Templates we use in active engagements, made available for organisations building these capabilities themselves. Three core templates — Records of Processing Activities, Data Protection Impact Assessment, and Personal Data Breach Response Playbook — are downloadable below with substantial inline preview content. Eight supporting templates are catalogued in the ledger. These are starting points, not regulatory compliance guarantees: substantive compliance depends on accurate population, ongoing maintenance, and the underlying processing being genuinely lawful. Adapt to your organisation; engage qualified support where the stakes warrant it.
| Template ID | Template | Format | Regimes | Status |
|---|---|---|---|---|
| VTX-PRV-TPL-RoPA | Records of Processing Activities Master register of all processing activities | .md |
All applicable | Available |
| VTX-PRV-TPL-DPIA | Data Protection Impact Assessment 7-step DPIA methodology with risk matrix | .md |
GDPR · DIFC · ADGM · DPDP · PDPL | Available |
| VTX-PRV-TPL-Breach | Breach Response Playbook 5-phase incident response with regulator notification | .md |
All applicable · multi-regime | Available |
| VTX-PRV-TPL-DPA | Data Processing Agreement Multi-regime DPA template with sub-processor regime | .md |
GDPR · DIFC · ADGM · PDPL | In preparation |
| VTX-PRV-TPL-PrivNotice | Privacy Notice Customer-facing privacy notice with regime variants | .md |
All applicable | In preparation |
| VTX-PRV-TPL-Consent | Consent Notice Affirmative consent capture with audit trail structure | .md |
DPDP · PDPL · DIFC · ADGM | In preparation |
| VTX-PRV-TPL-VendorAssess | Vendor Privacy & Security Assessment Tier-based vendor due diligence questionnaire | .md |
All applicable | In preparation |
| VTX-PRV-TPL-DSAR | DSAR Workflow Data subject access request workflow with timelines | .md |
All applicable | In preparation |
| VTX-PRV-TPL-Retention | Retention Schedule Records management retention schedule by data category | .md |
All applicable · sectoral overlays | In preparation |
| VTX-PRV-TPL-TIA | Transfer Impact Assessment Cross-border transfer risk assessment template | .md |
GDPR · DIFC · ADGM · PDPL | In preparation |
| VTX-PRV-TPL-Training | Privacy Awareness Training Plan Role-specific training programme with refresh cadence | .md |
All applicable | In preparation |
A RoPA is the inventory of processing activities required by every major privacy regulation. One row per processing activity, with sufficient detail to satisfy auditor scrutiny under any applicable regime. The template captures the full structure of a per-activity record including lawful basis per regime, cross-border transfer specifics, retention rationale, security measures, and DPIA linkage. Designed as a living document maintained quarterly — not a one-time exercise.
| Dimension | What it means in audit context |
|---|---|
| Completeness | Does every actual processing activity appear in the register? Activities operating off-register are a frequent finding. |
| Currency | Are records current with recent review dates? Dormant registers signal absence of operating discipline. |
| Lawful basis specificity | Is the cited lawful basis genuinely the right one for the processing — or generic? |
| Cross-border accuracy | Do international transfer records match what is actually happening operationally? |
| DPIA linkage | For high-risk activities, is the DPIA referenced and is the residual risk genuinely acceptable? |
| Retention defensibility | Are retention periods supported by stated rationale or statutory citation? |
Required where processing is likely to result in high risk to data subjects' rights and freedoms — large-scale sensitive data, systematic monitoring, automated decision-making, children's data at scale, novel technology including AI. The template walks through identification, necessity and proportionality, risk identification, risk scoring on a 5×5 matrix, mitigation measures, residual risk acceptance, and approval workflow. Designed for substantive risk analysis, not tick-box compliance.
Action thresholds: Low (1—4) document only · Medium (5—9) mitigation required · High (10—14) substantial mitigation + senior approval to accept residual · Critical (15—25) cannot proceed without remediation OR explicit DPO + executive + regulator approval.
Different from a breach response plan — a playbook is action-oriented, organised by phase, and designed to be usable under incident pressure. Five phases cover detection through lessons-learned. Includes regulator notification matrices for all major regimes (GDPR/DIFC/ADGM/UAE PDPL/KSA PDPL/DPDP), pre-drafted communication templates for regulator and data subject notification, severity classification, and tabletop exercise programme. The 72-hour clock starts on awareness — the playbook is built around that operational reality.
Confirm incident, characterise scope, start regulatory clock if applicable. 10-action checklist with triage decision tree.
Stop the incident, characterise precise scope and severity, classify (Severe/Significant/Limited), prepare regulator notification.
Regulator notifications per applicable regime, data subject notification where required, external communications discipline.
System restoration, vulnerability remediation, affected-subject support, regulator follow-up management.
Post-incident review, root cause analysis, corrective actions tracked to closure, playbook update, executive briefing.
| Regime | Authority | Deadline | Channel |
|---|---|---|---|
| GDPR | Lead supervisory authority | 72 hours from awareness | Authority-specific portal |
| DIFC DP Law | DIFC Commissioner | 72 hours from awareness | DIFC Commissioner portal |
| ADGM DP Regs | ADGM Office of Data Protection | 72 hours from awareness | ADGM portal |
| UAE Federal PDPL | UAE Data Office | Without undue delay (Executive Regs) | UAE Data Office channel |
| KSA PDPL | SDAIA | 72 hours from awareness | NDGP notification channel |
| DPDP Act | Data Protection Board of India | Prompt initial; detailed report 72hr | DPB notification channel |
Critical principle: multi-regime entities must notify each applicable regulator separately. The 72-hour clock starts on awareness of the breach, not on confirmation. When in doubt, start the clock — late notification is materially worse than early notification of an event that turns out to be non-reportable.
Additional governance templates that round out a complete privacy operating system. These are catalogued for transparency and will be released through the year as we finalise the institutional versions. Engagement clients receive these directly as part of project work; standalone availability follows.
Multi-regime DPA template with sub-processor regime, audit rights, breach notification SLAs, and return/deletion mechanics calibrated for organisations subject to two or more regimes simultaneously.
Customer-facing privacy notice with regime-specific variants (Federal PDPL Arabic, DIFC GDPR-aligned, ADGM, KSA Arabic, DPDP English plus 22 scheduled languages framework).
Affirmative consent capture with audit trail structure. Granular per-purpose consent, withdrawal mechanism specification, demonstrability evidence requirements per regime.
Tier-based vendor due diligence questionnaire covering processor obligations, security posture, sub-processor regime, breach notification capability, audit rights, residency.
Data subject access request workflow with response timelines per regime (14-day Federal PDPL, 30-day DIFC/ADGM, 30-day GDPR), identity verification protocols, exemption analysis.
Records management retention schedule by data category with sectoral overlay accommodation (banking 5+ years, healthcare records, employment, KYC). Backup retention alignment guidance.
Cross-border transfer risk assessment template. Destination country legal framework analysis, recipient safeguards, residual risk evaluation, supplementary measures specification.
Role-specific training programme with refresh cadence, comprehension assessment, completion records discipline. Tracks to accountability evidence under all major regimes.
Each template provides a credible structural foundation calibrated to regulatory expectations. Substantive compliance depends on accurate population to reflect your actual operations, ongoing maintenance against changing regulations and processing, and the underlying processing being genuinely lawful. Templates do not substitute for qualified legal advice on specific situations, regulator-engagement protocols, or the substantive privacy programme that gives the templates operational meaning. Where the stakes warrant it — large data subject populations, sensitive categories, active enforcement context, multi-regime exposure — engage qualified support to validate the population and operating effectiveness.
A template populated quickly and never maintained is worse than no template at all — it provides false comfort while documenting actual gaps. If you need substantive support populating these templates against your specific operations, validating the result against active regulatory expectations, or building the broader privacy programme they are designed to live within, a 30-minute scoping call costs nothing.
Schedule a call