River
Y CombinatorBacked by Y Combinator
Log InStart Free
FREE TEMPLATE

Privacy Compliance Documentation Template

Four documents and three sheets that give each rights request its real statutory deadline, computed from the regulation that actually governs it.

Edit with AIDownload (.docx + .csv)

Free download  ·  No account needed

What you get

Pack of 7 files: 4 documents, 3 spreadsheets

Privacy Compliance Documentation Template
  • Privacy PolicyDocument
  • Records of ProcessingDocument
  • DPIA TemplateDocument
  • Breach Response PlanDocument
  • Data InventorySpreadsheet
  • Processor RegisterSpreadsheet
  • Rights Request LogSpreadsheet
RiverPrivacy Compliance Documentation Template

Rights Request Log  ·  Kestrel Metrics, Inc.  ·  Q1 2026

One shared 30-day column can't time both clocks. Neither clock is actually 30 days.

Every row's due date is computed from the regulation that governs that specific requester, not from a single response-time field meant to serve both.

RequestRegimeReceivedReal dueFlat 30-day dueOff by
R-2601GDPRJan 9Feb 9Feb 8−1d
R-2647GDPRFeb 17Mar 17Mar 19+2d
R-2609CCPAJan 14Feb 28Feb 13−15d

34 of 34 requests this quarter disagree with a flat 30-day field. Only 7 are the dangerous kind.

R-2647's kind is the one that actually got missed. A February receipt's real GDPR deadline lands 2 days before a flat 30-day field says it will, so the tracker still shows time left after the legal deadline has already passed.

Most privacy compliance templates give you the same four documents: a Privacy Policy, Records of Processing, a DPIA Template, a Breach Response Plan. All standard, all correctly named, and none of them time a single actual rights request. The gap shows up the moment two regimes apply at once, because a shared spreadsheet with one response-due column has no way to be right for both, and most companies serving both the EU and California are already carrying both.

Article 12(3) of the GDPR gives a data subject one calendar month, extendable by two further months. A calendar month is not a fixed day count: it runs 28 to 31 real days depending on which month the request lands in. The CCPA, as amended by the CPRA, gives a California consumer 45 calendar days outright, extendable once by 45 more. Neither number is 30, and a flat 30-day field misdates a request under either regime, in opposite directions.

Applied to Kestrel Metrics' Q1 2026 volume, 19 GDPR requests and 15 CCPA requests, all 34 disagree with a flat 30-day field. The 7 received in February, a 28-day month, land 2 real days early, the dangerous direction; the other 27 land late by 1 to 15 days, safe but still wrong. The Breach Response Plan runs the same logic against notification. Regulatory change keeps either register current as a rule amends, and the same mapping habit is where a privacy obligation lands once it becomes one row in the wider program.

Two rights-request clocks, three breach-notice clocks, and why none of them is 30 days or 72 hours by default

The Rights Request Log, the calendar-month deadline math, and the Breach Response Plan's three notice clocks.

Privacy Compliance Documentation Template
RiverRights Request Log

Rights Request Log (excerpt)

8 of the quarter's 34 requests. Each due date is computed from the regulation that governs that specific requester.

RequestRegimeReceivedReal dueStatus
R-2601GDPR2026-01-092026-02-09Closed on time
R-2633GDPR2026-02-032026-03-03Closed on time
R-2647GDPR2026-02-172026-03-17Missed by 1 day
R-2609CCPA2026-01-142026-02-28Closed on time

19 GDPR requests, 15 CCPA requests, one miss

The miss is the February GDPR row. Its real deadline was 2 days earlier than a flat 30-day field would have shown, which is exactly the gap a shared SLA column cannot see.

RiverDeadline Math

Why a calendar month isn't 30 days

Q1 2026 has no 30-day month at all, Jan and Mar run 31, Feb runs 28, which is what makes every GDPR row disagree with a flat field.

Month receivedReal elapsed daysFlat 30-day fieldOff by
January (31 days)3130−1d
February (28 days)2830+2d
March (31 days)3130−1d
CCPA, any month4530−15d

8 of 12 months on the calendar disagree with a flat 30-day field in the dangerous direction or the safe one

Only April, June, September and November, the year's other 30-day months, would ever match a flat field by coincidence. February is the one that costs something.

RiverBreach Clocks

Breach Response Plan: three clocks, three audiences

A plan that defaults every audience to the strictest number gets at least two of the three wrong.

RegimeAudienceDeadlineFixed count?
GDPR Art. 33Supervisory authority72 hours from awarenessYes
GDPR Art. 34Affected individual, high-risk onlyWithout undue delayNo
Cal. Civ. Code 1798.82Affected CA resident30 calendar daysYes

Two of the three clocks are fixed numbers. One is a judgment call, and it is not the 72-hour one.

A plan that notifies every individual within 72 hours skips the GDPR's own high-risk assessment for one audience and is still 30 days ahead of schedule for the other. Neither shortcut satisfies what each statute actually asks for.

Edit with AI

What's in the pack

01

Data Inventory

Every system that touches personal data, its specific elements, the regime it engages, and the retention period the rest of the pack traces back to.

02

Processor Register

Every vendor with access to personal data, whether a data processing agreement is signed, and the breach notice commitment its own contract actually states.

03

Privacy Policy

The public-facing statement, traceable to the Data Inventory row behind every category it names, with each regime's real response clock stated by name.

04

Records of Processing

One entry per system, eight fields every time, so a reviewer can move between entries without re-learning the shape each one takes.

05

DPIA Template

Necessity, risk identification and named mitigations run against a specific high-risk processing activity, not a generic privacy-by-design statement.

06

Rights Request Log

Every request's due date computed from the regulation that actually governs the requester, a calendar month for the GDPR or 45 days for the CCPA, never one shared field.

07

Breach Response Plan

Three separate notice clocks run in parallel from one awareness timestamp, so a regulator's 72 hours and a resident's 30 days never get merged into one number.

How to use it

  1. 1

    Open in River, or take it blank

    Open the pack in River and describe which systems hold personal data, or download the Word documents and CSV sheets from the template library and build the inventory yourself.

  2. 2

    Build the Data Inventory before drafting anything else

    Every system, its data categories, its regime, and its retention period, because the Privacy Policy and the Records of Processing both trace back to this list rather than to memory.

  3. 3

    Log every rights request on its own regime's clock

    A calendar month for a GDPR request, 45 calendar days for a CCPA request, computed on the row rather than read off one shared column.

  4. 4

    Run the Breach Response Plan's three clocks in parallel

    A supervisory authority's 72 hours, an individual's undue-delay judgment call, and a resident's flat 30-day count, each logged separately from one awareness timestamp.

Frequently asked questions

Is this template free?

Yes, no account or card required. The download is Word documents and CSV sheets in a zip. Edit with AI is the second half: the agent builds the Data Inventory from a description of what your systems actually hold, then computes every rights request's real deadline from it.

What am I actually downloading?

Four Word documents and three CSV sheets, zipped. The sheets open in Excel, Numbers or Google Sheets straight off the download, and the Privacy Policy, Records of Processing, DPIA Template and Breach Response Plan open in Word or Pages.

Why can't one response-deadline field cover both regimes?

Because neither regime's real deadline is 30 days, and they are not computed the same way. The GDPR's one calendar month runs 28 to 31 real days depending on the month; the CCPA's 45 days is a fixed count. A field built for one regime is wrong for the other, and wrong for its own once a request lands in a short month.

What happens when a request could plausibly be either regime?

The log records which regime's clock was applied and the specific fact that decided it, a stated residency or an account's billing address, rather than picking silently. Where it stays genuinely unclear, running the shorter of the two applicable clocks is the safer default until it is resolved.

Does the GDPR's 72-hour rule apply to notifying customers directly?

No, and treating it that way skips a required judgment call. The 72 hours in Article 33 is the deadline to notify the supervisory authority. Notifying the individual is a separate GDPR obligation, triggered only by a high-risk finding, with no fixed hour count at all.

How does this fit with the other legal packs?

Regulatory change keeps either register current as a rule amends, and the same mapping habit is where a privacy obligation lands once it becomes one row in the wider compliance program rather than a document tracked on its own.

Sources

  1. EUR-Lex2016/679 — EN — gdpr (opens in a new tab)
  2. California Legislative InformationCalifornia Code, CIV 1798.130 (opens in a new tab)

Written by

Chandler Supple

Co-founder & CEO, River

Chandler has spent the last six years working in AI, building tools for millions of users and Fortune 100 companies. In 2025, he co-founded River to build a new kind of operating system for AI agents.

LinkedInGitHubX

Reviewed by

Brian Joseff, Co-founder, River

LinkedInX

Related workspaces

Map a privacy obligation to the control that covers it

Once a privacy obligation is dated and owned, this is where it gets checked against a real control and tested on a calendar.

Review a vendor's own data processing agreement

Checks a specific DPA against your retention windows and incident timings, the same commitments the Processor Register tracks.

More free templates

Compliance Policy and Attestation Template

Free compliance policy and attestation template: track every attestation against the exact policy version, not just whether one ever happened.

Compliance Program Documentation Template

Free compliance program documentation template: map every obligation to its control both ways, so gaps and orphan policies surface before a regulator does.

Internal Investigation Protocol Template

Free internal investigation protocol template: classify every witness into a warning tier before the first interview, not after.

Regulatory Inquiry Response Template

Free regulatory inquiry response template: map every numbered specification to its scope position and the documents that answer it.

Give every rights request its real statutory deadline

Take the Word documents and CSV sheets blank, or open this exact pack in River and describe which systems hold personal data.

Edit with AI