Als een klant naar beveiliging vraagt, heb je de antwoorden.

• Wat de AVG vraagt voordat ik lanceer

  GDPR

  Je vraagt je AI

  I am launching a habit-tracking web app next month. Users sign up with email, it stores their habits and reminders, and some users are in the EU. What does GDPR need from me before launch? A short checklist, most important first.

  ISMS Copilot antwoordt

  Here's a practical launch checklist, most important first:

  1. Legal basis for processing (Art. 6): Decide per purpose — contract for core habit/reminder data, consent for marketing emails. Document it.
  2. Transparency & privacy policy (Art. 13): Publish a clear notice covering who you are, what you collect, purposes, legal basis, retention periods, user rights, and how to contact you. Show it at signup.
  3. Data minimization & retention (Art. 5): Collect only what's needed (email, habit data, reminder times). Define deletion timelines for inactive accounts.
  4. Security measures (Art. 32): Encrypt data in transit and at rest, secure backups, access controls, and test restoration. Your app is small, so proportionate but real.
  5. Processors under contract (Art. 28): List every vendor touching personal data (hosting, email provider for reminders, analytics). Sign their DPAs (most SaaS offer standard ones).
  6. Breach response plan (Arts. 33-34): Know how you'd detect a breach and notify your supervisory authority within 72 hours if needed.
  7. Data subject rights process (Arts. 12-22): A way to handle export, deletion, and correction requests within one month. Even a simple email workflow works at your size.
  8. Records of processing (Art. 30): A short document listing what you process, why, where, and for how long. Required even under 250 employees if processing is regular.
  9. DPO check (Art. 37): Likely not mandatory at your scale — you don't do large-scale systematic monitoring or special-category data. A named privacy contact is enough.
  10. Transfer check (Arts. 44-49): If your hosting or email provider stores EU data outside the EU/EEA (e.g., US), ensure SCCs or an adequacy mechanism is in place.

  Practical order: items 1-3 shape your product and signup flow, so do them before writing the privacy policy; 4-7 are operational; 8-10 are documentation you can finalize in launch week.

  Note: this is general compliance guidance, not legal advice — for edge cases (e.g., if you later add health-related habit tracking, which touches Art. 9 special-category data), consult a privacy lawyer.

  Toon het volledige antwoord

  ISMS Copilot's reply, 2026-10-19, fast mode, brief answer format. Unedited; trims marked with an ellipsis.

  Prompt en antwoord zijn in het Engels vastgelegd.

  Prompt kopiëren

• Schrijf het privacybeleid voor mijn app

  GDPR, CCPAToon

• Een beveiligingsbeleid dat een klant accepteert

  ISO 27001, SOC 2Toon

• Geldt de AI Act voor mijn chatbot?

  EU AI ActToon

Concepten om te controleren en aan te passen. ISMS Copilot certificeert niets.