Cuando un cliente pregunte por la seguridad, ten las respuestas.

• Qué exige el RGPD antes de lanzar

  GDPR

  Le preguntas a tu IA

  I am launching a habit-tracking web app next month. Users sign up with email, it stores their habits and reminders, and some users are in the EU. What does GDPR need from me before launch? A short checklist, most important first.

  ISMS Copilot responde

  Here's a practical launch checklist, most important first:

  1. Legal basis for processing (Art. 6): Decide per purpose — contract for core habit/reminder data, consent for marketing emails. Document it.
  2. Transparency & privacy policy (Art. 13): Publish a clear notice covering who you are, what you collect, purposes, legal basis, retention periods, user rights, and how to contact you. Show it at signup.
  3. Data minimization & retention (Art. 5): Collect only what's needed (email, habit data, reminder times). Define deletion timelines for inactive accounts.
  4. Security measures (Art. 32): Encrypt data in transit and at rest, secure backups, access controls, and test restoration. Your app is small, so proportionate but real.
  5. Processors under contract (Art. 28): List every vendor touching personal data (hosting, email provider for reminders, analytics). Sign their DPAs (most SaaS offer standard ones).
  6. Breach response plan (Arts. 33-34): Know how you'd detect a breach and notify your supervisory authority within 72 hours if needed.
  7. Data subject rights process (Arts. 12-22): A way to handle export, deletion, and correction requests within one month. Even a simple email workflow works at your size.
  8. Records of processing (Art. 30): A short document listing what you process, why, where, and for how long. Required even under 250 employees if processing is regular.
  9. DPO check (Art. 37): Likely not mandatory at your scale — you don't do large-scale systematic monitoring or special-category data. A named privacy contact is enough.
  10. Transfer check (Arts. 44-49): If your hosting or email provider stores EU data outside the EU/EEA (e.g., US), ensure SCCs or an adequacy mechanism is in place.

  Practical order: items 1-3 shape your product and signup flow, so do them before writing the privacy policy; 4-7 are operational; 8-10 are documentation you can finalize in launch week.

  Note: this is general compliance guidance, not legal advice — for edge cases (e.g., if you later add health-related habit tracking, which touches Art. 9 special-category data), consult a privacy lawyer.

  Ver la respuesta completa

  ISMS Copilot's reply, 2026-10-19, fast mode, brief answer format. Unedited; trims marked with an ellipsis.

  Prompt y respuesta registrados en inglés.

  Copiar prompt

• Escribe la política de privacidad de mi app

  GDPR, CCPAVer

• Una política de seguridad que un cliente acepte

  ISO 27001, SOC 2Ver

• ¿Se aplica el AI Act a mi chatbot?

  EU AI ActVer

Borradores para que los revises y adaptes. ISMS Copilot no certifica nada.