Privacy notice & data retention

1. Do we need a special privacy notice for all kinds of contact sources (website, email, etc..) or is one enough?

If the personal data collected and the purpose for which it is used are the same you can have just one privacy notice. However, within the notice, you need to mention what are the sources from where you collect the personal data.

2. In the Data Retention Policy - are the retention periods defined within this document?

Retention periods are usually mentioned in local laws such as Tax Law or Labor Law. If you cannot find a retention period is local laws you can establish them yourself taking into account the data minimization principle.

3. In the Inventory of Processing Activities - are there some examples of those processing activities given, or is this maybe covered with the email support - for example, if we ask the expert to give advice for that?

The Inventory of Processing Activates in the GDPR Documentation Toolkit has some comments embedded to help you understand what you need to fill in. Also, there is also a guidance document included in the toolkit. If you decide to purchase the toolkit, depending on the version you buy, you get also some consultancy hours as well as documents reviewed by our experts. More details on the GDPR toolkits may be found at https://advisera.com/eugdpracademy/pricing/ Just click on “See details”.

4. What is the maximum amount of time to respond to data subject requests?

The standard response time to a request is one month however if the request is complex the deadline can be prolonged by 2 more months.