EDPB Report on the public consultation on helpful templates for organisations to facilitate their GDPR compliance

EDPB Report on the public consultation on helpful templates for organisations to facilitate their GDPR compliance 1. Background on the public consultation process Following the Helsinki Statement on enhancing clarity, support and engagement 1 , the EDPB launched a written public consultation on its website 2 to collect inputs from organisations on what templates could facilitate their GDPR compliance activities. The objective of the public consultation was to gather feedback on the most relevant templates for GDPR compliance. Based on the contributions received, and building on and harmonising the work already done at national level, the EDPB intends to develop a series of ready-to-use templates for organisations. The public consultation was launched on 5 November 2025 and closed on 3 December 2025. It was addressed to the general public, with a focus on SMEs 3 . 2. Amount and nature of contributions received The EDPB received written contributions from business associations, DPOs, lawyers, companies or business organisations, public authorities, NGOs, academic or research institutions, and individuals. Total number of contributions received: 82 Link to the page where the contributions are published: https://www.edpb.europa.eu/our- work-tools/documents/public-consultations/2025/help-make-gdpr-compliance-easy- organisations en Number of contributing entities by category: 1 https://www.edpb.europa.eu/our-work-tools/our-documents/statements/helsinki-statement-enhanced-clarity-support-and- engagement en 2 https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2025/help-make-gdpr-compliance-easy- organisations en 3 The EDPB invited its members to inform stakeholders at national level, in particular associations of SMEs, about this public consultation. 2 | Business association Company/ Business o rganisation Individual Lawyer Public authority DPO/ Professional Association NGO Academic/ R esearch institution Other (please specify) 5 1 6 1 9 17 3 15 1 1 Consultant: 1 P ension Fund: 1 Dairy Sector: 1 Unknown: 2 Total: 5 Total number of contributions received from EU/EEA and third countries: EU/EEA Third countries 7 1 1 1 3. Main outcomes of the public consultation In some cases, t he contributions received simply mentioned the name of the template they wish to see adopted , in others , they included detailed reasons why the specific template was considered relevant. Other contributions mentioned the need to have templates available and how this could improve the work of organisations , but without mentioning specific templates . The c ontributions received identified the following templates as those being the most relevant and most wanted ones 4 by the contributors to facilitate organisations’ GDPR compliance activities: 1. Record of Processing Activities (ROPA) 2. Data protection impact assessment (DPIA) 3. Legitimate interest assessment 4. Privacy notice/policy 5. Transfer impact assessment 6. Data processing agreement ( e.g. criteria for minimal technical and organisational measures depending on the risks ) 7. Data breach notification form 4 All the templates listed here were mentioned by at least five contributors. The templates that were mentioned less than five times in the contributions (e.g., template data retention policy , template arrangement between joint controllers , template consent form for biometric data ) were not considered by t he EDPB when developing its 2026 - 2027 Work Programme , in order to focus its efforts on the templates that were the most popular in the contributions received . 3 | 8. Privacy risk assessment In the context of the public consultation, the EDPB recalled that it already decided to work on creating a template for data protection impact assessment (DPIA) and for data breach notifications and suggested to propose other ideas of templates. The EDPB takes note that those templates were still nevertheless proposed by the public, which certainly underlines their usefulness. The EDPB considered the feedback received by the public when shaping its Work Programme for 2026-2027 5 , and decided to include therein the following templates: 1. Template or flowchart on legitimate interest assessment 2. Template record of processing activities 3. Template privacy notice/policy The EDPB will therefore develop these three templates, taking into consideration the templates already available at national level and harmonising them. If time allows during 2026- 2027, the EDPB may consider to work on additional templates. 5 https://www.edpb.europa.eu/our-work-tools/our-documents/strategy-work-programme/edpb-work-programme-2026-2027 en