ISMS Copilot
What GDPR needs before I launch
GDPRYou ask your AI
I am launching a habit-tracking web app next month. Users sign up with email, it stores their habits and reminders, and some users are in the EU. What does GDPR need from me before launch? A short checklist, most important first.
ISMS Copilot answers
Here's a practical launch checklist, most important first:
- Legal basis for processing (Art. 6): Decide per purpose — contract for core habit/reminder data, consent for marketing emails. Document it.
- Transparency & privacy policy (Art. 13): Publish a clear notice covering who you are, what you collect, purposes, legal basis, retention periods, user rights, and how to contact you. Show it at signup.
- Data minimization & retention (Art. 5): Collect only what's needed (email, habit data, reminder times). Define deletion timelines for inactive accounts.
- Security measures (Art. 32): Encrypt data in transit and at rest, secure backups, access controls, and test restoration. Your app is small, so proportionate but real.
- Processors under contract (Art. 28): List every vendor touching personal data (hosting, email provider for reminders, analytics). Sign their DPAs (most SaaS offer standard ones).
- Breach response plan (Arts. 33-34): Know how you'd detect a breach and notify your supervisory authority within 72 hours if needed.
- Data subject rights process (Arts. 12-22): A way to handle export, deletion, and correction requests within one month. Even a simple email workflow works at your size.
- Records of processing (Art. 30): A short document listing what you process, why, where, and for how long. Required even under 250 employees if processing is regular.
- DPO check (Art. 37): Likely not mandatory at your scale — you don't do large-scale systematic monitoring or special-category data. A named privacy contact is enough.
- Transfer check (Arts. 44-49): If your hosting or email provider stores EU data outside the EU/EEA (e.g., US), ensure SCCs or an adequacy mechanism is in place.
Practical order: items 1-3 shape your product and signup flow, so do them before writing the privacy policy; 4-7 are operational; 8-10 are documentation you can finalize in launch week.
Note: this is general compliance guidance, not legal advice — for edge cases (e.g., if you later add health-related habit tracking, which touches Art. 9 special-category data), consult a privacy lawyer.
ISMS Copilot's reply, 2026-10-19, fast mode, brief answer format. Unedited; trims marked with an ellipsis.