A GDPR trust center a buyer's legal team can check on their own
Show your GDPR and UK GDPR status on your trust center, beside the other things a data protection review asks for: where your subprocessors are, a DPA to sign, a way to submit a privacy request, and how long you keep data. Notice Labs puts all five on one public page.
From £39 a month. No sales call.
GDPR questions arrive one email at a time
A data protection lead reviewing a new vendor asks for the subprocessor list, the DPA, and how to raise a data subject request, usually in that order. Each one is a separate email, and each waits on whoever holds the document.
Without a public page, the same three questions come up in every deal and every renewal. A page that already answers them cuts the back-and-forth to the parts that actually need a person.
Setting up for a GDPR review
- 01
List your subprocessors
Add each vendor with its purpose and location. Search the built-in library of known vendors or add your own. Subscribers who've confirmed their email are told when you change the list.
- 02
Publish your DPA, or draft one
Upload your Data Processing Agreement as a document, or draft a template with Create for your lawyer to review. Mark it public, or available on request if you'd rather review who asks.
- 03
Turn on the privacy request form
A visitor can submit an access, deletion, correction, export or other request. It's recorded in the admin and sent to your privacy contact.
- 04
Mark your compliance status
Add GDPR and UK GDPR to your compliance list as certified, aligned or in progress, with a note if you'd like one.
Subprocessors with where they run
Each subprocessor lists its purpose and location, so a reviewer can check international transfers without asking. The built-in library fills in the name, website and usual purpose for thousands of known vendors.
The request form your DPA and policy point to
Access, deletion, correction, export or another kind of request, with a place to describe it. It's recorded in your admin and sent to whichever address you've set as the privacy contact.
What's on the page
Five feature pages, brought together for a GDPR review.
- Subprocessor listEvery vendor with a purpose and a location, filled in from a library of known subprocessors or added by hand.
- DPAYour Data Processing Agreement, published as a document, public or available on request.
- Privacy request formAccess, deletion, correction, export or other requests, recorded in the admin and sent to your privacy contact.
- GDPR and UK GDPR statusMark each as certified, aligned or in progress, next to your other compliance frameworks.
- Retention controlState how long you keep customer data and when it's deleted, as one of the controls a reviewer reads.
Where each question lands
Who are your subprocessors, and where do they run?
Subprocessors tab
Can we see your DPA?
Documents tab
How do we submit a data subject request?
Privacy request form
Are you GDPR and UK GDPR compliant?
Compliance list on the Overview tab
How long do you keep our data?
Retention and deletion control, Security tab
What it doesn't do
This page states what you tell it to: the subprocessors you list, the compliance status you set, the DPA you upload. Notice Labs doesn't verify any of it, and it isn't a data protection officer or a law firm.
The page describes, in general terms, what GDPR asks for in a subprocessor list, a DPA and a way to handle data subject requests. Check your own obligations, including any that apply beyond what's covered here, with your own advice.
Questions
Straight answers to what people ask before they set this up.
What should a GDPR trust center actually include?
A subprocessor list with locations, a Data Processing Agreement, a way to submit a data subject request, and your compliance status for GDPR and, if it applies, UK GDPR. Add how long you keep data, and those are the five things a reviewer usually asks for first.
Do we need a UK GDPR entry as well as GDPR?
If you have customers or process data covered by UK law, list it separately. They're related frameworks with the same shape, but a reviewer checking one won't assume the other.
Should the DPA be public or on request?
Most companies publish it, since a reviewer asks for it early and it holds nothing sensitive. If you'd rather know who's reading it, mark it available on request and each reader gives a name, company and email first.
What status should we show for GDPR?
Choose certified, aligned or in progress, and use the note to say what the status rests on. Notice Labs doesn't check it, so show only what you can back up, and ask your own adviser what you can claim.
Does this page replace our privacy policy?
No. A privacy policy is a separate legal document you publish yourself. This page gives a reviewer the subprocessor list, DPA and request form your policy usually just points to.
Is the subprocessor list kept up to date automatically?
No. You add and remove subprocessors in the admin as your vendors change. The library of known vendors speeds up adding one; it doesn't track your usage for you.
Related reading
Give a GDPR review one page to check, not three emails.
From £39 a month. No sales call.