GDPR Compliance Statement: What to Include and How to Write One

A GDPR compliance statement is a formal declaration that explains how an organisation meets its obligations under the General Data Protection Regulation. For any business that processes personal data of individuals in the European Union or European Economic Area, having a clear and accurate GDPR compliance statement is not just good practice. It is a direct response to the accountability principle embedded in the regulation itself.

This guide walks through what a GDPR compliance statement should contain, how it differs from a privacy policy, and the practical steps for creating one that holds up under regulatory scrutiny. This is educational content, not legal advice. Consult a qualified attorney for guidance specific to your organisation.

A GDPR compliance statement is a document in which an organisation declares its commitment to complying with the General Data Protection Regulation and describes the specific measures it has implemented to achieve that compliance. It serves both an internal purpose (guiding staff and establishing accountability structures) and an external purpose (demonstrating to customers, partners, and regulators that the organisation takes data protection seriously).

The GDPR itself does not mandate a document with this exact title. What it does require, under Article 5(2), is that controllers be able to demonstrate compliance with the data protection principles set out in Article 5(1). These principles include lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability.

A GDPR compliance statement is the most direct way to meet this demonstration requirement. It consolidates your data protection commitments, policies, and procedures into a single reference document that can be presented to:

Supervisory authorities during audits or investigations
Business partners as part of due diligence for data processing agreements
Customers who want assurance that their data is handled responsibly
Internal teams who need to understand their data protection responsibilities

Without a clear statement of compliance, organisations risk being unable to satisfy the accountability burden when regulators come asking.

These two documents are related but serve different purposes. Understanding the distinction helps ensure you have both bases covered.

Privacy Policy

A privacy policy is a public-facing document directed at individuals whose data you process. Articles 13 and 14 of the GDPR require that you provide specific information to data subjects, including:

The identity and contact details of the controller
The purposes and legal basis for processing
Categories of personal data collected
Recipients or categories of recipients
Retention periods
Data subject rights (access, rectification, erasure, portability, objection)
Whether data is transferred outside the EEA

A privacy policy fulfils the GDPR's transparency requirements. You can create one using a privacy policy generator as a starting point, then tailor it to your specific processing activities.

A GDPR compliance statement is broader in scope. While it may reference or incorporate privacy policy content, it also covers:

Internal governance structures and data protection roles
Technical and organisational security measures
Staff training programmes
Data breach detection and response procedures
Data Protection Impact Assessment processes
Records of processing activities
Processor and sub-processor management
International data transfer mechanisms

Think of the privacy policy as the "what we do with your data" document for individuals, and the compliance statement as the "how we run our data protection programme" document for regulators and partners.

A comprehensive GDPR compliance statement addresses each of the regulation's core requirements. The following sections represent the minimum content that most organisations should include.

Organisational Commitment

Open with a clear declaration that the organisation is committed to protecting personal data and complying with the GDPR. Name the responsible parties: the data controller (your organisation), the Data Protection Officer if one has been appointed (required under Article 37 for public authorities, organisations engaged in large-scale systematic monitoring, or those processing special categories of data at scale), and the supervisory authority you report to.

Lawful Basis for Processing

Article 6 of the GDPR requires that every processing activity has a valid legal basis. Your compliance statement should identify the legal bases you rely on:

Consent (Article 6(1)(a)): The data subject has given clear, informed consent
Contract (Article 6(1)(b)): Processing is necessary to perform or prepare a contract
Legal obligation (Article 6(1)(c)): Processing is required by law
Vital interests (Article 6(1)(d)): Processing is necessary to protect someone's life
Public task (Article 6(1)(e)): Processing is necessary for a task in the public interest
Legitimate interests (Article 6(1)(f)): Processing is necessary for legitimate interests, provided these are not overridden by the individual's rights

For each category of data processing your organisation performs, the statement should specify which legal basis applies.

Data Subject Rights

The GDPR grants individuals a set of rights over their personal data. Your compliance statement should confirm that your organisation honours these rights and describe how individuals can exercise them:

Right of access (Article 15): Individuals can request a copy of their personal data
Right to rectification (Article 16): Individuals can request correction of inaccurate data
Right to erasure (Article 17): Individuals can request deletion of their data in certain circumstances
Right to restriction (Article 18): Individuals can request that processing be limited
Right to data portability (Article 20): Individuals can receive their data in a structured, machine-readable format
Right to object (Article 21): Individuals can object to processing based on legitimate interests or direct marketing
Rights related to automated decision-making (Article 22): Individuals can request human intervention in decisions made solely by automated means

Specify the process for submitting requests (email address, web form, postal address) and confirm that you respond within the one-month timeframe required by Article 12(3).

Technical and Organisational Measures

Article 32 of the GDPR requires controllers and processors to implement appropriate technical and organisational security measures. Your compliance statement should describe the safeguards you have in place, without revealing enough technical detail to create security vulnerabilities.

Common measures to document include:

Encryption of personal data at rest and in transit
Access controls limiting data access to authorised personnel on a need-to-know basis
Pseudonymisation where feasible to reduce risk
Regular security testing including vulnerability assessments and penetration testing
Backup and recovery procedures to ensure data availability
Physical security of servers and workstations
Incident monitoring systems to detect unauthorised access or breaches

Data Breach Procedures

Under Articles 33 and 34 of the GDPR, controllers must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. If the breach poses a high risk, affected individuals must also be notified without undue delay.

Your compliance statement should outline:

How breaches are detected and reported internally
The escalation process and responsible personnel
How the 72-hour notification deadline is tracked
The criteria for determining whether individual notification is required
How breach records are maintained (required by Article 33(5) regardless of whether notification is triggered)

International Data Transfers

If your organisation transfers personal data outside the EEA, Chapter V of the GDPR requires appropriate safeguards. Your compliance statement should identify:

Which transfers occur and to which countries
The transfer mechanism used (adequacy decision under Article 45, Standard Contractual Clauses under Article 46(2)(c), Binding Corporate Rules under Article 47, or a derogation under Article 49)
How transfer impact assessments are conducted following the Schrems II ruling

Data Retention

Article 5(1)(e) of the GDPR requires that personal data be kept no longer than necessary for its stated purpose. Your compliance statement should reference your data retention schedule and explain how retention periods are determined for different categories of data.

Processor Management

If you use third-party processors (cloud providers, analytics platforms, email services), Article 28 requires written contracts that bind processors to specific data protection obligations. Your compliance statement should confirm that:

All processors are vetted for GDPR compliance before engagement
Data Processing Agreements are in place with every processor
Processors are subject to regular review
Sub-processor changes are monitored and approved

Moving from template to finished document requires a systematic approach. The following steps provide a practical framework.

Step 1: Conduct a Data Mapping Exercise

Before you can declare compliance, you need to know what data you process. A data mapping exercise identifies:

Every category of personal data your organisation collects
The sources of that data (directly from individuals, from third parties, generated by your systems)
Where the data is stored and how it flows between systems
Who has access to the data internally and externally
The retention period for each data category

This exercise also forms the basis of your Records of Processing Activities, which are required under Article 30 for most organisations.

Step 2: Identify Your Legal Bases

For each processing activity identified in the data mapping, determine which of the six lawful bases under Article 6 applies. Document this clearly. Where you rely on consent, ensure your consent mechanisms meet the GDPR's requirements: freely given, specific, informed, unambiguous, and as easy to withdraw as to give (Article 7).

Create a comprehensive privacy policy for your website or app. Create yours in minutes with TermsBox.

Generate Now

Step 3: Review Your Technical Safeguards

Audit your current security measures against the requirements of Article 32. Identify gaps between your current state and what the regulation requires. Common shortfalls include:

Lack of encryption for data at rest
Overly broad access permissions
No formal incident response plan
Outdated software with unpatched vulnerabilities
Absence of regular security testing

Address gaps before finalising the compliance statement. Declaring compliance with measures you have not actually implemented creates legal risk rather than reducing it.

Step 4: Establish Data Subject Rights Workflows

Create internal procedures for handling data subject requests. Assign responsibility for:

Receiving and logging requests
Verifying the identity of the requester
Gathering the relevant data from all systems
Responding within the one-month deadline
Documenting each request and outcome

Test these workflows before publishing your compliance statement by running simulated requests through the process.

Step 5: Draft, Review, and Publish

Write the statement in clear, accessible language. While legal precision matters, the document should be understandable by non-lawyers. Have the statement reviewed by your Data Protection Officer (if applicable), legal counsel, and relevant technical staff.

Publish the statement on your website and make it available to partners and regulators on request. Many organisations place it alongside their privacy policy and cookie policy in the website footer.

Avoiding these frequent errors will strengthen your compliance posture and reduce the risk of regulatory action.

Copying a Generic Template Without Customisation

A compliance statement that does not reflect your actual processing activities is worse than not having one at all. Supervisory authorities can quickly identify generic statements that bear no resemblance to the organisation's real operations. Fines under Article 83 of the GDPR can reach up to 20 million EUR or 4% of annual global turnover for serious infringements.

Declaring Compliance Without Evidence

The accountability principle requires that you can demonstrate compliance, not merely assert it. If your statement claims you conduct regular Data Protection Impact Assessments but you have no DPIA records, the statement becomes evidence of your failure rather than your diligence.

Ignoring Processor Relationships

Many organisations focus their compliance statements entirely on their own activities and neglect to address how third-party processors handle data on their behalf. Under Article 28, the controller is responsible for ensuring processors comply with the GDPR. Your statement should address this relationship explicitly.

Failing to Update

A compliance statement written in 2018 and never revised is unlikely to reflect your current processing activities, technology stack, or the evolving regulatory guidance from supervisory authorities and the European Data Protection Board. Treat it as a living document.

Omitting Breach Response Procedures

The 72-hour notification requirement under Article 33 is one of the GDPR's most operationally demanding provisions. Organisations that have not documented and tested their breach response procedures before a breach occurs frequently miss the deadline, compounding their regulatory exposure.

Websites face specific compliance challenges because they typically process personal data through multiple mechanisms simultaneously: contact forms, analytics tools, advertising pixels, cookie consent systems, and user accounts.

Website-Specific Elements

A GDPR compliance statement for a website should address:

Cookie and tracking technology use: What cookies and similar technologies are deployed, their purposes, and the legal basis for each. A separate cookie policy is standard practice.
Analytics processing: Whether analytics data constitutes personal data (IP addresses, device fingerprints) and the legal basis for collection.
Form data handling: How data submitted through contact forms, signup forms, and checkout processes is stored and processed.
Third-party integrations: Which external services receive visitor data (payment processors, email marketing platforms, social media plugins, advertising networks).
Consent management: How cookie consent is collected, recorded, and respected across the site.

Practical Implementation

For website operators, maintaining GDPR compliance across all these touchpoints manually is difficult and error-prone. Automated compliance tools can help by scanning your website for cookies and trackers, generating appropriate consent mechanisms, and keeping your legal documents current as your site evolves. TermsBox, for example, offers a website compliance scanner and consent management platform that identifies what data your site collects and generates the corresponding documentation.

Regardless of the tools you use, the compliance statement should accurately reflect your website's actual data processing activities, not a hypothetical ideal.

The accountability principle in Article 5(2) is the thread that ties the entire GDPR compliance framework together. It shifts the burden of proof from regulators to controllers: you must be able to show that you comply, not just claim it.

What Accountability Requires in Practice

The European Data Protection Board has clarified that accountability includes adopting data protection policies, taking a data protection by design and by default approach (Article 25), maintaining Records of Processing Activities (Article 30), conducting Data Protection Impact Assessments where required (Article 35), appointing a Data Protection Officer where required (Article 37), implementing appropriate technical and organisational measures (Article 32), training staff, and adhering to codes of conduct or certification mechanisms where applicable.

Your GDPR compliance statement should reference each of these elements and describe how your organisation addresses them. The statement itself then becomes a piece of accountability evidence that supervisory authorities will request during audits or investigations.

Frequently Asked Questions

Is a GDPR compliance statement legally required?

The GDPR does not explicitly require a document labelled a compliance statement. However, Article 5(2) of the GDPR establishes the accountability principle, which requires controllers to demonstrate compliance with all data protection principles. A GDPR compliance statement is the most practical way to document and communicate this accountability. Supervisory authorities routinely expect organisations to produce evidence of compliance during audits and investigations.

What is the difference between a GDPR compliance statement and a privacy policy?

A privacy policy is an external-facing document that tells individuals how their personal data is collected, used, and protected. It fulfils the transparency requirements of Articles 13 and 14 of the GDPR. A GDPR compliance statement is a broader declaration covering the organisation's overall approach to data protection, including internal governance, staff training, breach procedures, and technical safeguards. Some organisations combine elements of both into a single document, while others maintain them separately.

Who needs a GDPR compliance statement?

Any organisation that processes personal data of individuals in the EU or EEA needs to demonstrate GDPR compliance, regardless of where the organisation is based. This includes businesses that sell to EU customers, websites that collect data from EU visitors, and service providers that process data on behalf of EU-based clients. In practice, a formal compliance statement is particularly important for organisations handling large volumes of personal data, processing sensitive categories of data, or acting as data processors for other companies.

How often should a GDPR compliance statement be updated?

A GDPR compliance statement should be reviewed and updated at least annually, or whenever a significant change occurs in your data processing activities, organisational structure, or the regulatory landscape. Triggers for an update include launching new products or services that process personal data, entering new markets, changing data processors or sub-processors, experiencing a data breach, or receiving guidance from a supervisory authority that affects your processing activities.

What Is a GDPR Compliance Statement?

GDPR Compliance Statement vs. Privacy Policy

Privacy Policy