Practical resources for SMEs | European Data Protection Board

Country

Austria

Formulare sind für Anträge, um Ihre Rechte nach der Datenschutz-Grundverordnung (DSGVO) auszuüben (DE)

PDF - Data subject rights forms

Meldungen von Verletzungen des Schutzes personenbezogener Daten (DE)

PDF - form to report a personal data breach by the controller itself. The form is not suitable for complaints.

Belgium

Als kmo omgaan met rechten van betrokkenen (NL)

PDF - GDPR brochure for SMEs
Boost het bewustzijn van de Belgische KMO’s en de naleving van de AVG, met speciale aandacht voor drie nalevingsthema’s

L'analyse d'impact relative à la protection des données (FR)

VIDEO - the Data Protection Impact Assessments (DPIAs)

La gestion des droits des personnes concernées dans les PME (FR)

PDF - Règlement général sur la protection des données (RGPD)

Le principe de transparence (FR)

VIDEO - on the topic of transparency

Les 2 grands rôles dans le traitement des données (FR)

VIDEO - the role of processor and controller

Rechten van de burger (NL)

VIDEO - Data Subject Rights

RGPD vade-mecum pour les PME (FR)

PDF - GDPR brochure for SMEs
Un guide pour préparer les petites et moyennes entreprises (PME) au Règlement général sur la protection des données

Bulgaria

Legal grounds for lawful personal data processing (EN)

PDF - Legal bases for data processing

Legal grounds for lawful personal data processing (EN)

PDF - Legal grounds for lawful personal data processing

Transfers of Personal Data to Third Countries (EN)

PDF - Transfers of Personal Data to Third Countries

Големи бази данни (Big Data) и свързаната с тях възможност за профилиране - брошура за администраторите на лични данни(BG)

PDF - Big Data and related profiling, brochure for data controllers

Големи бази данни (Big Data) и свързаната с тях възможност за профилиране - брошура за физическите лица (BG)

PDF - Big Data and related profiling capability, brochure for individuals

Десет практически стъпки за прилагане на Общия регламент относно защитата на данните (BG)

Brochures - 10 Practical Steps in Applying GDPR

Личните данни и тяхната защита: всичко за тях и как да ги пазиш - текст на информационно-разяснителна брошура, предназначена за деца (BG)

Website guide - Personal data and its protection: everything about them and how to keep it (text of an information and explanatory brochure intended for children)

Нови моменти относно правата на физическите лица съгласно Регламент (ЕС) 2016/679 (BG)

PDF - New elements of data subject rights under GDPR

Основания за законосъобразност на обработването на лични данни (BG)

PDF - Legal bases for data processing

Основания за законосъобразност на обработването на лични данни (BG)

PDF - Legal grounds for lawful personal data processing

Предаване на данни извън Европейския съюз (BG)

PDF - Transfers of Personal Data to Third Countries

Съвременни заплахи и предизвикателства пред защитата на личните данни в контекста на тенденциите в развитието на изкуствения интелект и новите технологии за лицево разпознаване (BG)

PDF - Contemporary threats and challenges to the protection of personal data in the context of trends in the development of artificial intelligence and new technologies for facial recognition

Cyprus

Form for lodging a complaint about receiving messages or calls for direct marketing (EN)

Docx - The Office of the Commissioner for Personal Data Protection form for lodging a complaint about receiving messages or calls for direct marketing

complaint_form_c_spam_cy.docx

Forms notification of data breaches (EN)

Docx - The Office of the Commissioner for Personal Data Protection forms for data breach notification

Record of processing activities (EN) (EL)

PDFs and xlsx - The Office of the Commissioner for Personal Data Protection guidelines and forms for record of processing activities available in Greek and English

Denmark

Datatilsynet template for the contract between data controller and processor (EN)

Docx - The Danish Data Protection Authority form contract between data controller and processor

Anmeld brud på persondatasikkerheden (DA)

Data Breach notification form - Er du selv dataansvarlig, kan du anmelde brud på persondatasikkerheden til Datatilsynet.

Datatilsynet skabelon til databehandleraftale (DA)

Docx - The Danish Data Protection Authority form contract between data controller and processor

Datatilsynet skabelon til en aftale vedrørende fælles dataansvar (DA)

Docx - The Danish Data Protection Authority template for joint data controllers

Datatilsynet skabeloner til oplysningspligt og indsigtsret (DA)

Docx - The Danish Data Protection Authority templates for meeting the obligation to provide information and the right of access

Datatilsynets liste over de typer af behandlingsaktiviteter, der er underlagt kravet om en konsekvensanalyse vedrørende databeskyttelse (DA)

PDF - List of types of data processing that always requires a DPIA

FAQ om databeskyttelse (DA)

FAQ on data protection

Har I styr på GDPR og håndteringen af personoplysninger? (DA)

Privacy compass - Online test: Introduction to personal data, 'Rights of data subjects'

Myter om GDPR (DA)

Myths about GDPR

Podcast om GDPR (DA)

Podcast on GDPR - In each episode, different employees from the Danish Data Protection Agency take on the role of host and talk about a topic that is particularly relevant for small and medium-sized

Estonia

Andmekaitse mõju hindamise juhend ja vorm (ET)

PDF - Data protection impact assessment’s guidance and form

dpia_form_ee.pdf

Andmekaitsealase mõjuhinnangu tegemise kontrollnimekiri (ET)

Checklist for DPIA

Andmekaitsetingimuste kontrollküsimustik (ET)

Checklist for privacy policy

Interaktiivne mall videovalve siltide jaoks (ET)

Website guideline - Interactive template for video surveillance signs

Isikuandmete töötleja üldjuhendi veebitekst (ET)

General Guidance for data controllers

Finland

Data Protection Tool (EN), (FI), (SW)

An online tool for SMEs to assess how they meet the requirements of the GDPR

France

Approbation des BCR : les différentes étapes (FR)

PDF - Approval of BCRs: the different stages infographic

Comprendre le RGPD (FR)

La certification (FR)

Website guide - What is certification? What products or services can be certified? What are the steps to get a certification mechanism approved?

Les notions clés du RGPD (FR)

Listes des traitements pour lesquels une AIPD est requise ou non (FR)

GDPR check-list for SMEs

Listes des traitements pour lesquels une AIPD est requise ou non (FR)

Website lists - Lists of processing operations for which a DPIA is required or not

PIA - an overview of the requirements and methodology

Infographic

Privacy Impact Assessment,PIA (EN)

DPIA guidelines, PIA Software and PIA Guides

Qu'est-ce qu'une donnée personnelle ? (FR)

Video - What is personal data

Record of processing activities (EN)

Website guide and Record model form

RGPD / GDPR : FAQ avec la CNIL (FR)

Video with Youtuber on how to apply the GDPR

RGPD : se préparer en 6 étapes

Transférer des données hors de l'UE (FR)

General information on international transfers

Germany

Auftragsverarbeitungsvertrag Muster (DE)

PDF - Contract template between data controller and processor.
By LfDI - Baden-Wuerttemberg

Auftragsverarbeitungsvertrag Muster (EN)

PDF - Contract template between data controller and processor.
By LfDI - Baden-Wuerttemberg

Checkliste zur Dokumentation der getroffenen technischen und organisatorischen Maßnahmen (DE)

Checklist of technical and organisational measures.
By LfD - Saxony-Anhalt DPA

Das Verfahren nach § 169 TKG (DE)

Website guide - Data protection for telecommunications.
By BfDI - Federal German DPA

Datenschutz beim Hochladen oder Einbinden von Videos auf Webseiten (DE)

Website guide - Data protection when uploading or embedding videos on websites.
By LfDI - Baden-Württemberg DPA

Datenschutz ist Chefsache! (DE)

PDF - Guidelines on Personal Data Protection.
By LfD - Saxony-Anhalt DPA

Datenschutz-Folgenabschätzung (DE)

Website guide - Data Protection Impact Assessment.
By BayLDA - Bavaria DPA

Datenschutz-Icons (DE)

PNG or SVG icons - Data protection icons.
By LfDI - Baden-Württemberg DPA

DS-GVo.clever (DE)

Online tool for SMEs to create data protection policies by Baden-Württemberg DPA

Education Center for Data Protection and Freedom of Information Baden-Württemberg, BIDIB (DE)

Trainings on data protection issues particularly for SME in our schooling center (Bildungszentrum BIDIB).
By LfDI - Baden-Württemberg DPA

FAQ zu Cookies und Tracking (DE)

Website guide - FAQ on cookies and tracking.
By LfDI - Baden-Württemberg DPA

Formulierungshilfe für eine Auskunft nach Art. 15 DS-GVO (DE)

DOCX - Template consent form.
By LfD - Saxony-Anhalt DPA

Formulierungshilfe für einen Auftragsverarbeitungsvertrag (DE)

Docx - Processing personal data template form.
By LDA - Brandenburg DPA

Formulierungshilfe für einen Auftragsverarbeitungsvertrag nach Art. 28 Abs. 3 DS-GVO (DE)

PDF - Template for the contract between data controller and processor.
By BayLDA - Bavaria DPA

Fragenkatalog für KMU zur Datenschutz-Grundverordnung (DE)

PDF - Questionnaire for SMEs on the GDPR.
By LfD - Saxony-Anhalt DPA

Für Verantwortliche: Datenpanne melden (DE)

Form to submit data breach notifications.
By LfDI - Baden-Wuerttemberg

Häufige Ursachen von Datenschutzverletzungen und Abwehmaßnahmen (DE)

PDF - Common causes of data breaches and countermeasures.
By LfD - Saxony-Anhalt DPA

Information über die Erhebung von personenbezogenen Daten nach Art. 13, 14 und 21 Datenschutz-Grundverordnung (DE)

PDF - Information on the collection of personal data in accordance with Articles 13, 14 and 21 of the General Data Protection Regulation - implementation aid for the data protection notices.
By LDI - North Rhine-Westphalia DPA

Informationen für kleine Unternehmen (DE)

Overview of the essential requirements for small companies are compiled as examples.
By BayLDA - Bavaria DPA

Informationen zu Meldungen von Datenschutzverstößen (DE)

Website guide - Information on data breach reports.
By BfDI - Federal German DPA

Informationen zur gemeinsamen Verantwortlichkeit nach Art. 26 Abs. 2 S. 2 der Datenschutz-Grundverordnung (DS-GVO) (DE)

DOCX - Form on joint responsibility.
By LfDI - Baden-Wuerttemberg DPA

Informationspflichten (DE)

Guideline on processing personal data.
By BayLDA - Bavaria DPA

Kurzpapiere (DE)

List of GDPR guidelines.
By the DSK - Datenschutzkonferenz, Conference of the Independent Data Protection Authorities of Germany

Meldung von Datenschutzverletzungen (DE)

PDF - Notification of data breach.
By LDA - Brandenburg DPA

Muster für Datenschutzhinweise für Websites nicht-öffentlicher Stellen (DE)

PDF - Template for data protection notices for websites of non-public bodies.
By LDI - North Rhine-Westphalia DPA

Muster für die Benennung von Datenschutzbeauftragten (DE)

DOCX - Template for the appointment of data protection officers
By LfD - Saxony-Anhalt DPA

Muster für die Geltendmachung von Betroffenenrechten (DE)

DOCX - templates for data subject rights, the creation of a list of processing activities or for a contract for order processing.
By BayLDA - Bavaria DPA

Online-Service zur Meldung einer Datenschutzverletzung nach Art. 33 DS-GVO (DE)

Online form for Data Breach notification.
By BayLDA - Bavaria DPA

Praxisratgeber - Bilder und Verein (DE)

PDF - Information about taking photos and video recording.
By BayLDA - Bavaria DPA

Richtlinien und Formular zum Schutz personenbezogener Daten (DE)

Guidelines and form on Personal Data Protection.
By LDA - Brandenburg DPA

Unsere Freiheiten: Daten nützen - Daten scützen (DE)

PDF - handout on data protection issues when taking photos.
By LfDI - Baden-Württemberg DPA

Verarbeitungsverzeichnis nach Artikel 30 DS-GVO (DE)

Sample processing directory according to Article 30 GDPR for those responsible and processors,
LDI - North Rhine-Westphalia DPA

Verarbeitungsverzeichnis nach Artikel 30 DS-GVO (DE)

List of processing operations pursuant to Article 30 of the GDPR.
By LDI - North Rhine-Westphalia DPA

Vertragsmuster-Art-26 (DE)

DOCX - Template for a joint controllership contract.
By LfDI - Baden-Wuerttemberg DPA

Vertragsmuster-Art-26 (EN)

DOCX - Template for a joint controllership contract.
By LfDI - Baden-Wuerttemberg DPA

Verzeichnis von Verarbeitungstätigkeiten, Art. 30 DS-GVO (DE)

PDF - List of processing activities, Art. 30 GDPR.
By LfDI - Baden-Württemberg DPA

Videoüberwachung (DE)

General overview plus template for video surveillance notice.
By BayLDA - Bavaria DPA

VV und Löschkonzept (DE)

XLXS - Template for records of processing activities.
By LfDI - Baden-Wuerttemberg

Widerruf einer Einwilligung gemäß Art. 7 Abs. 3 DS-GVO (DE)

DOCX - Withdrawal of consent template form.
By BayLDA - Bavaria DPA

Widerspruch gegen die Verarbeitung auf der Basis einer Interessenabwägung (Art. 6 Abs. 1 Satz 1 Buchstabe f DS-GVO) gemäß Art. 21 DS-GVO (DE)

DOCX - Right to object template form.
By BayLDA - Bavaria DPA

Wie geht Werbung datenschutzgerecht? (DE)

PDF - How does advertising work in accordance with data protection?
By LfD - Saxony-Anhalt DPA

Wie schützt man Datenträger gemäß Datenschutz-Grundverordnung? (DE)

PDF - How to protect data carriers according to GDPR.
By LfD - Saxony-Anhalt DPA

Greece

byDesign Guidance Documentation

Training programme and guidance documentation on data protection by design for the ICT sector developed in collaboration with University of Piraeus and the IT company, ICT Abovo.

GDPR Compliance Online Toolkit (EN)

Questionnaire - user-friendly Online Toolkit has been developed particularly tailored to the needs of the SMEs, facilitating GDPR compliance with a set of context-aware templates of essential documents.

Διαδικτυακό εργαλείο συμμόρφωσης με τον ΓΚΠΔ (EL)

Hungary

A GDPR egyszerűen kis- és középvállalkozások számára (HU)

PDF - user-friendly handbook offers guidance and practical suggestions for SMEs and it explains

Guidance for data protection authorities on setting up hotlines for SMEs (EN)

PDF - STAR Project: digital guidance for DPAs on good practices in running a hotline and raising SME awareness

Ireland

Guidance Note: GDPR Guidance for SMEs (EN)

PDF

Italy

Data Breach - Violazioni di dati personali (IT)

Guidelines on Data Breach and notification form

Il Responsabile della Protezione dei Dati, RDP (IT)

Guidelines and FAQ on the Data Protection Officer, DPO

Trasferimento di dati personali all'estero (IT)

Guidelines on international data transfers

Lithuania

Dėl Standartinių sutarčių sąlygų asmens duomenų tvarkymo sutartys

Online form - Template for the contract between data controller and processor

DUK. Kaip duomenų valdytojui informuoti apie vykdomą vaizdo stebėjimą informacinėje lentelėje? (LT)

PDF - Guideline for video surveillance notice.

Pavyzdinė poveikio duomenų apsaugai atlikimo forma (LT)

Word file - DPIA checklist or self-test forms or tools

Pavyzdinė poveikio duomenų apsaugai atlikimo forma (LT)

DOCX - Data Protection Impact Assessment (DPIA) form

pavyzd_pdav_forma.docx

Pranešimas apie Duomenų apsaugos pareigūną (LT)

DOCX - Template of Application for prior consultation

notification_to_the_state_data_protection_inspectorate_about_the_appointed_data_protection_officer_lt.docx

Prašymo suteikti / nutraukti išankstinę konsultaciją forma (LT)

DOCX - Template of Application for prior consultation

prior_consultations_lt.docx

PDF - Form for personal data breach notification

Rekomendaciją dėl duomenų tvarkymo veiklos įrašų (LT)

DOCX - Template Record of processing activities for data controllers and processors

Standard contractual clauses for the data processing agreement (EN)

DOCX - Form Standard contractual clauses for the data processing agreement

standard_contractual_clauses_for_the_data_processing_agreement.docx

Luxembourg

Data Accountability from A to Z. Online training for SMEs.

Data Accountability from A to Z (EN - FR)

Online training for SMEs based on real and practical examples on GDPR compliance developed by the National Commission for Data Protection of Luxemburg. The training has 4 levels, from basics to design, implementation and governance 2.0.

Data breach notification form (EN)

Docx - Form to notify a data breach

Déclaration du délégué à la protection des données (FR)

Docx - Data Protection Officer (DPO) form

Formulaire Consultation Prealable (FR)

Docx - Formulaire de demande de consultation préalable (DPIA)

GDPR-CARPA application form for accreditation (EN)

Docx - Form intended for organizations that want to apply for accreditation from the CNPD for delivering the GDPR-CARPA certification

Guide de mise en conformité au règlement général sur la protection des données (FR)

Website guide

Les mécanismes de certification en matière de protection des données (FR)

Data protection certification mechanisms guideline

Lignes directrices en matière de cookies et autres traceurs (FR)

Website guide, brochure ; dossier thématique

Your data protection obligations (EN)

PDF - Guide for businesses, public authorities and associations

Netherlands

Regelhulp Algemene verordening gegevensbescherming (NL)

Interactive questionnaire for organisations

Stappenplan: hoe bepaal ik als mkb’er of ik persoonsgegevens mag verwerken? (NL)

PDF - Step-by-step plan: how do I, as an SME, determine whether I may process personal data?

Waarom is privacy belangrijk (NL)

website guide - Why is privacy important?

Slovenia

Čezmejna kršitev varnosti (SL)

DOCX – Cross-border personal data breach

GDPR na kratko (SL)

PDF - GDPR at a glance infographic

Kaj (VSE) so osebni podaki (SI)

Infographic - What are personal data?

Kako so moji podatki varovani v delovnem razmerju? (SL)

PDF - Handbook for employees: How are data protected in employment?

Moji podatki, moja stvar - Priročnik za varstvo osebnih podatkov (SL)

PDF - "My data, my thing" MY DATA, Manual for personal protection
data

Neupravičeni vpogledi v Osebne podatke infografika (SL)

PDF - Unauthorised access to personal data infographic

Obrazec - Uradno obvestilo o kršitvi varnosti osebnih podatkov (člen 33 Splošne uredbe) (SL)

DOCX - Template for notification of a personal data breach (Article 33 of the GDPR)

Obrazec - Vloga za prenos osebnih podatkov v tretje države ali mednarodne organizacije (SL)

DOCX - Template for application for transfer of personal data to third countries or international organisations

Ocena učinka (dpia) je orodje za identifikacijo, analizo in zmanjševanje Tveganj glede nezakonitih ravnanj z osebnimi podatki, do katerih lahko pride pri Določenem projektu, sistemu ali uporabi tehnologije (SL)

PDF - Data Protection Impact Assessment (DPIA) relevance and recommendations infographic.

Pogodbena obdelava (SL)

Standard contractual clauses

Pogodbena obdelava osebnih podatkov (SL)

PDF - Infographic contractual processing

Prenos osebnih podatkov (op) v tretjo državo / mednarodno organizacijo v 2 korakih (SL)

PDF - Infographic on personal data transfer to third countries or international organisation in 2 steps

Prijava kršitev varnosti (SL)

PDF - Data breach notification infographic

Skupni Upravljavci (SL)

PDF - Joint controllers infographic

Smernice glede prenosa osebnih podatkov v tretje države in mednarodne organizacije po Splošni uredbi o varstvu podatkov (SL)

PDF - Guidelines on the transfer of personal data to third countries and international organisations

Smernice Informacijskega pooblaščenca o (pogodbeni) obdelavi osebnih podatkov (SL)

PDF - Guidelines on the contractual processing of personal data

Smernice Informacijskega pooblaščenca za oblikovanje izjave o varstvu osebnih podatkov na spletnih straneh (SL)

PDF - Guidelines about personal data protection statement on websites

Smernice ocene učinkov na varstvo osebnih podatkov (SL)

PDF - Guidelines for impact assessment on personal data protection

Smernice uporaba GPS sledilnih naprav in varstvo osebnih podatkov (SL)

PDF - Guideline for the use of GPS tracking devices and the protection of personal data

Spletna stran za pomoč majhnim in srednje velikim podjetjem (SL)

Website - Website to help small and medium-sized enterprises

Spletni obrazec za sporočanje pooblaščenih oseb za varstvo osebnih podatkov (DPO) (SL)

Online form for notifying Data Protection Officers (DPO)

Vi odločate o svojih podatkih - Priročnik o varstvu osebnih podatkov (SL)

PDF - Handbook on personal data protection "You decide about your data"

Vodič po pravicah posameznikov s področja varstva osebnih podatkov (SL)

Website - Guide to the rights of individuals in the field of personal data protection

Vzorec evidence dejavnosti obdelave za OBDELOVALCE (člen 30 Splošne uredbe) (SL)

DOCX - Model records of processing activities for processors (Article 30 of the GDPR)

Vzorec evidence dejavnosti obdelave za UPRAVLJAVCE (člen 30 Splošne uredbe) (SL)

DOCX - Model records of processing activities for controllers (Article 30 of the GDPR)

Vzorec obvestila posameznikom glede obdelave osebnih podatkov (člen 13 Splošne uredbe) (SL)

DOCX - Model notice to individuals concerning the processing of personal data (Article 13 of the GDPR)

Spain

Asesora Brecha (ES), (EN)

Website guide - Tool to assess the obligation to notify the DPA about a personal data breach

Checklist for determining the formal adequacy of an DPIA and the submission of prior consultation (EN)

DOCX

Comunica-Brecha RGPD (ES)

Website guide - Tool to help controllers assess next steps following a data breach and data subjects rights obligation to communicate

Cumple con la normativa y #Protege sus datos (ES)

PDF - Infographic on resources to help comply with the GDPR

Decálogo de recursos de ayuda de la AEPD (ES)

Website guide - AEPD Catalogue on aid resources

Directrices para la elaboración de contratos entre responsables y encargados del tratamiento (ES)

PDF - Guidelines for the preparation of contracts between controllers and processors

Evalúa-Riesgo RGPD (EN)

Online tool for controllers and processors to assess the need of Data Protection Impact Assessment (DPIA) and risk management on personal data

Facilita EMPRENDE (ES)

Webguide site - Tool to supports entrepreneurs and start-ups with data processings

Facilita RGPD (ES)

Step by step questionnaire for organisations

Guía del Reglamento General de Protección de Datos para responsables de tratamiento (ES)

PDF - Guidelines for data controllers on GDPR

Guía para el cumplimiento del deber de informar

PDF - Guidelines on the duty to inform

Guidelines on personal data breach notification (EN)

PDF - Guidelines on personal data breach management and notification

Innovation and Technology (EN)

Web guide - resources and tools to promote compliance with the RGPD, focusing attention on supporting SMEs and entrepreneurs

Modelo de claúsula para contratos de encarga dos del tratamiento (ES)

PDF - Template clauses for data processor contracts

Personal data breach notification form (EN)

PDF - Template for data breach notification

Template data protection impact assessment report, DPIA (EN)

DOCX - Template for data protection impact assessment report (DPIA) for private sector

EDPS

Data Protection Impact Assessment in a nutshell (EN)

PDF - Data Protection Impact Assessment

EEA

Liechtenstein

GDPR Für Unternehmen (DE)

Online guide - GDPR for companies

Muster und Checklisten (DE)

PDF and DOCX - Templates for requests for information, privacy policy, consent, contract for order processing, joint responsibility agreement and record of processing activities, etc.

Norway

Dine rettigheter (NO)

Website guide - Overview of all the rights you have under the privacy regulations when information about you is collected and used

Ordliste (NO)

Glossary with key concepts

Registrering av personvernombud (NO)

Website guide - Information on the data protection officer registration

Sjekkliste for bedrifter (NO)

Checklist for business - You have a business and need to make sure you follow the privacy policy. What do you need to do to preserve the personal data of customers, users, members and your own employees?

SMEData

GDPR in Your Pocket (BG, DE, FR, IT)

mobile app available on Google Play Store and Apple App Store. The GDPR explained for citizens and SMEs, practical knowledge, advice on their rights and obligations under the EU data protection law.