The Dutch Personal Data Authority (AP) has published practical templates aimed at small and medium-sized enterprises to facilitate their compliance with data protection rules.

The authority has made available a template for the record of processing activities and a privacy statement template. This initiative responds to the request of entrepreneurs who found the regulatory burden of the GDPR high and wanted ready-to-use tools. These documents are the result of prior consultations with the Ministry of Economic Affairs and Climate and the MKB-Netherlands organization. The templates contain examples for ten sectors, including education, hospitality, retail, and health, which companies can adapt to their specific needs.

The record of processing activities allows documenting the personal data processed, which is useful for managing data subject rights, drafting subcontracting contracts, and responding in case of a data breach. The privacy statement aims to clearly inform customers about the use of their data and their rights in this regard. It is also mentioned that a proposal from the European Commission could in the future limit the obligation to maintain such a record to only processing activities presenting a high risk to privacy.