Build your enforceable privacy compliance dossier in weeks, not months.
The GDPR + CCPA/CPRA package is for both data controllers and processors, regardless of size, as soon as they collect, use, or store personal data of EU residents OR California residents (and increasingly residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Florida, Montana, and other US states with active privacy laws).
Data Protection Officers (internal or outsourced), Chief Privacy Officers, in-house counsel, and compliance leads who must build, maintain, and produce the documented privacy dossier required by GDPR Article 30, CCPA/CPRA, and US state privacy laws.
CEOs, CFOs, and senior management who carry legal responsibility for processing under GDPR Article 24 (and equivalent US state law accountability standards) and must demonstrate compliance to enterprise customers, partners, EU DPAs, and the California Privacy Protection Agency (CPPA).
CISOs, Heads of Information Security, and IT Directors who must align technical and organizational measures (GDPR Art. 32) with the privacy documentation framework, DPIAs, breach response, and SOC 2 / ISO 27001 controls.
Privacy consultants, specialized attorneys, and advisory firms who want a validated documentation foundation to start client engagements quickly (consultant license available on request).
EU Regulation 2016/679 covers 99 articles, of which around 30 directly require documents, registers, or written procedures. CCPA/CPRA layers in additional disclosure obligations, opt-out mechanisms, and consumer rights handling. Building all this in-house takes 3 to 6 months of writing work and exposes you to regulator action.
Most online templates are simplified registers or standalone privacy notices. They ignore the connected requirements: DPIAs (Art. 35), breach notification (Art. 33-34), processor contracts / DPAs (Art. 28), international transfers including SCCs and DPF (Art. 44-49), data subject rights handling (Art. 15-22), and CCPA-specific notices, opt-out mechanisms, and Service Provider Agreements.
EU Data Protection Authorities have issued thousands of fines, with amounts ranging from a few thousand to over $1 billion (Meta, Amazon, TikTok). The GDPR cap reaches €20M or 4% of global annual turnover — whichever is higher. CCPA/CPRA fines reach $7,500 per intentional violation, and California's CPPA has begun aggressive enforcement actions against US companies.
Fortune 500 buyers, federal contracts, healthcare partners, and SaaS resellers now systematically require a privacy compliance dossier, a signed DPA (GDPR Art. 28), and increasingly a DPIA in their vendor onboarding. Without a ready dossier, vendor qualification stalls.
A complete GDPR + CCPA compliance engagement billed by a privacy consulting firm or outsourced DPO/CPO represents 10 to 30 days of intervention. The documentation package gives you the complete written foundation — you keep your budget for field implementation and specific DPIAs.
The package covers the 15 GDPR compliance domains (Articles 5 to 49 of EU Regulation 2016/679), the CCPA/CPRA layer with US state law alignment, plus EDPB and CPPA guidelines. Each document is mapped to one or more specific normative articles.
GDPR is an accountability-based regulation (Art. 5.2 and 24). When facing a regulator inquiry or an enterprise customer audit, the first question is always the same: "show me your documentation." Below is the article-by-article mapping between the regulatory text and the documents provided.
| GDPR Article | Regulatory requirement | Documents provided in the package |
|---|---|---|
| Art. 5 | Principles relating to processing: lawfulness, purpose, minimization, accuracy, storage limitation, security, accountability | General privacy policy Compliance manual Retention matrix Minimization procedure |
| Art. 6 | Lawfulness of processing — 6 legal bases (consent, contract, legal obligation, vital interest, public interest, legitimate interest) + compatibility test (Art. 6.4) | Legal basis qualification procedure Legitimate interest balancing test (LIA) Compatibility test for further purposes |
| Art. 7 | Conditions applicable to consent: proof, distinguishability, withdrawal as easy as collection | Consent procedure Consent form Withdrawal procedure |
| Art. 8 | Children's consent for information society services (16 EU default; lower in some Member States) | Children consent procedure (GDPR Art. 8 + COPPA US alignment) Parental verification mechanism |
| Art. 9 | Special categories (origin, opinions, health, biometric, genetic, sexual orientation) — 10 derogations | Sensitive data procedure Art. 9.2 derogations matrix CCPA Sensitive PI handling procedure |
| Art. 10 | Personal data relating to criminal convictions and offenses | Criminal data procedure Authorization matrix under public authority |
| Art. 11 | Processing not requiring identification — partial exemption from Art. 15-20 | Note on processing without identification |
| Art. 12 — 14 | Transparent information of data subjects, direct collection (Art. 13) and indirect (Art. 14) + rights exercise modalities (Art. 12, 1 month + 2 month extension) | Direct collection notice (Art. 13) Indirect collection notice (Art. 14) Privacy policy Cookie policy + CCPA opt-out HR notices Standardized icons template |
| Art. 15 — 21 | Data subject rights: access (15), rectification (16), erasure / right to be forgotten (17), restriction (18), portability (20), objection (21) | Global rights handling procedure Access response template (CCPA right to know aligned) Rectification response template (CCPA right to correct) Erasure response template (CCPA right to delete) Restriction response template Portability response template (CCPA aligned) Objection response template (CCPA right to opt-out) Identity verification (Art. 12.6 / CCPA verifiable consumer request) Rights request register |
| Art. 19 | Notification obligation to recipients of any rectification, erasure, or restriction | Recipient notification procedure Recipient register per processing |
| Art. 22 | Automated individual decision-making and profiling producing legal effects or significantly affecting the person | Automated decision & profiling procedure Matrix of processing with legal effect Human intervention & contestation procedure CPRA automated decision-making opt-out |
| Art. 24 — 25 | Controller responsibility, Privacy by Design & by Default | Compliance manual Privacy by Design procedure PbD project checklist |
| Art. 26 | Joint controllership between controllers — written agreement defining respective obligations | Joint controllership agreement Joint controller qualification procedure |
| Art. 27 | Designation of an EU representative by controllers or processors not established in the EU but targeting EU residents (Art. 3.2) | EU representative designation procedure Standard written mandate |
| Art. 28 | Processor obligations and written processing contract — 10 mandatory clauses (§3 a to h) | Standard contractual clauses Art. 28 (DPA) Processor selection procedure Evaluation grid Processor register Sub-processor procedure (Art. 28.2, 28.4) Annual audit procedure CCPA Service Provider Agreement template |
| Art. 30 | Records of processing activities (controller 30.1 + processor 30.2) — < 250 employees derogation under conditions | Controller RoPA (Art. 30.1) Processor RoPA (Art. 30.2) Standard processing record template Update procedure Note on < 250 employees derogation |
| Art. 31 | Cooperation with the supervisory authority — obligation to make registers available and assist the authority | Supervisory authority cooperation procedure Inquiry response procedure (EU DPA, CPPA, state AG) |
| Art. 32 | Security of processing: pseudonymization, encryption, confidentiality, integrity, availability, resilience + regular testing of TOMs | Information Security Policy Access management policy Encryption & pseudonymization Backup & resilience Regular TOM testing procedure TOM matrix (SOC 2 / ISO 27001 aligned) Acceptable use policy |
| Art. 33 — 34 | Notification to supervisory authority within 72h (Art. 33) and communication to data subjects in case of high risk (Art. 34) | Breach management procedure Internal breach register (Art. 33.5) Supervisory authority notification 72h Communication to data subjects Risk assessment grid US state-by-state breach notification matrix |
| Art. 35 — 36 | Data Protection Impact Assessment (DPIA) mandatory in 3 cases (Art. 35.3) + prior consultation if high residual risk (Art. 36) | DPIA procedure (4 elements Art. 35.7) Triggering matrix Complete DPIA template Risk assessment grid DPIA review procedure (Art. 35.11) Prior consultation procedure CPRA Risk Assessment template |
| Art. 37 — 39 | DPO designation, function, and missions — 3 mandatory cases (Art. 37.1), independence (Art. 38.3), 5 minimum missions (Art. 39) | DPO/CPO appointment letter Designation procedure Job description (5 missions Art. 39) Independence charter (Art. 38.3) Annual report |
| Art. 44 — 49 | Transfers to third countries: adequacy decision (45), appropriate safeguards (46), derogations (49) | Transfer qualification procedure Transfers mapping Standard Contractual Clauses 2021 (Art. 46.2.c) TIA procedure post-Schrems II EU-US Data Privacy Framework checklist Derogations procedure (Art. 49) Transfers register |
| Art. 47 | Binding Corporate Rules (BCRs) for groups — 14 mandatory elements (§2 a to n) | BCR policy BCR approval procedure with lead authority |
| Art. 48 | Transfers or disclosures not authorized by Union law — framework for foreign court/authority requests (CLOUD Act, FISA 702 type) | Foreign authority requests procedure Applicable international agreement assessment grid |
| Art. 88 | Processing of data in employment relations — specific national provisions (collective agreements, works councils) | HR processing procedure HR register (candidates, employees, former employees) Workplace surveillance procedure Remote work procedure CCPA HR notice for California employees |
| Art. 89 | Safeguards and derogations for processing for archiving in the public interest, scientific or historical research, or statistics | Archiving purposes procedure Scientific research procedure Statistical purposes procedure Derogations matrix Art. 89.2 and 89.3 HIPAA de-identification methodology (if PHI) |
| US state laws + sectoral | US compliance layer: CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), TX/OR/MT/FL/IA/IN/TN privacy acts, HIPAA (PHI), GLBA (financial), FERPA (education), COPPA (children) | CCPA/CPRA compliance procedure Multi-state US privacy matrix HIPAA / HITECH procedure GLBA compliance procedure Mapping matrix GDPR ↔ CCPA ↔ US state laws |
| Not included | Deliverables specific to each processing and each organization — which must be produced case by case by your DPO/CPO, CISO, or compliance team | Filled-in RoPA (your processing activities) Complete DPIAs (per high-risk processing) Signed DPAs (per processor) Filled-in TIAs (per transfer) Authority-approved BCRs (dedicated procedure) Actual breach notifications Technical security audits (pentest, ISO 27001 certification) Customized team training |
Beyond the article-by-article mapping, here are the rigor points that experienced DPOs/CPOs, regulator inspectors, and privacy auditors verify first.
GDPR applies beyond the European Union as soon as an organization targets EU residents or monitors their behavior (Art. 3.2). CCPA/CPRA applies to any business that does business in California and meets thresholds (revenue, data volumes, or data sale). Being compliant with both positions you for the global "GDPR-like" regulatory landscape and US state privacy laws.
| Criterion |
QSE Academy GDPR + CCPA $589 |
Free templates $0 |
Outsourced DPO / privacy firm $8,000 — $20,000 |
|---|---|---|---|
| Coverage of the 15 GDPR domains | ✓ 100% | Partial | ✓ 100% |
| Article-by-article GDPR mapping | ✓ Excel matrix | ✗ | Per engagement |
| CCPA/CPRA + US state law layer | ✓ Included | ✗ | Per engagement |
| Processor contracts Art. 28 (DPA) + CCPA SPA | ✓ | Rare | ✓ |
| DPIA procedure + complete template | ✓ | Rarely | ✓ |
| State-by-state breach notification matrix | ✓ Included | ✗ | Per engagement |
| Editable Word format, neutral charter | ✓ | Variable | ✓ |
| Delivery time | Instant | Instant | 3 to 6 months |
| Money-back guarantee | ✓ 30 days | ✗ | ✗ |
| Filled-in RoPA & customized DPIAs | On you | On you | Included |
| Implementation & team training | On you | On you | Included |
Answer the 15 article-by-article questions to get your GDPR + CCPA/CPRA maturity score. Instant result, free, no personal information required.
The package isn't just delivered. Here is the concrete path to bring it into production in your organization, step by step.
Secure payment, immediate access to the full package as a ZIP. Within minutes you have the 118 Word documents, the Excel matrices, and the user manual.
Adapting the documents to your organization: logo, organizational chart, processing inventory, processors, transfers, applicable scope (GDPR + CCPA + state laws). Plan 2 to 4 weeks for thorough customization including data mapping work.
Team training, RoPA filling, DPIA on high-risk processing, processor contracts review, breach response drill, privacy notices update. Records start feeding real privacy traceability.
Internal privacy audit using the checklist provided in the package. Identification of remaining gaps, corrective action plan, preparation for enterprise customer audits, regulator inquiries, or vendor onboarding requests.
You have 30 days to download the package, review its content, open the documents, and verify that the writing quality matches your expectations. If something is off, you write us an email — no justification needed — and the refund is processed within 5 business days. That simple.
The privacy regulatory landscape evolves rapidly. The package you buy today shouldn't become obsolete in 6 months. That's why updates are included.
The package already integrates GDPR, CCPA/CPRA, the latest US state privacy laws, the EU-US Data Privacy Framework, and post-Schrems II SCCs. In case of new EDPB guidelines, CPPA enforcement guidance, new US state privacy laws (over a dozen states have active legislation in 2026), or significant case law, you receive relevant package updates free of charge for 12 months after your purchase.
The package gives you the complete documentation foundation required by GDPR, CCPA/CPRA, and other US state privacy laws. To pass an enterprise audit or respond to a regulator inquiry, you also need to fill in the documents with your real processing activities (RoPA, DPIAs, signed DPAs) and demonstrate operational implementation. The package saves you the 3 to 6 months of writing work. Operational implementation remains your work (typically 4 to 12 weeks depending on company size).
Yes. The package fully covers GDPR (EU Regulation 2016/679) with article-by-article mapping, plus the CCPA/CPRA layer with all California-specific obligations (Notice at Collection, Do Not Sell or Share, opt-outs, Service Provider Agreements, Risk Assessments, etc.). It also includes a multi-state US privacy compliance matrix covering Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas, Oregon, Montana, Florida, Iowa, Indiana, Tennessee, and other states with active privacy laws. Sectoral compliance procedures (HIPAA, GLBA, FERPA, COPPA) are included where applicable.
Most free templates are simplified registers or standalone privacy notices. They ignore the connected requirements: DPIAs (Art. 35), breach notification (Art. 33-34), processor contracts / DPAs (Art. 28), international transfers including SCCs and DPF (Art. 44-49), data subject rights handling (Art. 15-22), and CCPA-specific notices, opt-out mechanisms, and Service Provider Agreements. The QSE Academy package is written specifically for GDPR + CCPA/CPRA and includes the verifiable article-by-article mapping, the state-by-state breach notification matrix, and the latest 2026 regulatory updates.
GDPR is enforced by EU Data Protection Authorities (DPAs) such as the Irish DPC, French CNIL, German DPAs, and others. They have jurisdiction over US companies offering goods/services to EU residents (Art. 3.2). CCPA/CPRA is enforced by the California Privacy Protection Agency (CPPA) and the California AG. Other US state privacy laws are enforced by state Attorneys General. Real risks include: GDPR fines up to €20M or 4% of global turnover; CCPA fines up to $7,500 per intentional violation; class action lawsuits; enterprise customer contract breaches; reputational damage; and increasingly, exclusion from federal contracts and SaaS marketplaces.
Plan 2 to 4 weeks to customize the documents: logo, organizational chart, processing inventory, processors, transfers, applicable jurisdictions (which US state laws apply, whether GDPR Art. 3.2 applies). Then plan implementation time: data mapping, RoPA filling, DPIA on high-risk processing, signed DPAs, privacy notices update, breach response drill — 4 to 12 additional weeks depending on company size and starting maturity.
All policies, procedures, and templates are delivered in fully editable Microsoft Word (.docx) format. Registers, mapping matrices, and the multi-state compliance matrix are delivered in Excel format. No locked PDFs, no proprietary software dependency. The graphic charter is neutral, ready to receive your logo and colors.
Under GDPR Art. 37.1, a DPO is mandatory in 3 cases: public authority/body, core activities requiring large-scale systematic monitoring, or core activities of large-scale processing of special categories. Many US companies don't fall into these mandatory cases but voluntarily appoint a Chief Privacy Officer (CPO) or Privacy Lead because enterprise customers, investors, and regulators increasingly expect it. CPRA doesn't mandate a CPO but expects equivalent accountability. The package includes the DPO/CPO appointment letter, job description, independence charter, and annual report templates.
Yes. The package includes the full transfer framework: transfer qualification procedure, mapping of transfers outside the EEA, Standard Contractual Clauses (SCCs) 2021 with all 4 modules, Transfer Impact Assessment (TIA) procedure post-Schrems II, EU-US Data Privacy Framework (DPF) self-certification readiness checklist, BCR policy for international groups, foreign authority requests procedure (CLOUD Act, FISA 702 considerations), and the EU representative designation procedure (Art. 27) for US companies needing one.
The $589 license covers a single legal entity, with unlimited internal use (all your employees can use the package). For multi-site rollout, a group with multiple subsidiaries, or consulting use across multiple clients, contact us for an adapted license.
Yes. The package already integrates the latest 2026 regulatory landscape (GDPR, CCPA/CPRA, all major US state privacy laws, DPF, post-Schrems II SCCs). In case of new EDPB guidelines, CPPA enforcement actions, new US state privacy laws (the landscape is still evolving rapidly), or significant case law, you receive package updates free of charge for 12 months after your purchase.
You're covered by a 30-day money-back guarantee, no conditions. You write us a simple email — no justification required — and the refund is processed within 5 business days.
118 documents, 15 GDPR domains covered + CCPA/CPRA + multi-state US privacy compliance, article-by-article mapping included. Instant download after payment.
QSE Academy supports quality managers, SMEs, and consultants in accelerating their ISO standards implementation through ready-to-use documentation, targeted training programs, custom documentation services, and compliance tools.
Quality Consultants Group LLC
8206 Louisiana Blvd NE,
Ste A #135
Albuquerque, NM 87113
United States
Secure Payment
© 2026 QSE Academy. All Rights Reserved.
