The Data Protection Policy is an internal document of the organization that serves as the basis for the organization's operations and practices. The document defines the data protection requirements for employees and commits the organization to complying with the data protection requirements.

Data Protection by Design Documentation helps organizations meet GDPR requirements and protect the rights of data subjects by pushing them to consider data privacy and protection at the start and throughout the data lifecycle.

DPO is an expert within the organisation, who monitors the processing of personal data and provides advice on compliance with data protection regulations. The tasks undertaken by the DPO are instrumental in establishing a strong privacy program. DPO is compulsory in case the controller is a public authority or body (except courts), the controller is monitoring individuals on a large scale and when controller is processing sensitive data.

ROPA identifies what information is processed by the organisation, in what systems, for what purposes and based on what legal bases. ROPA also include the list of other parties and agreements with them to ensure security of processed data. A good ROPA removes a lot of challenges in privacy compliance, as it constitutes a springboard to the fulfilment of other privacy tasks.

The Data Retention Policy and the description of the retention periods determine how long the personal data will be retained and how they will be deleted at the end of the retention time. That document shall also specify how the personal data will be stored, how the need for the storage of the data will be assessed, where the personal data will be stored and who will be responsible for carrying out the deletion process.

A Information Security Policy defines how personal information is protected in an organization. The Information Security Policy also defines the level of security that the organization requires from those who assist in the processing of personal data. Maintaining security requires both technical and organizational security measures: examples of technical security measures include strong encryption, firewalls and virus systems, and examples of organizational security measures include limited access rights to personal data, intrusion prevention exercises and regular training for employees.

The purpose of the Data Processing Agreement is to ensure the level of data protection of the processing of personal data. That agreement may specify the conditions for the processing of personal data by the parties.

Data Processing Agreement Tracker helps an organization monitor the flow of information to ther parties. The tracker shall always be updated with the newest information and include such information as a full name of the counterparties, what agreements have been concluded (when and by whom) and description about personal data processing.

Transfer mechanism allows organisation to provide adequate level of protection to personal data which is transferred outside the EU/EEA. According to GDPR, every transfer outside EU/EEA must have a basis for transfer as specified in Chapter V of the GDPR and the processing of personal data must be permitted in the specific situation.

Transfer Impact Assessment is a process to reassess the appropriateness of the transfer mechanisms for transferring personal data outside the EU/EEA. The effectiveness of the basis for transfer and the need for supplementary safeguards must be assessed on a case-by-case basis.Transfer impact assessment shall be done from time to time to update the transfer mechanisms where needed and in some cases to update the agreements with certain counterparties.

Data Breach Documenation is a fundamental document which establishes a step-by-step action plan in case of a data breach. It stipulates the necessary notifications, breach assessment process, time frame for actions and clarifies the roles in handling the data breaches.

Into the Data Breach Tracker shall record a general description of the breach, the outcome of the assessment, the level of risk of the breach, the time of the assessment and any notifications to data subjects or the supervisory authority.

Data Breach Assessment Template is a ready form, which ease up the assessment of every separate breach. This template shall include sections about the description of the breach, stakeholders, timeline of the breach, data breach risk class and actions taken to mitigate it.

Data Subject Request Documentation defines how the organisation reacts to individuals’ requests to access, correct, delete the data or when the individuals object to processing. Data subject can be anyone whose personal data you are processing: employees, clients, consumers, citizens, individuals.

Data Subject Request Tracker is a log of all requests received from the individuals. The Tracker helps to manage and demonstrate that data subjects' requests are responded to without undue delay and what kind of requests have been processed and executed.

Data Protection Statement for customers is usually published on the organisation’s website. Data Protection Statement explains, among other things, what personal data about the data subjects are processed and why, the contact details of the data controller, the data subject's rights and how to react to data breaches.

Data Protection Statement for employees is an internal document describing how the employer processing personal data of the employees. Usually, the reference to such document is made in the employment contract.

Cookie Statement indicates to anyone visiting organisation’s website that the web page is installing cookies or other tracking technologies. Cookie Statement shall inform about the types of cookies used, how they work and how an individual can manage his/her preferences (how to switch on/off the cookies).

Risk Assessment Documentation defines how and in which situations data protection risks are assessed. The documentation recommeds defining also the roles and practices responsible for risk assessment to implement control measures for the identified risks.

DPIA is carried out when the processing of personal data may cause a high risks to the rights and freedoms of data subjects. DPIAs are required to be held in case the controller is processing special categories of personal data on a large scale; also, if the organisation carries out a systematic and extensive evaluation of personal aspects relating to natural persons that is based on automated processing; or the organisation is systematically monitoring publicly accessible areas on a large scale.

Balancing Test is an assessment which is aimed at defining whether legitimate interest of the organisation / other parties can be used as a legal basis for processing. Legitimate interest is balanced against the rights and interests of the individuals. Balancing tests shall be carries out for every processing which is reliant on legitimate interest as a legal basis.

Consent Management Documentation is a document that identifies the matters related to processing based on individuals’ consent. This documentation shall establish a clear mechanism to collect and store the proof of freely given, unambiguous and explicit consent, demonstrated by the affirmative action of individuals.

Data Protection Training and Awareness Plan is an action plan used to educate the employees about privacy and data protection framework within organisation. This plan shall be attached to a calendar with deadlines and contain the list of departments which will go through / had gone through the trainings.

Annual Report is fundamental document that summarizes all tasks and subtasks successfully fulfilled / failed / cancelled / postponed in data protection and privacy during the passing year. Annual Report also serves as a basis for creating an Annual Plan for the upcoming year.