Website Data Protection Pack
Compliance services · GDPR Articles 28, 30 and 35
The website is the one system your data protection officer does not own.
Every form, embed and analytics tool on your site is processing personal data, and it all has to appear in your record of processing, your sub-processor list and, where the risk warrants it, a data protection impact assessment. We already know what runs on your site. We write it down in the form your DPO needs.
What we deliver
We inventory every point at which the website collects or transmits personal data: forms, newsletter signups, embedded video, maps, analytics, chat, fonts served from third parties, and the hosting stack itself. For each we document the purpose, the data, the lawful basis, the retention and the recipient. Where a third party receives data we identify it, its location and its safeguards. Where the processing is likely to carry higher risk we prepare a data protection impact assessment for your DPO to adopt.
01
What you receive
Three documents. Record of processing entries for the website, in the Article 30 format, ready to drop into your organisation’s register. A named sub-processor list for the website, with roles and locations, which is also the list your Article 28 agreement with us refers to. A DPIA for the site, where one is prudent, structured to the Article 35 headings. On Premium and Custom the sub-processor list is kept current as part of the plan.
02
Why it exists
The most common request in a supplier due-diligence exercise is the sub-processor list. The second is evidence that the website’s processing has been thought about at all. Both are usually answered from memory. This service answers them from a document.
03
All prices ex VAT. We are not a law firm and do not give legal advice. The documents are prepared for your data protection officer to review and adopt; responsibility for the register remains with the controller.