The GDPR, mapped to the work it asks of you.
The GDPR applies to any company handling personal data of people in the EU, wherever it is based. Privacyboard turns each of its duties into a screen, drafted from the tools you already use.
Free to set up · No credit card · Checked 12 November 2026
In short
- Applies to
- EU companies, and companies elsewhere serving or tracking people in the EU
- Maximum fine
- EUR 20 million or 4% of worldwide turnover
- Deadlines
- 1 month per request, 72 hours per breach
- In Privacyboard
- Free to start, DPIAs and TIAs on Pro
What the GDPR asks, and where it lives
Pick a duty to see the screen that handles it.
What the law asks
A written list of what you do with personal data, why, and for how long.
In Privacyboard
Activities suggested from your tools, prefilled, with what is missing flagged.
Every planExports on Business
Show all 8 duties as a list
Art. 30Keep a record of processingEvery plan
What the law asks: A written list of what you do with personal data, why, and for how long.
In Privacyboard: Activities suggested from your tools, prefilled, with what is missing flagged. Exports on Business.
Art. 13–14Tell people what you doEvery plan
What the law asks: A privacy notice: purposes, legal bases, recipients, retention, rights.
In Privacyboard: Drafted from your register and vendors, flagged when a tool changes.
Art. 12, 15–22Answer requests within a monthEvery plan
What the law asks: Access, erasure and other rights, answered within one month.
In Privacyboard: Deadline counted, identity check, reply templates, reminders. Request form on Pro.
Art. 28Put processors under contractEvery plan
What the law asks: A data processing agreement with every provider handling data for you.
In Privacyboard: Each vendor comes with its role, region and agreement link. DPA for your clients on Pro.
Art. 33–34Report breaches in 72 hoursEvery plan
What the law asks: Notify the authority within 72 hours when people are at risk.
In Privacyboard: A 72-hour countdown, who to notify, and the record of every incident.
Art. 35Assess high-risk processingEvery plan
What the law asks: A DPIA before processing likely to put people at high risk.
In Privacyboard: Every activity screened. Complete DPIAs prefilled from your register. Complete DPIAs on Pro.
Art. 44–49Protect data leaving the EEAEvery plan
What the law asks: A legal tool for each transfer outside the EEA.
In Privacyboard: Transfers flagged per vendor, with the tool they rely on. TIAs on Pro.
Art. 5(2)Be able to show itBusiness
What the law asks: Accountability: you must be able to prove compliance.
In Privacyboard: Versioned documents, and an evidence pack in one dated file.
The numbers to know
or 4% of worldwide turnover, the top fine
to report a breach to the authority
to answer a request, extendable by two
Fines are set case by case. The deadlines apply to everyone.
What Privacyboard covers, and what it does not
Covered
- Processing register, suggested from your tools
- Privacy policy kept in step with your records
- Requests with deadlines and reply templates
- Vendors with roles, regions and agreements
- Breach register with the 72-hour countdown
- DPIA and transfer screening
- A public privacy center
Not covered
- Acting as your data protection officer
- Putting security measures in place in your systems
- Finding personal data inside your databases
Privacyboard is a guidance tool, not legal advice.
Your first hour
- 1
Enter your website
Your company and tools are prefilled.
- 2
Confirm your vendors
Activities are suggested from them.
- 3
Validate your policy
Only validated versions go public.
- 4
Publish your center
Deadlines then come to you by email.
Go online for free. Grow when you need to.
Free puts you online. Pro adds requests, monitoring and your team; Business, security questionnaires and only your brand.
Free
$0 forever
No card, no time limit
For getting compliant and going online on your own.
Start for freeKey features:
- Privacy and cookie policies
- Vendor and processing registers
- Requests and breaches tracked
- Impact assessment screening
- AI Act screening
- Privacy center on privacyboard.io
- Cookie banner on 1 domain
- 1 person
- And 1 more on the pricing page
No card needed
ProRecommended
$20 per month
Billed $240 a year Save $48
For founders who want to be compliant in a few clicks and stay that way.
Start with ProEverything in Free, plus:
- DPA for your clients
- Vendor monitoring
- Reminders for documents and reviews
- Request form and replies
- Your own domain
- Banner on 3 domains, every choice logged
- Weekly site scan
- Complete DPIAs and TIAs
- AI assistant connector
- 2 people
- And 1 more on the pricing page
Cancel any time
Business
$109 per month
Billed $1,308 a year Save $240
For the person in charge of privacy: every detail in order, a team with roles, and proof for audits and customers.
Start with BusinessEverything in Pro, plus:
- Up to 50 people, with roles
- PDF and Excel exports
- Signed agreements on vendors
- Activity log kept 3 years
- Security questionnaires answered for you
- No Privacyboard mention
- Center in English and French
- Evidence pack in one click
- Banner on 10 domains, daily scan
- Two-step verification required
- And 3 more on the pricing page
Bank transfer on request
Questions, answered.
Does the GDPR apply outside the EU?
Yes, if you offer goods or services to people in the EU or monitor them there (Article 3(2)).
Does a small company need a record of processing?
Usually. Today the exemption under 250 employees only covers occasional, low-risk processing. A change raising it to 1,000 employees awaits the European Parliament’s vote.
Is Privacyboard enough to be compliant?
No tool is. Privacyboard drafts and tracks the paperwork; what you do with data stays your responsibility.
Do we need a DPIA for everything?
No, only for processing likely to put people at high risk. Privacyboard tells you which ones.
Official sources
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
- EDPB, data protection guide for small business
- Omnibus IV procedure 2025/0130(COD)
Checked on 12 November 2026. Laws and guidance change: read the official text before you rely on a figure.
Read more
Guides on the blog
- Do you need a data protection officer? The three triggers in Article 3711 min read
- When do you need a DPIA? GDPR Article 35 with a small-business example9 min read
- Legitimate interests under the GDPR: how to run the three-part test8 min read
- GDPR fines in numbers: what regulators have actually imposed9 min read
- How to choose privacy software for a small business: 9 questions to ask9 min read
- Data breach notification templates: authority and customer messages8 min read