PrivacyBuilt / Knowledge
Governance models & templates
Working documents, not tick-box assurance. Download, adapt and approve in your own environment.
PrivacyBuilt Editorial · Reference edition 3 November 2026
DSAR / CSV + Markdown
Record of processing activities
An activity-led working register with recipients, transfers, retention and control evidence.
Use one row per processing activity. Confirm Article 30 fields for your role and any applicable exceptions. Add contact details, joint-controller or representative details where required. Do not place real personal records in this register.
AI / Markdown
AI system model card
Capture intended use, data boundaries, evaluations, limitations and accountable oversight.
Use this system-level record alongside provider model documentation, not as a substitute for an impact assessment or applicable legal technical documentation.
AI / CSV + Markdown
AI risk register
Track harms to people, evidence, mitigations and owned residual-risk decisions.
Describe concrete harms and evidence. Do not invent numerical scores without a defined method. Approval does not override a legal restriction.
Global / Markdown
Website privacy notice model
A drafting structure for an accurate, accessible notice tied to actual processing.
Adapt every section to actual practices, roles and laws. This is a drafting framework, not a ready-to-publish legal notice; never keep placeholder claims about cookies, transfers or lawful bases.
Global / Markdown
Internal data handling standard
Define classifications, approved channels, access, AI inputs and disposal expectations.
Obtain security, privacy and business approval. Use real internal contacts and approved systems before adoption. Avoid inserting real personal information into this template.
Breach / Markdown
Incident response escalation tree
Coordinate security, privacy, legal, suppliers and communications without a universal breach clock.
Populate contacts and backups, test out-of-hours reachability and validate applicable reporting triggers. Internal targets do not replace legal deadlines.
Retention / CSV + Markdown
Retention and disposal schedule
Purpose-led sample record families with unfilled periods for local validation.
There are no prefilled statutory retention periods. Validate legal duties, business necessity, holds and backup treatment per record family.
DSAR / CSV + Markdown
Individual-rights request log
Record clocks, proportional identity checks, system searches and secure delivery evidence.
Keep this case register restricted and use case IDs, not sensitive identifiers, in general reporting. Determine the clock under the applicable law; calendar months are not fixed 30-day periods.
Transfers / CSV + Markdown
Transfer assessment worksheet
Capture each data flow, legal route, destination evidence and safeguard effectiveness.
Use one row per transfer. Escalate uncertain law and practice; do not proceed on SCC signatures alone where protection cannot be made effective.