",
"required": true
},
{
"name": "period",
"type": "period",
"label": "How long?",
"required": true,
"hint": "Proposed defaults: CCTV footage 30 days, recruitment records 18 months after the decision."
},
{
"name": "trigger",
"type": "choice",
"label": "When does the period start?",
"required": true,
"default": "collection",
"options": [
{
"value": "collection",
"label": "When we collect the data",
"text": "we collect them"
},
{
"value": "end",
"label": "When the relationship ends",
"text": "our relationship ends"
},
{
"value": "last_use",
"label": "When the person last uses the service",
"text": "you last use our service"
},
{
"value": "decision",
"label": "When a decision is made, for example a recruitment decision",
"text": "we make our decision"
}
]
},
{
"name": "disposal",
"type": "choice",
"label": "What happens to the data at the end of the period?",
"required": true,
"default": "delete",
"options": [
{
"value": "delete",
"label": "Deleted",
"text": "delete them"
},
{
"value": "anonymise",
"label": "Anonymised",
"text": "anonymise them"
}
]
},
{
"name": "backup_period",
"type": "period",
"label": "How long may copies remain in your backups afterwards, if at all?",
"required": false,
"hint": "Leave blank if backups are purged at the same time."
}
],
"conditions": {
"in": {
"retention.any": [
"retention.fixed"
]
}
},
"asks": {
"step": 10,
"q": "Do you keep any data for a set period, then delete or anonymise it?",
"why": "The GDPR requires a stated retention period for each kind of data, and data must not be kept longer than needed.",
"links": {
"gdpr": "https://gdpr-info.eu/art-5-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/"
}
},
"multiple": true,
"g16": "",
"file": "icons/retention.fixed.svg"
},
{
"id": "retention.legal",
"cat": "retention",
"name": "As required by law",
"desc": "Data is kept for the period a law requires, for example tax, accounting or anti-money-laundering rules.",
"snippet": "We keep [categories] for [period] to comply with [tax / accounting / anti-money-laundering] obligations under [name of law].",
"law": "GDPR Arts 5(1)(e), 6(1)(c), 13(2)(a); APP 11.2; MLR 2017 reg 40(5); Corporations Act 2001 (Cth) s 286(2) (Australia, financial records 7 years)",
"clause": "We keep [categories] {if period}for [period]{else}for as long as the order requires{/if} to comply with [obligation].{if law_name} The law that requires this is [law_name].{/if} We then delete them.{if backup_period} Copies may remain in our backups for up to [backup_period] afterwards.{/if}",
"vars": [
{
"name": "categories",
"type": "multi",
"label": "Which data does this apply to?",
"options": "@data",
"required": true
},
{
"name": "period",
"type": "period",
"label": "How long does the law require?",
"required": false,
"default": {
"n": 6,
"unit": "years"
},
"hint": "6 years is proposed. Change it to the period you actually keep these records for. UK: company tax records 6 years from the end of the accounting period. Company accounting records 3 years (private company) or 6 years (public company) from when made. Anti-money-laundering records 5 years. Australia: financial records 7 years after the transactions are completed (Corporations Act 2001 s 286(2)). Leave blank only for a court or tribunal order."
},
{
"name": "obligation",
"type": "choice",
"label": "Which legal obligation?",
"required": true,
"default": "tax",
"options": [
{
"value": "tax",
"label": "Tax",
"text": "our tax obligations"
},
{
"value": "accounting",
"label": "Accounting and company records",
"text": "our accounting and company record obligations"
},
{
"value": "aml",
"label": "Anti-money-laundering",
"text": "anti-money-laundering rules"
},
{
"value": "employment",
"label": "Employment law",
"text": "employment law"
},
{
"value": "other",
"label": "Other",
"text": "[other_obligation]"
},
{
"value": "court",
"label": "A court or tribunal order",
"text": "a court or tribunal order"
}
],
"hint": "Anti-money-laundering records may be kept beyond 5 years only with the person's consent or where needed for legal proceedings (MLR 2017 reg 40(5))."
},
{
"name": "other_obligation",
"type": "text",
"label": "Describe the obligation in a few words",
"required": false,
"validation": {
"max": 100
},
"hint": "For example: product safety rules."
},
{
"name": "law_name",
"type": "text",
"label": "Name of the law, if you want to state it",
"required": false,
"validation": {
"max": 100
},
"hint": "For example: the Companies Act 2006."
},
{
"name": "backup_period",
"type": "period",
"label": "How long may copies remain in your backups afterwards, if at all?",
"required": false,
"hint": "Leave blank if backups are purged at the same time."
}
],
"conditions": {
"in": {
"retention.any": [
"retention.legal"
]
}
},
"asks": {
"step": 10,
"q": "Does a law require you to keep any data for a set period, for example tax or accounting rules?",
"why": "Keeping data to meet a legal obligation is a separate lawful basis, and the GDPR requires the period to be stated.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/"
}
},
"multiple": true,
"g16": "",
"file": "icons/retention.legal.svg"
},
{
"id": "retention.consent",
"cat": "retention",
"name": "Until consent is withdrawn",
"desc": "Data processed on the basis of consent is kept until you withdraw it (or for a defined maximum period).",
"snippet": "We keep [categories] until you withdraw your consent [or for a maximum of [period]], after which they are deleted.",
"law": "GDPR Arts 7(3), 13(2)(a), 17(1)(b)",
"clause": "{if max_period}We keep [categories] for up to [max_period], unless you withdraw your consent sooner.{else}We keep [categories] until you withdraw your consent.{/if} We then delete them.{if backup_period} Copies may remain in our backups for up to [backup_period] afterwards.{/if}",
"vars": [
{
"name": "categories",
"type": "multi",
"label": "Which data does this apply to?",
"options": "@data",
"required": true
},
{
"name": "max_period",
"type": "period",
"label": "Maximum period, if any",
"required": false,
"hint": "Leave blank if there is no fixed maximum."
},
{
"name": "backup_period",
"type": "period",
"label": "How long may copies remain in your backups afterwards, if at all?",
"required": false,
"hint": "Leave blank if backups are purged at the same time."
}
],
"conditions": {
"anyBasis": "basis.consent"
},
"asks": {
"step": 10,
"q": "Do you keep any data only until the person withdraws consent?",
"why": "Data processed on consent must be deleted when consent is withdrawn, unless another basis applies.",
"links": {
"gdpr": "https://gdpr-info.eu/art-7-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/"
}
},
"multiple": true,
"g16": "",
"file": "icons/retention.consent.svg"
},
{
"id": "retention.on-request",
"cat": "retention",
"name": "Deleted on request",
"desc": "Data is deleted when you ask us to, subject to any legal duty to keep it.",
"snippet": "We delete [categories] when you ask us to, unless we must keep them for [legal reasons / to defend legal claims].",
"law": "GDPR Art 17(3); CCPA §1798.105(d); APP 11.2",
"clause": "We delete [categories] when you ask us to, unless we must keep them [keep_reason].{if @jurisdiction.us_ca} If you live in California, we may also keep them to complete a transaction you asked for or to keep our service secure. We may also keep them where the CCPA otherwise allows (section 1798.105(d) CCPA).{/if}{if backup_period} Copies may remain in our backups for up to [backup_period] afterwards.{/if}",
"vars": [
{
"name": "categories",
"type": "multi",
"label": "Which data does this apply to?",
"options": "@data",
"required": true
},
{
"name": "keep_reason",
"type": "multi",
"label": "When would you have to keep the data despite a request?",
"required": true,
"default": [
"legal",
"claims"
],
"options": [
{
"value": "legal",
"label": "To comply with a legal obligation",
"text": "to comply with a legal obligation"
},
{
"value": "claims",
"label": "To establish, exercise, or defend legal claims",
"text": "to establish, exercise, or defend legal claims"
},
{
"value": "public_task",
"label": "For a task in the public interest",
"text": "for a task carried out in the public interest"
},
{
"value": "archiving",
"label": "For archiving, research, or statistics",
"text": "for archiving in the public interest, research, or statistics"
},
{
"value": "expression",
"label": "For freedom of expression and information",
"text": "for exercising the right of freedom of expression and information"
}
],
"hint": "Public task: public bodies only. Archiving, research, or statistics: only if some data is kept indefinitely or anonymised. Freedom of expression: platforms only."
},
{
"name": "backup_period",
"type": "period",
"label": "How long may copies remain in your backups afterwards, if at all?",
"required": false,
"hint": "Leave blank if backups are purged at the same time."
}
],
"conditions": {
"in": {
"retention.any": [
"retention.on-request"
]
}
},
"asks": {
"step": 10,
"q": "Do you delete any data as soon as the person asks you to?",
"why": "The GDPR requires deletion on request where no exception applies, and the exceptions are those listed in Article 17(3).",
"links": {
"gdpr": "https://gdpr-info.eu/art-17-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/"
}
},
"multiple": true,
"g16": "",
"file": "icons/retention.on-request.svg"
},
{
"id": "retention.anonymised",
"cat": "retention",
"name": "Anonymised after a period",
"desc": "After a set period, identifying details are removed and only anonymous data is kept.",
"snippet": "After [period] we anonymise [categories] and keep only anonymous data, which we may retain indefinitely for [statistics/research].",
"law": "GDPR Art 5(1)(e), Recital 26, Art 89",
"clause": "After [period] we anonymise [categories] and keep only anonymous data. We keep the anonymous data indefinitely for [anon_use].",
"vars": [
{
"name": "categories",
"type": "multi",
"label": "Which data does this apply to?",
"options": "@data",
"required": true
},
{
"name": "period",
"type": "period",
"label": "How long before you anonymise the data?",
"required": true,
"hint": "Pseudonymised data is not anonymous."
},
{
"name": "anon_use",
"type": "multi",
"label": "What do you use the anonymous data for?",
"required": true,
"options": [
{
"value": "statistics",
"label": "Statistics"
},
{
"value": "research",
"label": "Research"
},
{
"value": "improve",
"label": "Improving our service",
"text": "improving our service"
},
{
"value": "reporting",
"label": "Reporting",
"text": "reporting"
}
]
}
],
"conditions": {
"in": {
"retention.any": [
"retention.anonymised"
]
}
},
"asks": {
"step": 10,
"q": "Do you anonymise any data after a period and keep only the anonymous version?",
"why": "Data is anonymous only if the person cannot be identified by any means reasonably likely to be used, so the policy must say when.",
"links": {
"gdpr": "https://gdpr-info.eu/recitals/no-26/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/"
}
},
"multiple": true,
"g16": "",
"neg": true,
"file": "icons/retention.anonymised.svg"
},
{
"id": "retention.indefinite",
"cat": "retention",
"name": "Kept indefinitely",
"desc": "Data is kept without a defined end date. Under the GDPR this is permissible only where justified (for example archiving or research) and must be stated.",
"snippet": "We keep [categories] indefinitely because [justification, for example they form part of a permanent [record/archive]]. [We review this periodically.]",
"law": "GDPR Arts 5(1)(e), 13(2)(a), 89(1); Recital 39",
"clause": "We keep [categories] indefinitely because [justification].{if review_period} We review this every [review_period].{/if}",
"vars": [
{
"name": "categories",
"type": "multi",
"label": "Which data does this apply to?",
"options": "@data",
"required": true
},
{
"name": "justification",
"type": "choice",
"label": "Why do you keep this data indefinitely?",
"required": true,
"options": [
{
"value": "record",
"label": "Part of a permanent record",
"text": "they form part of a permanent record"
},
{
"value": "archive",
"label": "Archiving in the public interest",
"text": "we keep them for archiving purposes in the public interest"
},
{
"value": "research",
"label": "Scientific or historical research",
"text": "we use them for scientific or historical research"
},
{
"value": "statistics",
"label": "Statistical purposes",
"text": "we use them for statistical purposes"
},
{
"value": "other",
"label": "Other",
"text": "[other_justification]"
}
]
},
{
"name": "other_justification",
"type": "text",
"label": "Explain in one sentence",
"required": false,
"validation": {
"max": 200
}
},
{
"name": "review_period",
"type": "period",
"label": "How often do you review whether you still need the data?",
"required": false,
"default": {
"n": 1,
"unit": "years"
}
}
],
"conditions": {
"in": {
"retention.any": [
"retention.indefinite"
]
}
},
"asks": {
"step": 10,
"q": "Do you keep any data with no end date?",
"why": "The GDPR allows storage beyond what a purpose needs only for archiving, research, or statistics with safeguards, and the period or criteria must be stated.",
"links": {
"gdpr": "https://gdpr-info.eu/art-89-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/"
}
},
"multiple": true,
"g16": "",
"file": "icons/retention.indefinite.svg"
},
{
"id": "retention.criteria",
"cat": "retention",
"name": "Retention criteria",
"desc": "Where no fixed period can be given, the criteria used to determine it are stated.",
"snippet": "We determine how long to keep [categories] by reference to [the nature and sensitivity of the data, the purposes for which we use it, applicable legal requirements and the risk of harm from unauthorised use].",
"law": "GDPR Art 13(2)(a) ('or if that is not possible, the criteria used to determine that period'), Recital 39; CCPA §1798.100(a)(3)",
"clause": "We cannot give a fixed period for [categories]. We decide how long to keep them by reference to [criteria].{if review_period} We review whether we still need them every [review_period].{/if}",
"vars": [
{
"name": "categories",
"type": "multi",
"label": "Which data does this apply to?",
"options": "@data",
"required": true
},
{
"name": "criteria",
"type": "multi",
"label": "Which criteria decide how long you keep the data?",
"required": true,
"default": [
"sensitivity",
"purpose",
"legal",
"harm"
],
"options": [
{
"value": "sensitivity",
"label": "How sensitive the data is",
"text": "how sensitive they are"
},
{
"value": "purpose",
"label": "What you use it for",
"text": "what we use them for"
},
{
"value": "need",
"label": "Whether you still need it for that purpose",
"text": "whether we still need them for that purpose"
},
{
"value": "legal",
"label": "Legal requirements that apply",
"text": "the legal requirements that apply"
},
{
"value": "harm",
"label": "The risk of harm from unauthorised use",
"text": "the risk of harm from unauthorised use"
},
{
"value": "claims",
"label": "Limitation periods for legal claims",
"text": "the time limits for bringing legal claims"
}
]
},
{
"name": "review_period",
"type": "period",
"label": "How often do you review whether you still need the data?",
"required": false,
"hint": "Recital 39 expects a time limit for deletion or for a periodic review."
}
],
"conditions": {
"in": {
"retention.any": [
"retention.criteria"
]
}
},
"asks": {
"step": 10,
"q": "Is there any data for which you cannot give a fixed retention period?",
"why": "Where no period can be given, the GDPR requires the criteria used to decide it, and this is a fallback, not a first choice.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/"
}
},
"multiple": true,
"g16": "",
"file": "icons/retention.criteria.svg"
},
{
"id": "retention.claims",
"cat": "retention",
"name": "Kept for legal claims",
"desc": "Data is kept until the time limit for bringing legal claims has passed, then deleted.",
"snippet": "We keep [categories] for [period] after [the end of our relationship / collection] so that we can establish, exercise or defend legal claims, after which they are deleted.",
"law": "GDPR Arts 5(1)(e), 13(2)(a), 17(3)(e)",
"clause": "We keep [categories] for [period] after [trigger] so that we can establish, exercise, or defend legal claims.{if law_name} The period follows the time limit for claims under [law_name].{/if} We then delete them.{if backup_period} Copies may remain in our backups for up to [backup_period] afterwards.{/if}",
"vars": [
{
"name": "categories",
"type": "multi",
"label": "Which data does this apply to?",
"options": "@data",
"required": true
},
{
"name": "period",
"type": "period",
"label": "How long?",
"required": true,
"hint": "England and Wales: 6 years for most contract claims (Limitation Act 1980 s 5). Use the limitation period that applies to your claims."
},
{
"name": "trigger",
"type": "choice",
"label": "When does the period start?",
"required": true,
"default": "end",
"options": [
{
"value": "collection",
"label": "When we collect the data",
"text": "we collect them"
},
{
"value": "end",
"label": "When the relationship ends",
"text": "our relationship ends"
},
{
"value": "last_use",
"label": "When the person last uses the service",
"text": "you last use our service"
},
{
"value": "decision",
"label": "When a decision is made, for example a recruitment decision",
"text": "we make our decision"
}
]
},
{
"name": "law_name",
"type": "text",
"label": "Which law sets the time limit for claims?",
"required": false,
"validation": {
"max": 100
},
"hint": "For example: the Limitation Act 1980 (England and Wales)."
},
{
"name": "backup_period",
"type": "period",
"label": "How long may copies remain in your backups afterwards, if at all?",
"required": false,
"hint": "Leave blank if backups are purged at the same time."
}
],
"conditions": {
"in": {
"retention.any": [
"retention.claims"
]
}
},
"asks": {
"step": 10,
"q": "Do you keep any data until the time limit for bringing legal claims has passed?",
"why": "The GDPR requires a stated retention period, and allows data to be kept to establish, exercise, or defend legal claims.",
"links": {
"gdpr": "https://gdpr-info.eu/art-17-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/"
}
},
"multiple": true,
"g16": "",
"file": "icons/retention.claims.svg"
},
{
"id": "retention.legal-hold",
"cat": "retention",
"name": "Kept longer for a legal matter",
"desc": "Data that would be deleted is kept while a court order, investigation or legal claim requires it.",
"snippet": "We may keep data longer if a court order, an investigation, or a legal claim requires it, until that matter ends.",
"law": "GDPR Arts 5(1)(e), 13(2)(a), 17(3)(b), 17(3)(e)",
"clause": "We may keep data longer if a court order, an investigation, or a legal claim requires it. We keep it only until that matter ends.",
"vars": [],
"conditions": "retention.legal-hold",
"asks": {
"step": 10,
"q": "Could a court order, investigation or legal claim require you to keep data longer?",
"why": "The GDPR lets you keep data you would otherwise delete where the law or a legal claim requires it, and people must be told.",
"links": {
"gdpr": "https://gdpr-info.eu/art-17-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/"
}
},
"review": "Session 5 (owner A5): new practice; provisional glyph to approve visually.",
"g16": "",
"file": "icons/retention.legal-hold.svg"
},
{
"id": "rights.access",
"cat": "rights",
"name": "Right of access",
"desc": "Ask whether we process your data and receive a copy together with information about the processing.",
"snippet": "You have the right to ask us whether we process your personal data and to receive a copy of it, together with information about how we use it.",
"law": "GDPR Art 15; APP 12; CCPA §§1798.110, 1798.115, 1798.130(a)(5)(B)(v) (right to know)",
"clause": "You can ask us whether we process your personal data. If we do, you can ask for a copy of it and for information about how we use it.{if @jurisdiction.us_ca} If you live in California, you can ask what categories of personal information we collected, from which sources, why, and with whom we shared it. You can also ask for the specific pieces of personal information we hold about you.{/if}",
"vars": [],
"conditions": true,
"asks": {
"step": 12,
"q": null,
"why": "The GDPR gives everyone the right of access, so the policy must state it whenever personal data is processed.",
"links": {
"gdpr": "https://gdpr-info.eu/art-15-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/"
}
},
"g16": "",
"file": "icons/rights.access.svg"
},
{
"id": "rights.rectification",
"cat": "rights",
"name": "Right to rectification",
"desc": "Have inaccurate data corrected and incomplete data completed.",
"snippet": "You have the right to have inaccurate personal data corrected and incomplete data completed.",
"law": "GDPR Art 16; APP 13; CCPA §1798.106",
"clause": "You can ask us to correct personal data about you that is inaccurate. You can also ask us to complete data that is incomplete.",
"vars": [],
"conditions": true,
"asks": {
"step": 12,
"q": null,
"why": "The GDPR gives everyone the right to rectification, so the policy must state it whenever personal data is processed.",
"links": {
"gdpr": "https://gdpr-info.eu/art-16-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-rectification/"
}
},
"g16": "",
"file": "icons/rights.rectification.svg"
},
{
"id": "rights.erasure",
"cat": "rights",
"name": "Right to erasure",
"desc": "Have your data deleted in certain circumstances, for example where it is no longer needed or consent is withdrawn.",
"snippet": "You have the right to ask us to delete your personal data [where it is no longer needed, you withdraw consent, you object and there is no overriding ground, or it has been unlawfully processed].",
"law": "GDPR Art 17; CCPA §1798.105",
"clause": "You can ask us to delete your personal data.{if erasure_grounds} [erasure_grounds]{/if}{if erasure_exceptions} We can refuse where we need the data for [erasure_exceptions].{else} We can refuse where the law requires us to keep the data or we need it for a legal claim.{/if}",
"vars": [
{
"name": "erasure_grounds",
"type": "choice",
"label": "How should the policy describe when deletion applies?",
"required": true,
"default": "grounds",
"options": [
{
"value": "grounds",
"label": "List the main grounds",
"text": "This applies where we no longer need the data, you withdraw consent, you object and we have no overriding ground, or we processed it unlawfully."
},
{
"value": "all",
"label": "List all Article 17(1) grounds",
"text": "This applies where we no longer need the data, you withdraw consent, you object and we have no overriding ground, or you object to marketing. It also applies where we processed it unlawfully, the law requires deletion, or we collected it from a child for an online service."
},
{
"value": "none",
"label": "Short form, no grounds listed",
"text": ""
}
]
},
{
"name": "erasure_exceptions",
"type": "multi",
"label": "Which Article 17(3) exceptions do you rely on to refuse deletion?",
"required": false,
"hint": "Leave blank to state only the legal obligation and legal claims exceptions.",
"options": [
{
"value": "expression",
"label": "Freedom of expression and information",
"text": "exercising the right of freedom of expression and information"
},
{
"value": "legal",
"label": "Legal obligation or public task",
"text": "complying with a legal obligation or performing a task in the public interest"
},
{
"value": "health",
"label": "Public health",
"text": "reasons of public interest in the area of public health"
},
{
"value": "archiving",
"label": "Archiving, research, or statistics",
"text": "archiving in the public interest, research, or statistics"
},
{
"value": "claims",
"label": "Legal claims",
"text": "establishing, exercising, or defending legal claims"
}
]
}
],
"conditions": true,
"asks": {
"step": 12,
"q": null,
"why": "The GDPR gives everyone the right to erasure, so the policy must state it whenever personal data is processed.",
"links": {
"gdpr": "https://gdpr-info.eu/art-17-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/"
}
},
"g16": "",
"file": "icons/rights.erasure.svg"
},
{
"id": "rights.restriction",
"cat": "rights",
"name": "Right to restriction",
"desc": "Require us to stop using your data (but keep it) in certain circumstances, such as while accuracy is contested.",
"snippet": "You have the right to ask us to restrict processing of your personal data [while we verify its accuracy, where processing is unlawful, or while we consider your objection].",
"law": "GDPR Art 18",
"clause": "You can ask us to restrict how we use your personal data. This applies while we check its accuracy, if the processing is unlawful, or while we consider your objection. It also applies if we no longer need the data but you need it for a legal claim. We then store the data but do not otherwise use it without your consent, except for legal claims, another person's rights, or important public interests. We will tell you before we lift a restriction.",
"vars": [],
"conditions": true,
"asks": {
"step": 12,
"q": null,
"why": "The GDPR gives everyone the right to restriction of processing, so the policy must state it whenever personal data is processed.",
"links": {
"gdpr": "https://gdpr-info.eu/art-18-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-restrict-processing/"
}
},
"g16": "",
"file": "icons/rights.restriction.svg"
},
{
"id": "rights.portability",
"cat": "rights",
"name": "Right to data portability",
"desc": "Receive the data you provided in a structured, machine-readable format and have it transmitted to another controller.",
"snippet": "Where we process your data by automated means on the basis of consent or contract, you have the right to receive it in a structured, commonly used and machine-readable format and to have it transmitted to another organisation.",
"law": "GDPR Art 20",
"clause": "You can ask us for a copy of the personal data you gave us in a structured, commonly used, machine-readable format. You can also ask us to send it to another organisation where this is technically possible. This applies to data we process by automated means on the basis of your consent or a contract.",
"vars": [],
"conditions": {
"any": [
{
"anyBasis": "basis.consent"
},
{
"anyBasis": "basis.explicit-consent"
},
{
"anyBasis": "basis.contract"
},
{
"in": {
"art9.data.biometric": [
"basis.explicit-consent"
]
}
},
{
"in": {
"art9.data.health": [
"basis.explicit-consent"
]
}
},
{
"in": {
"art9.data.genetic": [
"basis.explicit-consent"
]
}
},
{
"in": {
"art9.data.special": [
"basis.explicit-consent"
]
}
},
{
"in": {
"art9.data.children": [
"basis.explicit-consent"
]
}
}
]
},
"asks": {
"step": 12,
"q": null,
"why": "The right to data portability applies whenever any processing rests on consent, explicit consent, or contract and is carried out by automated means.",
"links": {
"gdpr": "https://gdpr-info.eu/art-20-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-data-portability/"
}
},
"g16": "",
"file": "icons/rights.portability.svg"
},
{
"id": "rights.object",
"cat": "rights",
"name": "Right to object",
"desc": "Object to processing based on legitimate interests or public task, and at any time to direct marketing.",
"snippet": "You have the right to object to processing based on our legitimate interests [or public task]. You can object to direct marketing at any time and we will stop.",
"law": "GDPR Art 21(1), (2), (4), (6), Recital 70; DPA 2018 s 122(5); PECR Sch A1 paras 5, 6",
"clause": "You can object, for reasons relating to your own situation, to processing that relies on [object_basis].{if object_refusal} [object_refusal]{/if}{if li_summary} [li_summary]{/if}{if @marketing.any} You can object to direct marketing at any time [marketing_opt_out]. We will then stop, although it might take us a short period to process your request.{/if}{if @purpose.research} You can also object, for reasons relating to your own situation, to our use of your data for research or statistics.{if research_public_task} This does not apply where the research is a task in the public interest.{/if}{/if}{if @uk_exempt_purposes}{if uk_exempt_purposes} In the UK you can object to the cookies we set without asking for consent{if privacy_settings_url} at [privacy_settings_url]{else} by contacting us{/if}. Objecting is free.{/if}{/if}",
"vars": [
{
"name": "object_basis",
"type": "choice",
"label": "Which bases does the objection right apply to?",
"required": true,
"default": "li",
"hint": "Legitimate interests, public task, or both, matching the bases chosen in step 6.",
"options": [
{
"value": "li",
"label": "Legitimate interests",
"text": "our legitimate interests"
},
{
"value": "public_task",
"label": "Public task",
"text": "our public task"
},
{
"value": "both",
"label": "Both",
"text": "our legitimate interests or our public task"
}
]
},
{
"name": "object_refusal",
"type": "choice",
"label": "Say when you can continue despite an objection?",
"required": true,
"default": "state",
"options": [
{
"value": "state",
"label": "Yes, state the compelling-grounds test",
"text": "We will stop unless we show compelling legitimate grounds that override your interests, or we need the data for a legal claim."
},
{
"value": "none",
"label": "No, leave it out",
"text": ""
}
]
},
{
"name": "li_summary",
"type": "choice",
"label": "Offer a summary of your legitimate interests assessment?",
"required": true,
"default": "offer",
"options": [
{
"value": "offer",
"label": "Yes",
"text": "You can ask us for a summary of our legitimate interests assessment."
},
{
"value": "none",
"label": "No",
"text": ""
}
]
},
{
"name": "marketing_opt_out",
"type": "choice",
"label": "How do people opt out of marketing?",
"required": false,
"hint": "Needed if you send marketing, fundraising, or campaigning messages, or push offers.",
"options": [
{
"value": "unsubscribe",
"label": "Unsubscribe link in each message",
"text": "using the unsubscribe link in each message"
},
{
"value": "account",
"label": "Account settings",
"text": "in your account settings"
},
{
"value": "contact",
"label": "Contacting us",
"text": "by emailing [contact_email]"
}
]
},
{
"name": "research_public_task",
"type": "choice",
"label": "Is your research or statistics a task in the public interest?",
"required": false,
"hint": "Asked only when research or statistics is a selected purpose.",
"options": [
{
"value": "yes",
"label": "Yes",
"text": "yes"
},
{
"value": "none",
"label": "No",
"text": ""
}
]
},
{
"name": "uk_exempt_purposes",
"type": "multi",
"label": "Which UK cookie exemptions do you rely on?",
"required": false,
"hint": "Mirrors the same answer under cookie consent and is pre-set by the engine, not asked again. UK only.",
"options": [
{
"value": "statistics",
"label": "Statistics about how the service is used, to improve it"
},
{
"value": "appearance",
"label": "Remembering how people like the service to look and work"
}
]
},
{
"name": "privacy_settings_url",
"type": "url",
"label": "Link to your privacy settings page, if you have one",
"required": false,
"shared": true,
"validation": {
"https": true
}
},
{
"name": "contact_email",
"type": "email",
"label": "Contact email address for privacy matters",
"required": true,
"shared": true
}
],
"conditions": {
"any": [
{
"anyBasis": "basis.legitimate-interests"
},
{
"anyBasis": "basis.public-task"
},
"marketing.any",
"purpose.research"
]
},
"asks": {
"step": 12,
"q": null,
"why": "The GDPR gives a right to object to processing based on legitimate interests, public task, or research, and an absolute right to object to marketing.",
"links": {
"gdpr": "https://gdpr-info.eu/art-21-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-object/"
}
},
"g16": "",
"file": "icons/rights.object.svg"
},
{
"id": "rights.withdraw",
"cat": "rights",
"name": "Right to withdraw consent",
"desc": "Withdraw consent at any time, as easily as it was given, without affecting earlier processing.",
"snippet": "Where we rely on your consent, you can withdraw it at any time by [method]. Withdrawal does not affect the lawfulness of processing carried out before it.",
"law": "GDPR Art 7(3), 13(2)(c)",
"clause": "Where we rely on your consent, you can withdraw it at any time [withdraw_method]. This does not affect processing carried out before you withdrew.",
"vars": [
{
"name": "withdraw_method",
"type": "multi",
"label": "How can people withdraw consent?",
"required": true,
"hint": "Withdrawing must be as easy as giving consent.",
"options": [
{
"value": "account",
"label": "Account settings",
"text": "in your account settings"
},
{
"value": "cookie",
"label": "Cookie settings on the site",
"text": "using the cookie settings on our site"
},
{
"value": "link",
"label": "Link in each message",
"text": "using the link in each message"
},
{
"value": "settings_url",
"label": "Privacy settings page",
"text": "{if privacy_settings_url}at [privacy_settings_url]{else}in our privacy settings{/if}"
},
{
"value": "contact",
"label": "Contacting us",
"text": "by emailing [contact_email]"
}
]
},
{
"name": "privacy_settings_url",
"type": "url",
"label": "Link to your privacy settings page, if you have one",
"required": false,
"shared": true,
"validation": {
"https": true
}
},
{
"name": "contact_email",
"type": "email",
"label": "Contact email address for privacy matters",
"required": true,
"shared": true
}
],
"conditions": {
"any": [
{
"anyBasis": "basis.consent"
},
{
"anyBasis": "basis.explicit-consent"
},
{
"in": {
"art9.data.health": [
"basis.explicit-consent"
]
}
},
{
"in": {
"art9.data.special": [
"basis.explicit-consent"
]
}
},
{
"in": {
"art9.data.biometric": [
"basis.explicit-consent"
]
}
},
{
"in": {
"art9.data.genetic": [
"basis.explicit-consent"
]
}
}
]
},
"asks": {
"step": 12,
"q": null,
"why": "Where any processing rests on consent, the GDPR requires the policy to say that consent can be withdrawn at any time.",
"links": {
"gdpr": "https://gdpr-info.eu/art-7-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/how-should-we-obtain-record-and-manage-consent/"
}
},
"g16": "",
"file": "icons/rights.withdraw.svg"
},
{
"id": "rights.human-intervention",
"cat": "rights",
"name": "Rights regarding automated decisions",
"desc": "Obtain human intervention, express your view and contest a decision made solely by automated means.",
"snippet": "Where we make a decision about you solely by automated means, you have the right to obtain human intervention, to express your point of view and to contest the decision by [method].",
"law": "GDPR Art 22(3), Recital 71; UK GDPR Arts 22A to 22D (DUAA 2025 s 80)",
"clause": "Where we make a decision about you solely by automated means, you can ask for a person to review it. You can also give us your point of view and contest the decision. You can do this [adm_method].{if adm_notice} [adm_notice]{/if}",
"vars": [
{
"name": "adm_method",
"type": "choice",
"label": "How do people ask for human review of an automated decision?",
"required": true,
"options": [
{
"value": "contact",
"label": "Contacting us",
"text": "by emailing [contact_email]"
},
{
"value": "link",
"label": "Link shown with the decision",
"text": "using the link shown with the decision"
},
{
"value": "account",
"label": "Account settings",
"text": "in your account settings"
}
]
},
{
"name": "adm_notice",
"type": "choice",
"label": "Do you tell people when an automated decision is made about them and explain it on request?",
"required": true,
"default": "none",
"hint": "Required in the UK, where UK GDPR Art 22C makes this a safeguard.",
"options": [
{
"value": "yes",
"label": "Yes",
"text": "We tell you when we make such a decision about you, and you can ask us to explain it."
},
{
"value": "none",
"label": "No",
"text": ""
}
]
},
{
"name": "contact_email",
"type": "email",
"label": "Contact email address for privacy matters",
"required": true,
"shared": true
}
],
"conditions": "processing.adm",
"asks": {
"step": 12,
"q": null,
"why": "Where a decision is made solely by automated means, the GDPR requires the right to human intervention, to express a view, and to contest it.",
"links": {
"gdpr": "https://gdpr-info.eu/art-22-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/rights-related-to-automated-decision-making-including-profiling/"
}
},
"g16": "",
"file": "icons/rights.human-intervention.svg"
},
{
"id": "rights.complain",
"cat": "rights",
"name": "Right to complain",
"desc": "Lodge a complaint with a data-protection supervisory authority.",
"snippet": "You have the right to complain to a supervisory authority, in particular [the [Data Protection Authority of [Member State]] / the UK Information Commissioner's Office (ico.org.uk) / the Office of the Australian Information Commissioner]. We would appreciate the chance to address your concerns first: contact us at [contact].",
"law": "GDPR Arts 13(2)(d), 77; UK GDPR Art 13(2)(ca), (d); DPA 2018 ss 164A, 165; APP 1.4(e); Privacy Act 1988 (Cth) s 36",
"clause": "You can complain to a supervisory authority.{if @jurisdiction.eu} In the EU you can do this in the country where you live, work, or where the problem happened.{/if}{if @jurisdiction.eu}{if authority_name} Our lead authority is [authority_name].{/if}{/if}{if @jurisdiction.uk} You have the right to complain to us first.{if uk_complaint_channel} You can do this [uk_complaint_channel].{/if} We will acknowledge your complaint within 30 days and tell you the outcome. In the UK you can complain to the Information Commissioner's Office at ico.org.uk.{/if}{if @jurisdiction.au}{if au_complaint_handling} [au_complaint_handling]{else} In Australia you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.{/if}{/if}{if complain_first} [complain_first]{/if}",
"vars": [
{
"name": "authority_name",
"type": "text",
"label": "Name of your lead supervisory authority",
"required": false,
"shared": true,
"validation": {
"max": 120
}
},
{
"name": "uk_complaint_channel",
"type": "multi",
"label": "How can people complain to you?",
"required": false,
"hint": "Required for UK operators (DPA 2018 s 164A).",
"options": [
{
"value": "form",
"label": "Complaint form",
"text": "using our complaint form at [complaint_form_url]"
},
{
"value": "email",
"label": "Email",
"text": "by emailing [contact_email]"
},
{
"value": "post",
"label": "Post",
"text": "by post at [contact_postal]"
}
]
},
{
"name": "complaint_form_url",
"type": "url",
"label": "Link to your complaint form",
"required": false,
"validation": {
"https": true
}
},
{
"name": "contact_postal",
"type": "address",
"label": "Postal address for privacy enquiries",
"required": false,
"shared": true
},
{
"name": "au_complaint_handling",
"type": "choice",
"label": "How do you deal with a privacy complaint?",
"required": false,
"hint": "Required for Australian operators (APP 1.4(e)).",
"options": [
{
"value": "ack",
"label": "Acknowledge, then aim to resolve within a period",
"text": "We acknowledge complaints within [complaint_ack] and aim to resolve them within [complaint_resolve]. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au."
},
{
"value": "written",
"label": "Investigate and reply in writing within a period",
"text": "We investigate complaints and reply in writing within [complaint_resolve]. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au."
}
]
},
{
"name": "complaint_ack",
"type": "period",
"label": "How quickly do you acknowledge a complaint?",
"required": false
},
{
"name": "complaint_resolve",
"type": "period",
"label": "How quickly do you resolve or reply to a complaint?",
"required": false
},
{
"name": "complain_first",
"type": "choice",
"label": "Invite people to contact you first?",
"required": true,
"default": "invite",
"options": [
{
"value": "invite",
"label": "Yes",
"text": "We would welcome the chance to deal with your concern first. You can contact us at [contact_email]."
},
{
"value": "none",
"label": "No",
"text": ""
}
]
},
{
"name": "contact_email",
"type": "email",
"label": "Contact email address for privacy matters",
"required": true,
"shared": true
}
],
"conditions": true,
"asks": {
"step": 12,
"q": null,
"why": "The GDPR requires the policy to state the right to lodge a complaint with a supervisory authority.",
"links": {
"gdpr": "https://gdpr-info.eu/art-77-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/",
"oaic": "https://www.oaic.gov.au/privacy/privacy-complaints"
}
},
"g16": "",
"file": "icons/rights.complain.svg"
},
{
"id": "rights.opt-out-sale",
"cat": "rights",
"name": "Opt out of sale or sharing",
"desc": "Direct a business not to sell or share your personal information (CCPA), including via a 'Do Not Sell or Share' link and opt-out preference signals.",
"snippet": "[California residents] You have the right to opt out of the sale or sharing of your personal information by [clicking 'Do Not Sell or Share My Personal Information' / [method]]. We honour opt-out preference signals such as Global Privacy Control.",
"law": "CCPA §§1798.120, 1798.135; Cal. Code Regs. tit. 11 §7025 (opt-out preference signals)",
"clause": "If you live in California, you can opt out of the sale or sharing of your personal information (Civil Code section 1798.120). You can do this [opt_out_method].",
"vars": [
{
"name": "opt_out_method",
"type": "choice",
"label": "How do people opt out of sale or sharing?",
"required": true,
"default": "link",
"options": [
{
"value": "link",
"label": "'Do Not Sell or Share' link",
"text": "using the 'Do Not Sell or Share My Personal Information' link on our site"
},
{
"value": "settings_url",
"label": "Privacy settings page",
"text": "{if privacy_settings_url}at [privacy_settings_url]{else}in our privacy settings{/if}"
},
{
"value": "contact",
"label": "Contacting us",
"text": "by emailing [contact_email]"
}
]
},
{
"name": "privacy_settings_url",
"type": "url",
"label": "Link to your privacy settings page, if you have one",
"required": false,
"shared": true,
"validation": {
"https": true
}
},
{
"name": "contact_email",
"type": "email",
"label": "Contact email address for privacy matters",
"required": true,
"shared": true
}
],
"conditions": {
"all": [
"jurisdiction.us_ca",
{
"is": {
"ccpa.sale_or_share": true
}
}
]
},
"asks": {
"step": 12,
"q": null,
"why": "The CCPA requires a business that sells or shares personal information to offer California residents an opt-out.",
"links": {
"gdpr": "https://gdpr-info.eu/art-21-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-object/",
"ca": "https://oag.ca.gov/privacy/ccpa"
}
},
"g16": "",
"file": "icons/rights.opt-out-sale.svg"
},
{
"id": "rights.limit-sensitive",
"cat": "rights",
"name": "Limit use of sensitive information",
"desc": "Direct a business to use sensitive personal information only for necessary purposes (CCPA).",
"snippet": "[California residents] You have the right to limit our use and disclosure of your sensitive personal information to what is necessary to provide our services, by [clicking 'Limit the Use of My Sensitive Personal Information' / [method]].",
"law": "CCPA §1798.121, §1798.135",
"clause": "If you live in California, you can ask us to limit our use of your sensitive personal information (Civil Code section 1798.121). We then use it only as needed to provide our services. You can do this [limit_method].",
"vars": [
{
"name": "limit_method",
"type": "choice",
"label": "How do people limit use of sensitive information?",
"required": true,
"default": "link",
"options": [
{
"value": "link",
"label": "'Limit the Use' link",
"text": "using the 'Limit the Use of My Sensitive Personal Information' link on our site"
},
{
"value": "settings_url",
"label": "Privacy settings page",
"text": "{if privacy_settings_url}at [privacy_settings_url]{else}in our privacy settings{/if}"
},
{
"value": "contact",
"label": "Contacting us",
"text": "by emailing [contact_email]"
}
]
},
{
"name": "privacy_settings_url",
"type": "url",
"label": "Link to your privacy settings page, if you have one",
"required": false,
"shared": true,
"validation": {
"https": true
}
},
{
"name": "contact_email",
"type": "email",
"label": "Contact email address for privacy matters",
"required": true,
"shared": true
}
],
"conditions": {
"all": [
"jurisdiction.us_ca",
{
"any": [
"data.credentials",
"data.location-precise",
"data.biometric",
"data.health",
"data.genetic",
"data.special",
"data.government-id",
"data.communications",
"data.financial-status"
]
}
]
},
"asks": {
"step": 12,
"q": null,
"why": "The CCPA lets California residents limit the use of sensitive personal information to what is necessary to provide the service.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/",
"ca": "https://oag.ca.gov/privacy/ccpa"
}
},
"g16": "",
"file": "icons/rights.limit-sensitive.svg"
},
{
"id": "rights.non-discrimination",
"cat": "rights",
"name": "Non-discrimination",
"desc": "You will not be treated differently for exercising your privacy rights.",
"snippet": "We will not discriminate against you for exercising any of your privacy rights, for example by denying services, charging different prices or providing a different level of service.",
"law": "CCPA §1798.125; Cal. Code Regs. tit. 11 §7011(e)(2)(F); cf. GDPR Art 7(4)",
"clause": "We do not treat you differently for exercising your privacy rights. We do not deny you services, charge different prices, or provide a different level of service because you made a request.{if @audience.groups=workers} If you work for us or apply to work for us, we do not retaliate against you for exercising these rights.{/if}{if nd_incentive} [nd_incentive]{/if}",
"vars": [
{
"name": "nd_incentive",
"type": "choice",
"label": "Do you offer a loyalty scheme or other financial incentive tied to personal information?",
"required": true,
"default": "none",
"options": [
{
"value": "incentive",
"label": "Yes",
"text": "We offer a loyalty or discount programme with its own terms. Joining is optional and you can leave at any time."
},
{
"value": "none",
"label": "No",
"text": ""
}
]
}
],
"conditions": "jurisdiction.us_ca",
"asks": {
"step": 12,
"q": null,
"why": "The CCPA prohibits discriminating against people for exercising their privacy rights, subject to permitted financial incentives.",
"links": {
"gdpr": "https://gdpr-info.eu/art-7-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/",
"ca": "https://oag.ca.gov/privacy/ccpa"
}
},
"g16": "",
"file": "icons/rights.non-discrimination.svg"
},
{
"id": "rights.gpc",
"cat": "rights",
"name": "Opt-out signals honoured",
"desc": "Browser-level signals such as Global Privacy Control are treated as a valid opt-out.",
"snippet": "We treat opt-out preference signals sent by your browser, such as Global Privacy Control, as a valid request to opt out of [sale or sharing / targeted advertising].",
"law": "Cal. Code Regs. tit. 11 §§7011(e)(3)(F), (G), 7025; Colorado Privacy Act §6-1-1306(1)(a)(IV); GDPR Art 21(5) (objection by automated means)",
"clause": "Your browser or a browser extension may send an opt-out preference signal, such as Global Privacy Control. We treat this signal as a valid request to opt out of [gpc_scope]. The signal applies to [gpc_applies].{if gpc_howto} You can turn on Global Privacy Control in your browser settings or with a browser extension.{/if}",
"vars": [
{
"name": "gpc_scope",
"type": "choice",
"label": "What does an opt-out signal opt the person out of?",
"required": true,
"default": "sale",
"options": [
{
"value": "sale",
"label": "Sale or sharing",
"text": "the sale or sharing of your personal information"
},
{
"value": "sale_ads",
"label": "Sale, sharing, and targeted advertising",
"text": "the sale or sharing of your personal information and targeted advertising"
}
]
},
{
"name": "gpc_applies",
"type": "choice",
"label": "What does the opt-out signal apply to?",
"required": true,
"default": "device",
"options": [
{
"value": "device",
"label": "The browser or device only",
"text": "the browser or device that sends it"
},
{
"value": "account",
"label": "The browser or device, and the account if logged in",
"text": "the browser or device that sends it and, if you are logged in, your account"
},
{
"value": "offline",
"label": "Browser or device, account, and offline sales",
"text": "the browser or device that sends it, your account, and our offline sales, where we can link them"
}
]
},
{
"name": "gpc_howto",
"type": "choice",
"label": "Explain how to send an opt-out signal?",
"required": true,
"default": "yes",
"options": [
{
"value": "yes",
"label": "Yes",
"text": "yes"
},
{
"value": "none",
"label": "No",
"text": ""
}
]
}
],
"conditions": {
"all": [
"jurisdiction.us_ca",
{
"any": [
{
"is": {
"ccpa.sale_or_share": true
}
},
"sharing.advertising",
"sharing.cross-context"
]
}
]
},
"asks": {
"step": 12,
"q": null,
"why": "California regulations require a business that sells or shares personal information to honour browser opt-out preference signals.",
"links": {
"gdpr": "https://gdpr-info.eu/art-21-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-object/",
"ca": "https://oag.ca.gov/privacy/ccpa"
}
},
"review": "Owner, 3 October 2026 (BACKLOG E-RR-16): confirmed for now on the LII copy of CCPA regs §7025(b), (c)(1) (audit/rights.md); re-read the official text before launch. The optional targeted-advertising scope is kept.",
"g16": "",
"file": "icons/rights.gpc.svg"
},
{
"id": "rights.how",
"cat": "rights",
"name": "How to exercise your rights",
"desc": "The channel, identity-verification and response time for rights requests.",
"snippet": "To exercise any of these rights, contact us at [email / web form / postal address]. We may ask you to verify your identity. We will respond within [one month (GDPR) / 45 days (CCPA) / a reasonable period (APP)], extendable where requests are complex. Exercising your rights is free of charge [unless requests are manifestly unfounded or excessive].",
"law": "GDPR Art 12(2)-(6), Art 26(3); UK GDPR Art 12A; CCPA §1798.130(a)(1)(A), (a)(2), (b); Cal. Code Regs. tit. 11 §§7011(e)(3)(E), (H), 7021(a), 7026(f)(1); APP 12.4, 12.8, 12.9, 13.3, 13.5",
"clause": "To exercise any of these rights, contact us [how_channel]. We can ask you to confirm your identity first{if verify_items}, normally by giving us [verify_items]{/if}. We respond within 1 month. We can extend this by up to 2 months for complex or numerous requests, and we will tell you why within the first month. If we refuse a request, we tell you why in writing and how to complain or go to court.{if @jurisdiction.uk} The month starts once we have confirmed your identity.{/if}{if @jurisdiction.us_ca} If you live in California, we confirm receipt within 10 business days and respond within 45 days. We can extend this once by 45 days with notice. We act on opt-out and limit requests within 15 business days. You can also authorise an agent to make a request for you. An agent must give us your signed permission or log in to your account.{/if}{if @jurisdiction.au} If you are in Australia, we respond within a reasonable period.{/if} Exercising your rights is free.{if how_fee} [how_fee]{/if}{if @org.joint_controllers} Where we are joint controllers with another organisation, you can exercise these rights against either of us.{/if}",
"vars": [
{
"name": "how_channel",
"type": "multi",
"label": "How can people send a rights request?",
"required": true,
"options": [
{
"value": "email",
"label": "Email",
"text": "by email at [contact_email]"
},
{
"value": "form",
"label": "Web form",
"text": "using our web form at [rights_form_url]"
},
{
"value": "post",
"label": "Post",
"text": "by post at [contact_postal]"
},
{
"value": "tel",
"label": "Telephone",
"text": "by telephone on [contact_tel]"
},
{
"value": "account",
"label": "Account settings",
"text": "in your account settings"
}
]
},
{
"name": "contact_email",
"type": "email",
"label": "Contact email address for privacy matters",
"required": true,
"shared": true
},
{
"name": "contact_postal",
"type": "address",
"label": "Postal address for privacy enquiries",
"required": false,
"shared": true
},
{
"name": "contact_tel",
"type": "tel",
"label": "Telephone number for privacy enquiries",
"required": false,
"shared": true
},
{
"name": "rights_form_url",
"type": "url",
"label": "Link to your rights request form",
"required": false,
"validation": {
"https": true
}
},
{
"name": "verify_items",
"type": "multi",
"label": "What do you normally ask for to confirm identity?",
"required": false,
"hint": "Required for California operators, whose regulations call for a description of the verification process.",
"options": [
{
"value": "name_email",
"label": "Name and email address",
"text": "your name and email address"
},
{
"value": "account_email",
"label": "The email address on the account",
"text": "the email address on your account"
},
{
"value": "order",
"label": "Order number",
"text": "your order number"
},
{
"value": "postal",
"label": "Postal address",
"text": "your postal address"
},
{
"value": "id_doc",
"label": "Copy of an identity document, deleted after checking",
"text": "a copy of an identity document, which we delete after checking"
},
{
"value": "declaration",
"label": "Signed declaration",
"text": "a signed declaration"
}
]
},
{
"name": "how_fee",
"type": "choice",
"label": "State when you can charge a fee or refuse?",
"required": true,
"default": "state",
"options": [
{
"value": "state",
"label": "Yes",
"text": "We can charge a reasonable fee, or refuse, if a request is clearly unfounded or excessive."
},
{
"value": "none",
"label": "No",
"text": ""
}
]
}
],
"conditions": true,
"asks": {
"step": 12,
"q": null,
"why": "The GDPR requires the policy to say how to exercise rights, and requires a response within 1 month, free of charge.",
"links": {
"gdpr": "https://gdpr-info.eu/art-12-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/",
"oaic": "https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-12-app-12-access-to-personal-information",
"ca": "https://oag.ca.gov/privacy/ccpa"
}
},
"g16": "",
"file": "icons/rights.how.svg"
},
{
"id": "rights.admt-ca",
"cat": "rights",
"name": "Opt out of automated decisions (California)",
"desc": "Opt out of automated decision-making technology and ask how it makes decisions about you (CCPA regulations).",
"snippet": "[California residents] You have the right to opt out of our use of automated decision-making technology for [decisions] and to ask how it makes decisions about you, by [method].",
"law": "Cal. Code Regs. tit. 11 §§7011(e)(2)(F), (G), 7200(a), 7221(a), (b), (c)",
"clause": "If you live in California, you can ask how our automated decision-making technology makes decisions about [admt_decisions]. [admt_route] You can do this [admt_method].",
"vars": [
{
"name": "admt_decisions",
"type": "multi",
"label": "Which decisions does the technology make?",
"required": true,
"free": true,
"hint": "Pre-set from the automated decisions tile.",
"options": [
{
"value": "credit",
"label": "Credit or lending",
"text": "credit or lending"
},
{
"value": "eligibility",
"label": "Eligibility for the service or an offer",
"text": "your eligibility for our service or an offer"
},
{
"value": "pricing",
"label": "Price or terms offered",
"text": "the price or terms you are offered"
},
{
"value": "fraud",
"label": "Blocking suspected fraud",
"text": "blocking a transaction or account as suspected fraud"
},
{
"value": "recruitment",
"label": "Job applications",
"text": "whether a job application progresses"
},
{
"value": "content",
"label": "Removing or restricting content or accounts",
"text": "removing or restricting your content or account"
}
]
},
{
"name": "admt_route",
"type": "choice",
"label": "Do you offer an opt-out, or rely on an exception?",
"required": true,
"default": "optout",
"hint": "Choose an exception only if it applies to every decision listed.",
"options": [
{
"value": "optout",
"label": "We offer an opt-out (§7221(a))",
"text": "You can also opt out of our use of it for these decisions."
},
{
"value": "appeal",
"label": "We offer an appeal to a human reviewer instead (§7221(b)(1))",
"text": "You can also appeal a decision to a person who can change it."
},
{
"value": "exempt",
"label": "Hiring or admission assessment, or allocating work or pay (§7221(b)(2) or (3))",
"text": ""
}
]
},
{
"name": "admt_method",
"type": "choice",
"label": "How do people opt out or ask about the technology?",
"required": true,
"hint": "Pre-set from the human review method.",
"options": [
{
"value": "form",
"label": "Online opt-out form",
"text": "using our online form"
},
{
"value": "contact",
"label": "Contacting us",
"text": "by emailing [contact_email]"
},
{
"value": "link",
"label": "Link shown with the decision",
"text": "using the link shown with the decision"
},
{
"value": "account",
"label": "Account settings",
"text": "in your account settings"
}
]
},
{
"name": "contact_email",
"type": "email",
"label": "Contact email address for privacy matters",
"required": true,
"shared": true
}
],
"conditions": {
"all": [
"jurisdiction.us_ca",
"processing.adm"
]
},
"asks": {
"step": 12,
"q": null,
"why": "California regulations require a business that uses automated decision-making technology to state the right to opt out of it and the right to access it.",
"links": {
"gdpr": "https://gdpr-info.eu/art-22-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/rights-related-to-automated-decision-making-including-profiling/",
"ca": "https://oag.ca.gov/privacy/ccpa"
}
},
"g16": "",
"file": "icons/rights.admt-ca.svg"
},
{
"id": "governance.controller",
"cat": "governance",
"name": "Data controller identity",
"desc": "The organisation responsible for deciding how and why data is processed, with its contact details.",
"snippet": "[Legal name], [company number], of [registered address], is the controller of your personal data. Contact us at [email / postal address / telephone].",
"law": "GDPR Arts 4(7), 13(1)(a); APP 5.2(a); CCPA §1798.130(a)(1)(A) (contact methods)",
"clause": "[controller_name]{if company_number} (company number [company_number]){/if}, of [controller_address], is responsible for your personal data as controller.{if trading_name} We trade as [trading_name].{/if}{if processor_scope} [processor_scope]{/if}",
"vars": [
{
"name": "controller_name",
"type": "text",
"label": "Legal name of your organisation",
"required": true,
"shared": true,
"validation": {
"max": 200
}
},
{
"name": "company_number",
"type": "text",
"label": "Company or charity registration number, if any",
"required": false,
"validation": {
"max": 20,
"pattern": "^[A-Za-z0-9 -]+$"
}
},
{
"name": "controller_address",
"type": "address",
"label": "Registered or principal address",
"required": true,
"shared": true
},
{
"name": "trading_name",
"type": "text",
"label": "Trading name, if different from the legal name",
"required": false,
"validation": {
"max": 120
}
},
{
"name": "processor_scope",
"type": "choice",
"label": "Do your customers also use your service to handle personal data that you process for them?",
"required": false,
"options": [
{
"value": "yes",
"label": "Yes, we are their processor for that data",
"text": "When our customers use our [service_kind] to handle personal data, they decide how it is used. We act as their processor, and their own privacy policies apply to that data."
},
{
"value": "none",
"label": "No",
"text": ""
}
],
"hint": "Typical for software or platforms that businesses use with their own customers' data."
},
{
"name": "service_kind",
"type": "choice",
"label": "Is your service a website, an app, or both?",
"required": true,
"shared": true,
"default": "website",
"options": [
{
"value": "website",
"label": "Website",
"text": "website"
},
{
"value": "app",
"label": "App",
"text": "app"
},
{
"value": "both",
"label": "Website and app",
"text": "website and app"
}
]
}
],
"conditions": true,
"asks": {
"step": 1,
"q": "What is the legal name and address of your organisation?",
"why": "The GDPR requires the policy to identify the organisation responsible for the data and give its contact details.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/governance.controller.svg"
},
{
"id": "governance.joint-controllers",
"cat": "governance",
"name": "Joint controllers",
"desc": "Two or more organisations jointly decide the purposes and means of processing and have an arrangement allocating responsibilities.",
"snippet": "[Legal name] and [legal name] are joint controllers of [categories/processing]. The essence of our arrangement is [summary]; you may exercise your rights against either of us.",
"law": "GDPR Art 26; C-210/16 Wirtschaftsakademie; C-40/17 Fashion ID",
"clause": "We are joint controllers with [joint_controller_names] for [joint_scope]. We decide together why and how this data is used. [joint_essence] [joint_contact_point]{if joint_notice} [joint_notice]{/if}",
"vars": [
{
"name": "joint_controller_names",
"type": "text",
"label": "Name of the other joint controller or controllers",
"required": true,
"validation": {
"max": 200
}
},
{
"name": "joint_scope",
"type": "multi",
"label": "Which purposes do you share control of?",
"required": true,
"options": "@purpose"
},
{
"name": "joint_essence",
"type": "choice",
"label": "How do you make the essence of your arrangement available?",
"required": true,
"options": [
{
"value": "summary",
"label": "Summarise it here",
"text": "In summary, [joint_essence_text]"
},
{
"value": "url",
"label": "Published at a link",
"text": "A summary of our arrangement is at [joint_essence_url]."
},
{
"value": "request",
"label": "Available on request",
"text": "A summary of our arrangement is available on request."
}
]
},
{
"name": "joint_essence_text",
"type": "text",
"label": "One sentence on who does what",
"required": false,
"hint": "For example: we collect the data and they analyse it. End with a full stop.",
"validation": {
"max": 200
}
},
{
"name": "joint_essence_url",
"type": "url",
"label": "Link to the summary",
"required": false,
"validation": {
"https": true
}
},
{
"name": "joint_contact_point",
"type": "choice",
"label": "Who is the contact point for this data?",
"required": true,
"options": [
{
"value": "us",
"label": "We are",
"text": "We are your contact point for this data."
},
{
"value": "them",
"label": "The other controller is",
"text": "[joint_controller_names] is your contact point for this data."
},
{
"value": "either",
"label": "Either of us",
"text": "You can contact either of us about this data."
}
]
},
{
"name": "joint_notice",
"type": "choice",
"label": "Does the other controller give its own privacy information about this data?",
"required": true,
"default": "none",
"options": [
{
"value": "yes",
"label": "Yes",
"text": "[joint_controller_names] gives you its own privacy information about this data."
},
{
"value": "none",
"label": "Not stated",
"text": ""
}
]
}
],
"conditions": {
"any": [
"org.joint_controllers",
{
"is": {
"var.sharing.advertising.ad_partner_role": "joint"
}
},
{
"is": {
"var.sharing.social-platforms.social_role": "joint"
}
}
]
},
"asks": {
"step": 1,
"q": "Do you decide jointly with another organisation why and how any personal data is used?",
"why": "The GDPR requires joint controllers to agree who does what and to make the essence of that arrangement available to people.",
"links": {
"gdpr": "https://gdpr-info.eu/art-26-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-does-it-mean-if-you-are-joint-controllers/"
}
},
"g16": "",
"file": "icons/governance.joint-controllers.svg"
},
{
"id": "governance.dpo",
"cat": "governance",
"name": "Data protection officer",
"desc": "A designated officer who oversees compliance and is a contact point for individuals and the supervisory authority.",
"snippet": "Our Data Protection Officer can be contacted at [email / postal address].",
"law": "GDPR Arts 13(1)(b), 37-39",
"clause": "{if dpo_name}Our data protection officer is [dpo_name].{else}We have appointed a data protection officer.{/if} You can contact them at [dpo_contact].",
"vars": [
{
"name": "dpo_name",
"type": "text",
"label": "Name of the data protection officer or firm, if you publish it",
"required": false,
"validation": {
"max": 120
}
},
{
"name": "dpo_contact",
"type": "email",
"label": "Contact email address of your data protection officer",
"required": true,
"shared": true
}
],
"conditions": "org.dpo",
"asks": {
"step": 1,
"q": "Have you appointed a data protection officer?",
"why": "Where a data protection officer is appointed, the GDPR requires the policy to give their contact details.",
"links": {
"gdpr": "https://gdpr-info.eu/art-37-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/"
}
},
"g16": "",
"file": "icons/governance.dpo.svg"
},
{
"id": "governance.representative",
"cat": "governance",
"name": "EU / UK representative",
"desc": "A representative appointed by a controller established outside the EU or UK that offers goods or services to, or monitors, people there.",
"snippet": "Our representative in the [European Union / United Kingdom] under Article 27 is [name], [address], [email].",
"law": "GDPR Arts 3(2), 13(1)(a), 27(4); UK GDPR Art 27",
"clause": "[rep_name], of [rep_address], is our representative in the [rep_region]. You can contact them at [rep_email].",
"vars": [
{
"name": "rep_name",
"type": "text",
"label": "Name of the representative",
"required": true,
"validation": {
"max": 120
}
},
{
"name": "rep_address",
"type": "address",
"label": "Address of the representative",
"required": true
},
{
"name": "rep_region",
"type": "choice",
"label": "Where is the representative appointed?",
"required": true,
"options": [
{
"value": "eu",
"label": "European Union",
"text": "European Union (Article 27 GDPR)"
},
{
"value": "uk",
"label": "United Kingdom",
"text": "United Kingdom (Article 27 UK GDPR)"
},
{
"value": "both",
"label": "Both",
"text": "European Union and the United Kingdom (Article 27 GDPR and UK GDPR)"
}
]
},
{
"name": "rep_email",
"type": "email",
"label": "Email address of the representative",
"required": true,
"hint": "The GDPR lets people address the representative instead of you, so a contact route is required."
}
],
"conditions": "org.representative_required",
"asks": {
"step": 1,
"q": "Are you outside the EU and UK but offer services to, or monitor, people there?",
"why": "The GDPR requires an organisation outside the EU or UK that serves people there to appoint a local representative, with some exemptions.",
"links": {
"gdpr": "https://gdpr-info.eu/art-27-gdpr/",
"ico": "https://ico.org.uk/for-organisations/data-protection-and-the-eu/data-protection-and-the-eu-in-detail/the-uk-gdpr/uk-representatives/"
}
},
"multiple": true,
"g16": "",
"file": "icons/governance.representative.svg"
},
{
"id": "governance.encryption",
"cat": "governance",
"name": "Encryption",
"desc": "Data is encrypted in transit (for example TLS) and/or at rest.",
"snippet": "We encrypt your data [in transit using TLS and at rest using [standard]].",
"law": "GDPR Arts 32(1)(a), 34(3)(a); APP 11.1; CCPA §1798.150 (breach liability)",
"clause": "We encrypt your personal data [encryption_scope].",
"vars": [
{
"name": "encryption_scope",
"type": "multi",
"label": "Where do you encrypt personal data?",
"required": true,
"options": [
{
"value": "transit",
"label": "In transit",
"text": "in transit between your device and our systems"
},
{
"value": "rest",
"label": "At rest",
"text": "when stored on our systems"
},
{
"value": "backups",
"label": "In backups",
"text": "in our backups"
}
]
}
],
"conditions": {
"is": {
"compliance.security": "done"
}
},
"asks": {
"step": 11,
"q": "Do you encrypt personal data in transit or at rest?",
"why": "Encryption is a security measure the GDPR names, and it can remove the duty to tell people about a breach.",
"links": {
"gdpr": "https://gdpr-info.eu/art-32-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/encryption/"
}
},
"g16": "",
"file": "icons/governance.encryption.svg"
},
{
"id": "governance.security-measures",
"cat": "governance",
"name": "Security measures",
"desc": "Technical and organisational measures such as access controls, staff training, testing and certifications.",
"snippet": "We protect your data with appropriate technical and organisational measures, including [access controls, staff training, regular security testing and [ISO 27001 / SOC 2] certification]. No system is completely secure and we cannot guarantee the security of data transmitted over the internet.",
"law": "GDPR Arts 5(1)(f), 32; APP 11.1; CCPA §1798.100(e)",
"clause": "We protect your personal data against loss, misuse, and unauthorised access.{if security_measures} Our measures include [security_measures].{/if}{if security_disclaimer} [security_disclaimer]{/if}",
"vars": [
{
"name": "security_measures",
"type": "multi",
"label": "Which security measures do you have in place?",
"required": false,
"options": [
{
"value": "access",
"label": "Access controls",
"text": "access controls"
},
{
"value": "mfa",
"label": "Multi-factor authentication",
"text": "multi-factor authentication"
},
{
"value": "backups",
"label": "Regular backups",
"text": "regular backups"
},
{
"value": "testing",
"label": "Regular security testing",
"text": "regular security testing"
},
{
"value": "logging",
"label": "Logging and monitoring of access",
"text": "logging and monitoring of access"
},
{
"value": "iso27001",
"label": "ISO 27001 certification",
"text": "ISO 27001 certification"
},
{
"value": "soc2",
"label": "SOC 2 attestation",
"text": "SOC 2 attestation"
},
{
"value": "cyber_essentials",
"label": "Cyber Essentials certification",
"text": "Cyber Essentials certification"
}
]
},
{
"name": "security_disclaimer",
"type": "choice",
"label": "Add a sentence about the limits of internet security?",
"required": true,
"default": "none",
"options": [
{
"value": "none",
"label": "No",
"text": ""
},
{
"value": "yes",
"label": "Yes",
"text": "The internet is not a secure medium, so we cannot guarantee the security of data while it travels to us."
}
]
}
],
"conditions": true,
"asks": {
"step": 11,
"q": "Which security measures protect the personal data you hold?",
"why": "The GDPR requires security appropriate to the risk, and the policy should say what you do without claiming more.",
"links": {
"gdpr": "https://gdpr-info.eu/art-32-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/"
}
},
"g16": "",
"file": "icons/governance.security-measures.svg"
},
{
"id": "governance.breach",
"cat": "governance",
"name": "Breach notification",
"desc": "How personal data breaches are handled, including notification to the authority within 72 hours and to affected individuals where the risk is high.",
"snippet": "We notify the [supervisory authority] of a personal data breach within 72 hours where required. If a breach is likely to result in a high risk to you, we will also notify you without undue delay.",
"law": "GDPR Arts 33-34; Privacy Act 1988 (Cth) Part IIIC (Notifiable Data Breaches); Cal. Civ. Code §1798.82",
"clause": "We will report any data breach that affects you to {if authority_name}[authority_name]{else}the supervisory authority{/if}. We will do this without undue delay, and where feasible within 72 hours of finding out. If a breach is likely to result in a high risk to you, we also tell you without undue delay.",
"vars": [
{
"name": "authority_name",
"type": "text",
"label": "Name of your lead supervisory authority",
"required": false,
"shared": true,
"validation": {
"max": 120
}
}
],
"conditions": {
"is": {
"compliance.breach": "done"
}
},
"asks": {
"step": 11,
"q": "Do you have a process to report breaches to the authority within 72 hours?",
"why": "The GDPR requires breach reports to the authority without undue delay, within 72 hours where feasible, and to people at high risk.",
"links": {
"gdpr": "https://gdpr-info.eu/art-33-gdpr/",
"ico": "https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/"
}
},
"g16": "",
"file": "icons/governance.breach.svg"
},
{
"id": "governance.dpia",
"cat": "governance",
"name": "Impact assessment carried out",
"desc": "A data protection impact assessment has been carried out for high-risk processing.",
"snippet": "We have carried out a data protection impact assessment for [processing], [a summary of which is available on request].",
"law": "GDPR Art 35; UK GDPR Art 35",
"clause": "We have carried out a data protection impact assessment for [dpia_scope].{if dpia_mitigations} It records the measures we take to reduce the risks it identified.{/if}{if dpia_summary} [dpia_summary]{/if}",
"vars": [
{
"name": "dpia_scope",
"type": "multi",
"label": "Which processing did the assessment cover?",
"required": true,
"free": true,
"options": [
{
"value": "profiling",
"label": "Profiling with significant effects",
"text": "profiling"
},
{
"value": "adm",
"label": "Automated decisions",
"text": "automated decision-making"
},
{
"value": "special",
"label": "Large-scale special category data",
"text": "our use of special category data"
},
{
"value": "monitoring",
"label": "Systematic monitoring",
"text": "systematic monitoring"
},
{
"value": "tracking",
"label": "Cross-site tracking",
"text": "tracking across websites"
},
{
"value": "children",
"label": "Children's data",
"text": "children's data"
},
{
"value": "biometrics",
"label": "Biometric data",
"text": "biometric data"
},
{
"value": "ai",
"label": "AI systems",
"text": "our use of AI"
},
{
"value": "cctv",
"label": "CCTV",
"text": "CCTV"
},
{
"value": "staff_monitoring",
"label": "Staff monitoring",
"text": "staff monitoring"
},
{
"value": "new_tech",
"label": "New technology",
"text": "new technology we use"
}
]
},
{
"name": "dpia_mitigations",
"type": "choice",
"label": "Does the assessment record mitigations?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes, mitigations recorded"
},
{
"value": "none",
"label": "Not stated"
}
]
},
{
"name": "dpia_summary",
"type": "choice",
"label": "Do you make a summary available?",
"required": true,
"options": [
{
"value": "request",
"label": "On request",
"text": "A summary is available on request."
},
{
"value": "url",
"label": "Published at a link",
"text": "A summary is at [dpia_summary_url]."
},
{
"value": "none",
"label": "No",
"text": ""
}
],
"hint": "Optional: the law does not require you to share a summary."
},
{
"name": "dpia_summary_url",
"type": "url",
"label": "Link to the summary",
"required": false,
"validation": {
"https": true
}
}
],
"conditions": {
"is": {
"compliance.dpia": "done"
}
},
"asks": {
"step": 11,
"q": "Have you completed a data protection impact assessment for your high-risk processing?",
"why": "The GDPR requires an impact assessment before high-risk processing, such as profiling with legal effects or large-scale special category data.",
"links": {
"gdpr": "https://gdpr-info.eu/art-35-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/"
}
},
"multiple": true,
"g16": "",
"file": "icons/governance.dpia.svg"
},
{
"id": "governance.children-not-directed",
"cat": "governance",
"name": "Not intended for children",
"desc": "The service is not directed at children and their data is not knowingly collected.",
"snippet": "Our services are not directed at children under [16/13] and we do not knowingly collect their personal data. If you believe a child has provided us with data, contact us at [contact] and we will delete it.",
"law": "GDPR Art 8; UK GDPR Art 8; COPPA 15 U.S.C. §6502; CCPA §1798.120(c)",
"clause": "Our [service_kind] is not directed at children under [child_age] and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us at [contact_email] and we will delete it.",
"vars": [
{
"name": "service_kind",
"type": "choice",
"label": "Is your service a website, an app, or both?",
"required": true,
"shared": true,
"default": "website",
"options": [
{
"value": "website",
"label": "Website",
"text": "website"
},
{
"value": "app",
"label": "App",
"text": "app"
},
{
"value": "both",
"label": "Website and app",
"text": "website and app"
}
]
},
{
"name": "child_age",
"type": "number",
"label": "Age below which you treat someone as a child",
"required": true,
"default": 16,
"validation": {
"min": 13,
"max": 18
},
"hint": "The GDPR sets 16 unless national law sets a lower age, down to 13. The UK uses 13."
},
{
"name": "contact_email",
"type": "email",
"label": "Contact email address for privacy matters",
"required": true,
"shared": true
}
],
"conditions": {
"is": {
"audience.children_possible": false
}
},
"asks": {
"step": 2,
"q": "Could children use your service?",
"why": "The GDPR sets the consent age for online services at 16, or a national age down to 13, so the answer decides which clauses apply.",
"links": {
"gdpr": "https://gdpr-info.eu/art-8-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/children-and-the-uk-gdpr/"
}
},
"g16": "",
"file": "icons/governance.children-not-directed.svg"
},
{
"id": "governance.cookie-consent",
"cat": "governance",
"name": "Cookie consent",
"desc": "Non-essential cookies and trackers are set only after consent, which can be changed at any time.",
"snippet": "We set non-essential cookies only with your consent, which you can give or withdraw at any time via [cookie settings link]. Strictly necessary cookies are set without consent.",
"law": "ePrivacy Directive Art 5(3); PECR reg 6 (UK) as amended by DUAA 2025; PECR Sch A1 paras 5, 6 (UK, from 5 February 2026); C-673/17 Planet49; GDPR Art 7",
"clause": "{if @uk_exempt_purposes}Apart from the cookies described below, we{else}We{/if} set non-essential cookies and similar technologies only with your consent. We set strictly necessary cookies without consent.{if @uk_exempt_purposes} In the UK we also set some cookies without asking for consent. They [uk_exempt_purposes]. The law allows this as long as we tell you and give you a simple way to object.{/if}{if cookie_policy_url} Our cookie policy at [cookie_policy_url] lists each cookie we use and what it does.{/if}",
"vars": [
{
"name": "uk_exempt_purposes",
"type": "multi",
"label": "In the UK, which cookies do you set without consent under the PECR exemptions?",
"required": false,
"options": [
{
"value": "statistics",
"label": "Statistics to improve the service",
"text": "count how people use our [service_kind] to see what we can improve"
},
{
"value": "appearance",
"label": "Appearance and functionality preferences",
"text": "remember how you like things to look and work"
}
],
"hint": "UK operators only. The statistics exemption applies only where the sole purpose is improving the service and the data is shared only with someone helping you to improve it."
},
{
"name": "service_kind",
"type": "choice",
"label": "Is your service a website, an app, or both?",
"required": true,
"shared": true,
"default": "website",
"options": [
{
"value": "website",
"label": "Website",
"text": "website"
},
{
"value": "app",
"label": "App",
"text": "app"
},
{
"value": "both",
"label": "Website and app",
"text": "website and app"
}
]
},
{
"name": "cookie_policy_url",
"type": "url",
"label": "Link to your cookie policy, if you have one",
"required": false,
"validation": {
"https": true
},
"shared": true
}
],
"conditions": "source.automatic",
"asks": {
"step": 4,
"q": "Do you set cookies or similar trackers that are not strictly necessary?",
"why": "The ePrivacy rules require consent before non-essential cookies are set, and the policy must say so.",
"links": {
"gdpr": "https://gdpr-info.eu/art-7-gdpr/",
"ico": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/"
}
},
"g16": "",
"file": "icons/governance.cookie-consent.svg"
},
{
"id": "governance.changes",
"cat": "governance",
"name": "Changes to this policy",
"desc": "How updates to the policy are communicated and when they take effect.",
"snippet": "We may update this policy from time to time. We will notify you of material changes by [email / a notice on our website] [at least [period] before they take effect]. This policy was last updated on [date].",
"law": "GDPR Arts 12(1), 13(3), 14(4), Recital 61; APP 1.3; CCPA §1798.130(a)(5) (update at least once every 12 months); DSA Art 14(2) (significant changes to terms)",
"clause": "We may update this policy. We will tell you about any material changes, including new uses of your personal data, by [change_notice] before they take effect.{if change_lead} We will give at least [change_lead] notice.{/if}{if @compliance.dsa=done} We also tell you about significant changes to our terms of service by [change_notice].{/if}{if @jurisdiction.us_ca} We review this policy at least every 12 months.{/if} This policy was last updated on [policy_date].",
"vars": [
{
"name": "change_notice",
"type": "choice",
"label": "How will you tell people about material changes?",
"required": true,
"options": [
{
"value": "email",
"label": "Email",
"text": "email"
},
{
"value": "notice",
"label": "A notice on the website",
"text": "a notice on our website"
},
{
"value": "in_app",
"label": "A message in the app",
"text": "a message in the app"
},
{
"value": "email_notice",
"label": "Email and a notice on the website",
"text": "email and a notice on our website"
}
]
},
{
"name": "change_lead",
"type": "period",
"label": "Notice period before changes take effect, if any",
"required": false,
"hint": "Leave blank if you give no fixed notice period."
},
{
"name": "policy_date",
"type": "date",
"label": "Date this policy was last updated",
"required": true
}
],
"conditions": true,
"asks": {
"step": 12,
"q": "How will you tell people when this policy changes?",
"why": "The GDPR requires people to be told of a new purpose before their data is used for it, in an easily accessible form.",
"links": {
"gdpr": "https://gdpr-info.eu/art-12-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/"
}
},
"g16": "",
"file": "icons/governance.changes.svg"
},
{
"id": "governance.contact",
"cat": "governance",
"name": "Contact us",
"desc": "How to reach the organisation with privacy questions or requests.",
"snippet": "If you have questions about this policy or how we use your data, contact us at [email], [postal address] [or telephone].",
"law": "GDPR Art 13(1)(a); APP 5.2(a); CCPA §1798.130(a)(1)",
"clause": "You can contact us about this policy or our use of your personal data at [contact_email].{if contact_postal} Our postal address is [contact_postal].{/if}{if contact_tel} Our telephone number is [contact_tel].{/if}",
"vars": [
{
"name": "contact_email",
"type": "email",
"label": "Contact email address for privacy matters",
"required": true,
"shared": true
},
{
"name": "contact_postal",
"type": "address",
"label": "Postal address for privacy enquiries",
"required": false,
"shared": true
},
{
"name": "contact_tel",
"type": "tel",
"label": "Telephone number for privacy enquiries",
"required": false,
"shared": true
}
],
"conditions": true,
"asks": {
"step": 1,
"q": null,
"why": "The GDPR requires the policy to give the contact details people can use to raise questions about their data.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"g16": "",
"file": "icons/governance.contact.svg"
},
{
"id": "governance.mandatory",
"cat": "governance",
"name": "Mandatory or optional data",
"desc": "Whether providing data is a statutory or contractual requirement, and what happens if it is not provided.",
"snippet": "Providing [categories] is [required to enter into a contract with us / required by law / optional]. If you do not provide it, [we may be unable to provide our services to you / consequence].",
"law": "GDPR Art 13(2)(e); APP 5.2(c), (e)",
"clause": "Providing [mandatory_data] is [mandatory_reason]{if mandatory_law} ([mandatory_law]){/if}. If you do not provide it, [mandatory_consequence].",
"vars": [
{
"name": "mandatory_data",
"type": "multi",
"label": "Which data does this apply to?",
"required": true,
"options": "@data"
},
{
"name": "mandatory_reason",
"type": "choice",
"label": "Why is it required?",
"required": true,
"options": [
{
"value": "contract",
"label": "Contractual requirement",
"text": "required to enter into or carry out our contract with you"
},
{
"value": "law",
"label": "A legal requirement",
"text": "required by law"
},
{
"value": "authorised",
"label": "Authorised by law",
"text": "authorised by law",
"deprecated": true
},
{
"value": "optional",
"label": "Optional",
"text": "optional"
}
]
},
{
"name": "mandatory_law",
"type": "text",
"label": "Which law requires or authorises the collection?",
"required": false,
"validation": {
"max": 150
},
"hint": "Only for a legal requirement. Australian law requires the law or court order to be named."
},
{
"name": "mandatory_consequence",
"type": "choice",
"label": "What happens if it is not provided?",
"required": true,
"options": [
{
"value": "no_service",
"label": "We cannot provide the service",
"text": "we cannot provide our service to you"
},
{
"value": "no_contract",
"label": "We cannot enter into the contract",
"text": "we cannot enter into a contract with you"
},
{
"value": "partial",
"label": "Some features will not work",
"text": "some features will not be available to you"
},
{
"value": "legal",
"label": "We cannot meet a legal duty",
"text": "we cannot meet our legal duties and may have to stop dealing with you"
},
{
"value": "none",
"label": "No consequence",
"text": "you can still use our service"
},
{
"value": "other",
"label": "Other",
"text": "[mandatory_consequence_other]"
}
]
},
{
"name": "mandatory_consequence_other",
"type": "text",
"label": "Describe the consequence in a few words",
"required": false,
"validation": {
"max": 150
},
"hint": "Completes the sentence 'If you do not provide it, ...'."
}
],
"conditions": true,
"asks": {
"step": 3,
"q": "Is any of the data you collect required by law or for your contract with people?",
"why": "The GDPR requires the policy to say whether giving data is required by law or contract and what happens if it is not given.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/"
}
},
"multiple": true,
"g16": "",
"file": "icons/governance.mandatory.svg"
},
{
"id": "governance.privacy-by-design",
"cat": "governance",
"name": "Privacy by design and default",
"desc": "Data protection is built into systems and processes from the outset, and default settings are the most privacy-protective.",
"snippet": "We build data protection into our systems and processes from the outset and set the most privacy-protective options by default, including [data minimisation, pseudonymisation and limited default sharing].",
"law": "GDPR Art 25, Recital 78; UK GDPR Art 25",
"clause": "We build data protection into our systems and processes from the start. In particular, we [pbd_measures].",
"vars": [
{
"name": "pbd_measures",
"type": "multi",
"label": "Which of these do you do?",
"required": true,
"options": [
{
"value": "design_review",
"label": "Design review in projects",
"text": "review data protection in every new project"
},
{
"value": "minimisation",
"label": "Data minimisation rules",
"text": "collect only the data we need for each purpose"
},
{
"value": "defaults",
"label": "Most-protective defaults",
"text": "set the most protective options by default"
},
{
"value": "pseudonymisation",
"label": "Pseudonymisation where possible",
"text": "pseudonymise data where we can"
},
{
"value": "role_access",
"label": "Access limited by role",
"text": "limit access to data by role"
}
]
}
],
"conditions": {
"is": {
"compliance.privacy-by-design": "done"
}
},
"asks": {
"step": 11,
"q": "Do you build data protection into your systems and set protective defaults?",
"why": "The GDPR requires data protection by design and by default, and the policy should claim only the measures you have.",
"links": {
"gdpr": "https://gdpr-info.eu/art-25-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-by-design-and-default/"
}
},
"g16": "",
"file": "icons/governance.privacy-by-design.svg"
},
{
"id": "governance.ropa",
"cat": "governance",
"name": "Records of processing kept",
"desc": "A record of processing activities is maintained (mandatory unless the small-enterprise exemption in Art 30(5) applies).",
"snippet": "We maintain a record of our processing activities as required by Article 30 [and make it available to the supervisory authority on request].",
"law": "GDPR Art 30; Art 30(5) exemption for organisations employing fewer than 250 persons unless processing is likely to result in a risk, is not occasional, or includes special category or criminal offence data",
"clause": "We keep a record of our processing activities. We make it available to the supervisory authority on request.",
"vars": [],
"conditions": {
"is": {
"compliance.ropa": "done"
}
},
"asks": {
"step": 11,
"q": "Do you keep a record of your processing activities?",
"why": "The GDPR requires most organisations to keep a written record of their processing and to show it to the authority on request.",
"links": {
"gdpr": "https://gdpr-info.eu/art-30-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/documentation/"
}
},
"g16": "",
"file": "icons/governance.ropa.svg"
},
{
"id": "governance.processor-contracts",
"cat": "governance",
"name": "Processor contracts in place",
"desc": "Written contracts with every processor containing the Art 28(3) terms (instructions, confidentiality, security, sub-processors, assistance, deletion, audit).",
"snippet": "Every service provider that processes personal data on our behalf is bound by a written contract meeting the requirements of Article 28, including obligations of confidentiality, security and deletion or return of data at the end of the service.",
"law": "GDPR Art 28(3); Commission Implementing Decision (EU) 2021/915 (standard contractual clauses for processors)",
"clause": "Every service provider that processes personal data for us is bound by [processor_contract]. It requires them to act only on our instructions, keep the data confidential and secure, and delete or return it when the service ends.{if subprocessor_list} We keep a list of the further providers they use.{/if}",
"vars": [
{
"name": "processor_contract",
"type": "multi",
"label": "What binds your service providers?",
"required": true,
"options": [
{
"value": "written",
"label": "A written contract with the terms the GDPR requires",
"text": "a written contract containing the terms the GDPR requires"
},
{
"value": "standard_clauses",
"label": "The European Commission's standard processor clauses",
"text": "the European Commission's standard clauses for processors"
}
]
},
{
"name": "subprocessor_list",
"type": "choice",
"label": "Do you keep a list of your providers' sub-processors?",
"required": true,
"options": [
{
"value": "yes",
"label": "Yes"
},
{
"value": "none",
"label": "Not stated"
}
]
}
],
"conditions": {
"is": {
"compliance.processor-contracts": "done"
}
},
"asks": {
"step": 11,
"q": "Are all your service providers bound by a written data processing contract?",
"why": "The GDPR requires a written contract with every processor containing set terms on instructions, confidentiality, security, and deletion.",
"links": {
"gdpr": "https://gdpr-info.eu/art-28-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/contracts/"
}
},
"g16": "",
"file": "icons/governance.processor-contracts.svg"
},
{
"id": "governance.staff-training",
"cat": "governance",
"name": "Staff training and access control",
"desc": "Staff who handle personal data are trained and bound by confidentiality, and access is limited to those who need it.",
"snippet": "Our staff receive data protection training, are bound by confidentiality obligations and can access personal data only where their role requires it.",
"law": "GDPR Arts 5(2), 29, 32(4), 39(1)(b)",
"clause": "Our staff [staff_measures].",
"vars": [
{
"name": "staff_measures",
"type": "multi",
"label": "Which of these apply to your staff?",
"required": true,
"options": [
{
"value": "confidentiality",
"label": "Confidentiality clauses",
"text": "are bound by confidentiality obligations"
},
{
"value": "training",
"label": "Data protection training",
"text": "receive data protection training"
},
{
"value": "need_to_know",
"label": "Access on a need-to-know basis",
"text": "can access personal data only where their role requires it"
}
]
}
],
"conditions": {
"is": {
"compliance.staff": "done"
}
},
"asks": {
"step": 11,
"q": "Are your staff trained, bound by confidentiality, and limited to the data they need?",
"why": "The GDPR requires that people acting under your authority process data only on your instructions and that access is controlled.",
"links": {
"gdpr": "https://gdpr-info.eu/art-29-gdpr/",
"ico": "https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/training-and-awareness/"
}
},
"g16": "",
"file": "icons/governance.staff-training.svg"
},
{
"id": "governance.dsar-procedure",
"cat": "governance",
"name": "Rights-request procedure",
"desc": "A documented process for receiving, verifying and answering data subject requests within the statutory time limit.",
"snippet": "We have a procedure for handling requests to exercise your rights. We will confirm receipt, may ask you to verify your identity, and will respond within one month [extendable by two further months for complex requests, in which case we will tell you].",
"law": "GDPR Art 12(2) to (6); ICO right-of-access guidance; CCPA §1798.130(a)(2) (45 days); Cal Code Regs tit 11 §7011(e)(2)(G) (access to ADMT)",
"clause": "We have a procedure for handling requests to exercise your rights over your personal data.{if dsar_steps} We [dsar_steps].{/if} We respond within 1 month of receiving a request. For complex or numerous requests we can take up to 2 further months, and we will tell you if so.{if @jurisdiction.us_ca} For requests under California law{if @processing.adm}, including requests to access automated decision-making technology,{/if} we respond within 45 days.{/if}",
"vars": [
{
"name": "dsar_steps",
"type": "multi",
"label": "Which of these does your procedure include?",
"required": false,
"options": [
{
"value": "acknowledge",
"label": "Confirm receipt",
"text": "confirm receipt"
},
{
"value": "identity",
"label": "Verify identity where needed",
"text": "check your identity where we need to"
},
{
"value": "log",
"label": "Keep a log of requests",
"text": "keep a log of requests"
}
]
}
],
"conditions": {
"is": {
"compliance.rights-procedure": "done"
}
},
"asks": {
"step": 11,
"q": "Do you have a documented procedure for answering requests within 1 month?",
"why": "The GDPR requires answers within 1 month, extendable by 2 months for complex requests, and allows identity checks where there is reasonable doubt.",
"links": {
"gdpr": "https://gdpr-info.eu/art-12-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/"
}
},
"review": "Owner, 3 October 2026 (BACKLOG E-GC-10): deferred until CCPA regs §7001 (ADMT definition) and the ADMT access-request provisions are read; then add the glossary term and confirm the 45 days.",
"g16": "",
"file": "icons/governance.dsar-procedure.svg"
},
{
"id": "governance.consent-records",
"cat": "governance",
"name": "Consent records kept",
"desc": "Records showing who consented, when, how and to what, so that consent can be demonstrated.",
"snippet": "Where we rely on your consent, we keep a record of when and how you gave it and what you were told, so that we can demonstrate it.",
"law": "GDPR Art 7(1), 7(3), Recitals 32, 42; C-673/17 Planet49",
"clause": "Where we rely on your consent, we [consent_practices].",
"vars": [
{
"name": "consent_practices",
"type": "multi",
"label": "Which of these do you do?",
"required": true,
"options": [
{
"value": "records",
"label": "Keep records of consent",
"text": "keep a record of when, how, and to what you consented"
},
{
"value": "no_preticked",
"label": "No pre-ticked boxes",
"text": "do not use pre-ticked boxes or other defaults that assume consent"
},
{
"value": "reject_option",
"label": "Cookie banner with a reject option",
"text": "offer a reject option alongside accept in our cookie banner"
},
{
"value": "withdraw_easy",
"label": "Withdrawing is as easy as giving consent",
"text": "make withdrawing consent as easy as giving it"
}
]
}
],
"conditions": {
"is": {
"compliance.consent-management": "done"
}
},
"asks": {
"step": 11,
"q": "Do you keep records of consent and avoid pre-ticked boxes?",
"why": "The GDPR requires you to be able to show that consent was given and that it was a clear, affirmative act.",
"links": {
"gdpr": "https://gdpr-info.eu/art-7-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/how-should-we-obtain-record-and-manage-consent/"
}
},
"g16": "",
"file": "icons/governance.consent-records.svg"
},
{
"id": "governance.lia",
"cat": "governance",
"name": "Legitimate-interests assessment recorded",
"desc": "A documented three-part test (purpose, necessity, balancing) for each processing activity that relies on legitimate interests.",
"snippet": "For each activity that relies on our legitimate interests we have carried out and recorded an assessment of the purpose, the necessity of the processing and the balance against your interests and rights. You can request a summary by [method].",
"law": "GDPR Art 6(1)(f), Recital 47, Art 5(2); ICO legitimate interests guidance",
"clause": "For each purpose that relies on our legitimate interests, we have recorded an assessment. It covers the purpose, whether the processing is necessary, and the balance against your interests and rights.",
"vars": [],
"conditions": {
"all": [
{
"anyBasis": "basis.legitimate-interests"
},
{
"not": "li.missing"
}
]
},
"asks": {
"step": 6,
"q": null,
"why": "Relying on legitimate interests requires a careful assessment, which the ICO says to record, and the wizard produces in step 6.",
"links": {
"gdpr": "https://gdpr-info.eu/art-6-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/how-do-we-apply-legitimate-interests-in-practice/"
}
},
"g16": "",
"file": "icons/governance.lia.svg"
},
{
"id": "governance.retention-schedule",
"cat": "governance",
"name": "Retention schedule maintained",
"desc": "A written schedule setting retention periods for each category of data, with periodic review and deletion.",
"snippet": "We maintain a retention schedule setting out how long we keep each category of personal data and review and delete data in accordance with it.",
"law": "GDPR Art 5(1)(e), 5(2), 30(1)(f)",
"clause": "We keep a written schedule of how long we keep each category of personal data.{if retention_practices} We [retention_practices].{/if}",
"vars": [
{
"name": "retention_practices",
"type": "multi",
"label": "Which of these do you do?",
"required": false,
"options": [
{
"value": "automated",
"label": "Automated deletion",
"text": "delete data automatically when its period ends"
},
{
"value": "review",
"label": "Periodic review",
"text": "review the data we hold every [retention_review_period] and delete what we no longer need"
}
]
},
{
"name": "retention_review_period",
"type": "period",
"label": "How often do you review the data you hold?",
"required": false,
"default": {
"n": 1,
"unit": "years"
}
}
],
"conditions": {
"is": {
"compliance.retention-schedule": "done"
}
},
"asks": {
"step": 11,
"q": "Do you keep a retention schedule and delete data when its period ends?",
"why": "The GDPR requires data to be kept no longer than needed and requires you to be able to show how you decide that.",
"links": {
"gdpr": "https://gdpr-info.eu/art-5-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/"
}
},
"g16": "",
"file": "icons/governance.retention-schedule.svg"
},
{
"id": "governance.breach-register",
"cat": "governance",
"name": "Breach procedure and register",
"desc": "A documented procedure for detecting, assessing, recording and notifying personal data breaches.",
"snippet": "We have a procedure for detecting and responding to personal data breaches and keep a register of all breaches, whether or not they were notifiable.",
"law": "GDPR Art 33(5), 33 to 34",
"clause": "We [breach_measures].",
"vars": [
{
"name": "breach_measures",
"type": "multi",
"label": "Which of these do you have?",
"required": true,
"options": [
{
"value": "procedure",
"label": "Documented breach procedure",
"text": "have a written procedure for detecting, assessing, and responding to personal data breaches"
},
{
"value": "register",
"label": "Breach register",
"text": "keep a register of every breach, whether or not we had to report it"
},
{
"value": "criteria",
"label": "Criteria for telling affected people",
"text": "have set criteria for deciding when to tell affected people"
}
]
}
],
"conditions": {
"is": {
"compliance.breach": "done"
}
},
"asks": {
"step": 11,
"q": "Do you have a documented breach procedure and keep a register of breaches?",
"why": "The GDPR requires every breach to be documented, whether or not it is reported, so the authority can verify compliance.",
"links": {
"gdpr": "https://gdpr-info.eu/art-33-gdpr/",
"ico": "https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/"
}
},
"g16": "",
"file": "icons/governance.breach-register.svg"
},
{
"id": "governance.transfer-assessment",
"cat": "governance",
"name": "Transfer risk assessment done",
"desc": "For transfers on SCCs/IDTA, an assessment of the destination country's laws and any supplementary measures needed.",
"snippet": "Where we transfer data outside the [EEA/UK] under standard contractual clauses [or the IDTA], we have assessed the laws and practices of the destination country and adopted [supplementary measures] where needed.",
"law": "C-311/18 Schrems II; EDPB Recommendations 01/2020; ICO transfer risk assessment guidance",
"clause": "Some of our transfers outside the [region] rely on [transfer_tool]. Before we make these transfers, we assess the laws and practices of the destination country.{if transfer_measures} We [transfer_measures].{/if}",
"vars": [
{
"name": "region",
"type": "choice",
"label": "Which region does your policy cover?",
"required": true,
"shared": true,
"default": "eea",
"options": [
{
"value": "eea",
"label": "EEA",
"text": "EEA"
},
{
"value": "uk",
"label": "UK",
"text": "UK"
},
{
"value": "both",
"label": "EEA and UK",
"text": "EEA and the UK"
}
]
},
{
"name": "transfer_tool",
"type": "choice",
"label": "Which transfer tool do you use?",
"required": true,
"options": [
{
"value": "sccs",
"label": "Standard contractual clauses",
"text": "standard contractual clauses"
},
{
"value": "idta",
"label": "UK international data transfer agreement",
"text": "the UK international data transfer agreement"
},
{
"value": "both",
"label": "Both",
"text": "standard contractual clauses or the UK international data transfer agreement"
}
]
},
{
"name": "transfer_measures",
"type": "multi",
"label": "Which of these apply?",
"required": false,
"options": [
{
"value": "supplementary",
"label": "Supplementary measures where needed",
"text": "put in place extra safeguards where the assessment shows they are needed"
},
{
"value": "copy",
"label": "Copy available on request",
"text": "can supply a copy of the assessment on request"
}
]
}
],
"conditions": {
"is": {
"compliance.transfer-assessment": "done"
}
},
"asks": {
"step": 11,
"q": "Have you assessed the risks of your transfers under standard contractual clauses?",
"why": "Transfers under standard clauses require an assessment of the destination country's laws and any extra safeguards, following Schrems II.",
"links": {
"gdpr": "https://gdpr-info.eu/art-46-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/completing-a-transfer-risk-assessment/"
}
},
"g16": "",
"file": "icons/governance.transfer-assessment.svg"
},
{
"id": "governance.ca-sensitive",
"cat": "governance",
"name": "Sensitive personal information (California)",
"desc": "Names the categories California treats as sensitive personal information, the purposes they are used for, and whether they are sold or shared.",
"snippet": "Under California law, your [categories] are sensitive personal information. We [use it only to provide our services / also use it for [purpose]]. We [do not sell or share it / sell or share it].",
"law": "CCPA §1798.100(a)(2), §1798.140(ae); Cal Code Regs tit 11 §7011(e)(1)(K), §7027(m)",
"clause": "Under California law, your [ca_spi_categories] are sensitive personal information. We [ca_spi_use]. We [ca_spi_sold].",
"vars": [
{
"name": "ca_spi_categories",
"type": "multi",
"label": "Which sensitive personal information do you collect?",
"required": true,
"options": [
{
"value": "credentials",
"label": "Account log-in or financial account credentials",
"text": "account log-in or financial account credentials",
"hint": "Card or account numbers count only together with the code, password, or credentials that give access."
},
{
"value": "geolocation",
"label": "Precise geolocation",
"text": "precise geolocation"
},
{
"value": "government_id",
"label": "Government identifiers",
"text": "government identifiers"
},
{
"value": "messages",
"label": "Contents of messages",
"text": "contents of messages"
},
{
"value": "biometric",
"label": "Biometric information",
"text": "biometric information"
},
{
"value": "health",
"label": "Health information",
"text": "health information"
},
{
"value": "genetic",
"label": "Genetic data",
"text": "genetic data"
},
{
"value": "neural",
"label": "Neural data",
"text": "neural data",
"hint": "Information from measuring activity of the nervous system, not inferred from other information."
},
{
"value": "race",
"label": "Racial or ethnic origin",
"text": "racial or ethnic origin"
},
{
"value": "religion",
"label": "Religious or philosophical beliefs",
"text": "religious or philosophical beliefs"
},
{
"value": "union",
"label": "Union membership",
"text": "union membership"
},
{
"value": "sex_life",
"label": "Sex life or sexual orientation",
"text": "sex life or sexual orientation"
},
{
"value": "immigration",
"label": "Citizenship or immigration status",
"text": "citizenship or immigration status"
}
],
"hint": "We tick the categories that match the data you collect. Check them and change any that do not apply."
},
{
"name": "ca_spi_use",
"type": "choice",
"label": "What do you use sensitive personal information for?",
"required": true,
"default": "necessary",
"options": [
{
"value": "necessary",
"label": "Only to provide the service and for the permitted purposes",
"text": "use it only to provide our services and for the purposes California law allows without a right to limit"
},
{
"value": "other",
"label": "Also for other purposes",
"text": "also use it for [ca_spi_other_purpose]"
}
]
},
{
"name": "ca_spi_other_purpose",
"type": "text",
"label": "Which other purposes?",
"required": false,
"validation": {
"max": 150
},
"hint": "Completes the sentence 'We also use it for ...'. Choosing this makes the right to limit apply."
},
{
"name": "ca_spi_sold",
"type": "choice",
"label": "Do you sell or share sensitive personal information?",
"required": true,
"default": "no",
"options": [
{
"value": "no",
"label": "No",
"text": "do not sell or share it"
},
{
"value": "yes",
"label": "Yes, as described in this policy",
"text": "sell or share it, as described in this policy"
}
]
}
],
"conditions": {
"all": [
"jurisdiction.us_ca",
{
"any": [
"data.credentials",
"data.payment",
"data.location-precise",
"data.government-id",
"data.communications",
"data.biometric",
"data.health",
"data.genetic",
"data.special",
"data.financial-status"
]
}
]
},
"asks": {
"step": 8,
"q": null,
"why": "The CCPA requires the policy to name the categories of sensitive personal information, their purposes, and whether they are sold or shared.",
"links": {
"gdpr": "https://gdpr-info.eu/art-9-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/",
"ca": "https://oag.ca.gov/privacy/ccpa"
}
},
"g16": "",
"file": "icons/governance.ca-sensitive.svg"
},
{
"id": "governance.ai-transparency",
"cat": "governance",
"name": "AI transparency",
"desc": "People are told when they deal with an AI system, when content is generated or altered by AI, and before emotion recognition or biometric categorisation is used on them.",
"snippet": "We tell you when you are dealing with an AI system and when content is generated or altered by AI. [We label [images / videos / audio / articles] that AI generated or altered.] [We tell you before we use [emotion recognition / biometric categorisation] on you.]",
"law": "EU AI Act (Reg 2024/1689) Art 50(1), (3), (4), (5), applies from 2 August 2026",
"clause": "We tell you when you are dealing with an AI system and when content is generated or altered by AI.{if ai_content_kinds} We label [ai_content_kinds] that AI generated or altered.{/if}{if ai_emotion} We tell you before we use [ai_emotion] on you.{/if}",
"vars": [
{
"name": "ai_content_kinds",
"type": "multi",
"label": "Which kinds of AI-generated or altered content do you label?",
"required": false,
"options": [
{
"value": "images",
"label": "Images",
"text": "images"
},
{
"value": "videos",
"label": "Videos",
"text": "videos"
},
{
"value": "audio",
"label": "Audio",
"text": "audio"
},
{
"value": "articles",
"label": "Articles",
"text": "articles"
}
],
"hint": "Leave blank if you publish no AI-generated or altered content."
},
{
"name": "ai_emotion",
"type": "multi",
"label": "Do you use emotion recognition or biometric categorisation on people?",
"required": false,
"options": [
{
"value": "emotion",
"label": "Emotion recognition",
"text": "emotion recognition"
},
{
"value": "categorisation",
"label": "Biometric categorisation, such as age or gender estimation",
"text": "biometric categorisation, such as age or gender estimation"
}
],
"hint": "Facial age estimation under purpose.identity-checks (age checks) is biometric categorisation."
}
],
"conditions": {
"is": {
"compliance.ai-transparency": "done"
}
},
"asks": {
"step": 11,
"q": "Do you tell people when they deal with AI or see content AI generated or altered?",
"why": "The AI Act requires people to be told, at the first interaction or exposure, that they are dealing with an AI system or AI-generated content.",
"links": {
"gdpr": "https://gdpr-info.eu/art-13-gdpr/",
"ico": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/"
}
},
"g16": "",
"file": "icons/governance.ai-transparency.svg"
}
]
}