Free GDPR kit for your forms
If your form asks for names, emails or any personal data, you are the controller of that processing: you have to inform respondents and put in writing what you do with their data. The kit prepares it from what you declare and what your form shows, in a few minutes and for free.
What it prepares
- The information for respondents (Art. 13)
- In two layers: the basics on the form itself and everything else on a linked page, in the form's language (Spanish, English, French, German, Italian or Portuguese).
- The record of processing activities entry (Art. 30)
- With the controller, purpose, legal basis, data, recipients, retention period and security measures, ready to print or save as PDF.
- The impact assessment analysis (Art. 35)
- With the 11 criteria in the Spanish DPA (AEPD) list: if two or more apply, in most cases you need one, and it gives you a draft to start from.
- What your form shows
- It warns you if you ask for health data or other special categories, or children's data, and counts an anonymous form as data minimisation.
- Where else the responses go
- If you send them to your system, a spreadsheet or Notion, the notice and the record say so automatically.
How it works
- Open the form in the editor and go to «Data protection (GDPR kit)».
- Say who you are, what you'll use the responses for, on which legal basis and for how long you'll keep them.
- Choose whether to show the notice on the form, and download or print the record and the analysis.
What it doesn't do
It isn't legal advice and doesn't replace your data protection officer: these are helper documents built from your answers, worth reviewing. You choose the legal basis and the retention period, because they depend on your activity.
Frequently asked questions
Do I have to inform respondents?
Yes. When you collect data from a person, Article 13 GDPR requires telling them, at that moment, who you are, what you'll use it for, on which basis, who you'll share it with, how long you'll keep it and how to exercise their rights.
Do I need a record of processing activities if we're a small organisation?
Article 30 exempts organisations with fewer than 250 people only if the processing is occasional, isn't likely to result in a risk and doesn't include special categories of data. In practice, if you use forms regularly, it's worth having.
When is an impact assessment needed?
When the processing is likely to result in a high risk. The Spanish DPA publishes a list of 11 criteria: if two or more apply, in most cases one is required.
How much does it cost?
Nothing. The kit is free, like the rest of AIM FORM.