Quand un client pose des questions sur la sécurité, ayez déjà les réponses.

• Ce que le RGPD exige avant mon lancement

  GDPR

  Vous demandez à votre IA

  I am launching a habit-tracking web app next month. Users sign up with email, it stores their habits and reminders, and some users are in the EU. What does GDPR need from me before launch? A short checklist, most important first.

  ISMS Copilot répond

  Here's a practical launch checklist, most important first:

  1. Legal basis for processing (Art. 6): Decide per purpose — contract for core habit/reminder data, consent for marketing emails. Document it.
  2. Transparency & privacy policy (Art. 13): Publish a clear notice covering who you are, what you collect, purposes, legal basis, retention periods, user rights, and how to contact you. Show it at signup.
  3. Data minimization & retention (Art. 5): Collect only what's needed (email, habit data, reminder times). Define deletion timelines for inactive accounts.
  4. Security measures (Art. 32): Encrypt data in transit and at rest, secure backups, access controls, and test restoration. Your app is small, so proportionate but real.
  5. Processors under contract (Art. 28): List every vendor touching personal data (hosting, email provider for reminders, analytics). Sign their DPAs (most SaaS offer standard ones).
  6. Breach response plan (Arts. 33-34): Know how you'd detect a breach and notify your supervisory authority within 72 hours if needed.
  7. Data subject rights process (Arts. 12-22): A way to handle export, deletion, and correction requests within one month. Even a simple email workflow works at your size.
  8. Records of processing (Art. 30): A short document listing what you process, why, where, and for how long. Required even under 250 employees if processing is regular.
  9. DPO check (Art. 37): Likely not mandatory at your scale — you don't do large-scale systematic monitoring or special-category data. A named privacy contact is enough.
  10. Transfer check (Arts. 44-49): If your hosting or email provider stores EU data outside the EU/EEA (e.g., US), ensure SCCs or an adequacy mechanism is in place.

  Practical order: items 1-3 shape your product and signup flow, so do them before writing the privacy policy; 4-7 are operational; 8-10 are documentation you can finalize in launch week.

  Note: this is general compliance guidance, not legal advice — for edge cases (e.g., if you later add health-related habit tracking, which touches Art. 9 special-category data), consult a privacy lawyer.

  Voir toute la réponse

  ISMS Copilot's reply, 2026-10-19, fast mode, brief answer format. Unedited; trims marked with an ellipsis.

  Prompt et réponse enregistrés en anglais.

  Copier le prompt

• Rédiger la politique de confidentialité de mon app

  GDPR, CCPAVoir

• Une politique de sécurité qu'un client acceptera

  ISO 27001, SOC 2Voir

• L'AI Act s'applique-t-il à mon chatbot ?

  EU AI ActVoir

Des brouillons à relire et à adapter. ISMS Copilot ne certifie rien.