Custom legal document

GDPR Processing Register

Have it drafted, amended, or reviewed by our legal experts and/or lawyers starting from 99
SME Lawyers

Do not hastily put this document together yourself — a false sense of security is harmful.
Have a specialist screen it and be in a stronger position when it matters.

  • Truly Tailor-Made Legal Solutions
  • Fixed rates
  • Pay later after draft
  • Free adjustment round
  • Delivered within 5 working days
  • Express delivery possible
  • Available in Dutch and English

How does it work?
Our services include a free consultation, a draft document, a revision round, and a final document. We invoice after sending the draft document.

Experience with legal services for entrepreneurs since 2001
Lawyers and legal professionals.Direct contact with a specialist who thinks practically.
Fixed rates.Where possible, clarity regarding costs in advance.
Within 4 hoursWe respond quickly to your request.
  • We worked for, among others:
  • MKBjuristen.nl partner
  • MKBjuristen.nl partner
  • MKBjuristen.nl partner
  • MKBjuristen.nl partner

We worked for, among others:

An incorrect document often provides a false sense of security.
You think everything is taken care of, but only discover whether the document actually works during a conflict or claim.

1

Free intake

We discuss your company, the purpose of the document, and the key risks.

2

Draft or check

We draft a custom document or review your existing document legally.

3

Final version

You will receive a final version with instructions on correct usage.

Mr. Jaime Boogaers
Mr. Jaime Boogaers
Corporate Law
Attorney, 16 years of experience

A legal document must not only be legally correct. Above all, it must align with how the entrepreneur will actually use the document

  • Lawyers and in-house counsel
  • Active since 2001
  • Affordable custom legal services
  • Always focused on practical use

Choose Tailored Legal Solutions

Choose whether you want to have the document drafted, checked, or modified. Prices and options vary per document.

From 99
Customization
from 99.- per document

Do you already have a document, but are unsure if it is still correct? We check content, risks, and practical usability.

from 249.- per document

Is your document outdated, copied, generated with AI, or no longer suitable? We check and adjust the document.

About us

Our expertise

Our lawyers and in-house counsel specialize in drafting, reviewing, and amending legal documents and contracts. We look not only at the legal text but also at how you use the document in practice.

Custom solutions for your industry

Every business operates differently. That is why we take your industry, customers, working methods, and specific risks into account.

Our facts

  • Active since 2001
  • Lawyers and in-house counsel
  • Fixed rates in advance
  • Tailored legal solutions for entrepreneurs
  • Thousands of agreements per year
  • Customization
  • About us
from 99.- per document

Do you already have a document, but are unsure if it is still correct? We check content, risks, and practical usability.

  • Our legal expert spends 0.5 to 1.5 hours on the check
  • Telephone intake with a lawyer
  • Checks on content, risks, and practical usability
  • Attention to liability, payment, and termination
  • Concrete points for improvement and legal advice
  • Delivered within 3 working days, express delivery possible
from 249.- per document

Is your document outdated, copied, generated with AI, or no longer suitable? We check and adjust the document.

  • Our legal expert spends 1.5 to 2.5 hours checking and making adjustments
  • Telephone intake with a lawyer
  • Verification of the existing document
  • Adaptation to your business and working methods
  • Suitable for new services, customers, or risks
  • Delivered within 5 working days, express delivery possible

About us

Our expertise

Our lawyers and in-house counsel specialize in drafting, reviewing, and amending legal documents and contracts. We look not only at the legal text but also at how you use the document in practice.

Custom solutions for your industry

Every business operates differently. That is why we take your industry, customers, working methods, and specific risks into account.

Our facts

  • Active since 2001
  • Lawyers and in-house counsel
  • Fixed rates in advance
  • Tailored legal solutions for entrepreneurs
  • Thousands of agreements per year

Reviews (21)

Khalid

The initial sketch of the approach aligned seamlessly with what we had in mind. Despite the tight deadline, there was no compromise on care and quality. The final result fully meets our high standards.

Henk

I was struck by how customer-oriented the initial approach was. It was very pleasant that we could review the drafts digitally and quickly. Our business partners were impressed by the professionalism of the contracts.

Sebastian

The expertise was immediately evident from the first contact. The speed with which complex legislative changes were integrated into our document was excellent. Our clients are responding positively to the clear general terms and conditions.

Imran

The expertise was immediately evident from the first contact. The interim evaluation ensured that we remained perfectly aligned. A reliable partner striving for perfection in their documents.

Sarah

It was great that we could immediately brainstorm about the best approach. The attention to detail when reviewing the fine print was phenomenal. Fantastic value for money for this level of expertise.

Brahim

It was nice that potential pitfalls were proactively considered. The document was legally well-substantiated. Our business partners were impressed by the professionalism of the contracts.

Bjorn

The nuances of our business operations were listened to carefully. They immediately recognized where the sensitivities lay within our collaboration. Our business partners were impressed by the professionalism of the contracts.

Monique

The communication was smooth and professional. The advice regarding the collection terms in the terms and conditions was particularly useful for our cash flow. Fantastic value for money for this level of expertise.

Eva

It was nice that we knew immediately who would be helping us. The delivery was within the agreed timeframe. These documents will undoubtedly save us a lot of headaches in the future.

Sharon

The document aligned well with our wishes. They managed to get a stalled negotiation moving again by proposing a smart compromise. The final result meets our high standards 100%.

Rim

Professional approach without unnecessarily complicated language. We were given tight deadlines that were fortunately well adhered to on both sides. Our business partners were impressed by the professionalism of the contracts.

Mustafa

Our questions were taken seriously. They managed to get a stalled negotiation moving again by proposing a clever compromise. Our business partners were impressed by the professionalism of the contracts.

Sofiane

We were given the space to tell our entire story without being interrupted. The proactive approach went beyond just the legal framework; the business side was also addressed. Our business partners were impressed by the professionalism of the contracts.

Maaike

The professionalism shines through from the very first moment. Clauses were added that protect us against risks we did not foresee ourselves. A reliable partner that strives for perfection in their documents.

Michiel

Good service and a clear working method. The advice regarding the collection terms in the terms and conditions was particularly useful for our cash flow. The document was accepted flawlessly by our investors.

Aya

Communication was direct and efficient, exactly what we were looking for. The language in the contract was modern and clear, without archaic terms. The quality fully met our expectations.

Lotte

It felt good to be able to hand over the legal concerns immediately. We were able to easily add comments to the draft using a convenient system. Our business partners were impressed by the professionalism of the contracts.

Salma

They immediately started thinking in terms of solutions rather than problems. It was clearly indicated what we needed to pay attention to. A party that delivers on what it promises on its website.

Houda

We quickly received the right guidance in a legal landscape unfamiliar to us. Our questions were answered calmly and clearly. The quality fully met our expectations.

Zakaria

We came in with a vague idea, but were immediately presented with concrete steps. We received valuable tips on how to present the documents to our clients in practice. The quality fully met our expectations.

Tijn

The speed of action pleasantly surprised us. Communication was always handled through a single point of contact, which prevented confusion. The document was accepted flawlessly by our investors.

Meet our office

Our ContractCheck, simply explained what can all go wrong.

Why MKB Juristen?

Since 2001, we have been active as a no-nonsense legal firm for entrepreneurs. We quickly get to the heart of the matter: with a thorough assessment, clear answers, and a document that works practically.

  • Nationwide coverage
  • First consultation free and without obligation
  • Fixed rates where possible
  • Affordable legal advice from lawyers and legal experts
  • Always a response within 4 hours

First, see how we work

A legal document requires trust. You see immediately who we are, how we help entrepreneurs, and why we do not work with standard templates.

  • You can view our working method before submitting an application
  • You will get a feel for the office and the people faster
  • The video supports the choice for customized legal solutions
  • After that, you can immediately request a quote or intake

What you can expect from us

We translate your situation into a legal document that you can actually use. You won't receive a loose template, but a document tailored to your business, agreements, and risks.

  • A clear roadmap: intake, concept, revision round, and final version
  • Practical explanation on how to use the document
  • Legal attention to liability, payment, and termination
  • Where possible, provide clarity in advance regarding price and delivery time
Are you unsure whether you should have the document drafted, checked, or amended?
During the initial consultation, we will determine the sensible course of action together. Afterward, you will know exactly where you stand.

Why customization?

A legal document only works well if it aligns with your business, agreements, risks, and industry. That is why we do not work with a standard generator, but with legal experts who assess your situation.

  • Prepared for your company
  • Telephone consultation included
  • No standard template
  • Review by legal specialists

What do you get?

You will receive a legal document that is practical and aligns with the agreements you wish to make.

  • Draft document or legal review
  • One adjustment round
  • Clear explanation where necessary
  • Fixed price where possible

The founders of MKB Juristen

Our organization consists of several small teams working within various legal fields. Each legal field has its own senior in-house counsel and/or lawyers.

Denian Wielhouwer

Corporate lawyer in corporate law & business expert

Denian Wielhouwer

Annelore Hendriks

Corporate lawyer, corporate law, administrative law

Annelore Hendriks

Ilja van Driel

Corporate law attorney, employment law

Ilja van Driel

Jaime Boogaers

Corporate law, ICT & privacy law, energy law attorney

Jaime Boogaers
Custom choices

Which choices determine the content?

Before you complete the register, a few key questions determine its scope and depth. Your answers determine which processing operations you must record and in what detail.

Choice or question Why this matters legally
Are you a controller or a processor? A controller determines the purpose and means; a processor acts on instruction and maintains a different, more limited register.
Which processing activities have you mapped out? Inventory all processes involving personal data, from HR and marketing to IT and customer service.
Do you process special personal data? Data concerning health, race, or religion require additional safeguards and a stricter legal basis.
Do you engage processors or third parties? For external parties, you define the recipients and conclude a data processing agreement.
Is there a transfer outside the EEA? If so, you document the destination and the appropriate safeguards for that transfer.
Clauses and provisions

Which items belong in a GDPR processing register?

A processing register for a controller describes a fixed set of data for each processing activity. Below are the components to include, when they are relevant, and what to look out for.

Provision Relevant to Legal point of attention
Name and contact details of the person responsible Always List the organization and, if appointed, the Data Protection Officer (DPO) as the point of contact.
Purposes of processing Per activity Describe specifically why you process the data, for example, personnel administration or invoicing.
Categories of stakeholders and data Per activity Specify who is involved (customers, employees) and what types of data you process.
Recipients of the data Upon provision to third parties State to whom you provide data, including processors and any recipients outside the EU.
Transfer to third countries For exports outside the EEA State the country and the guarantee, such as model contract clauses or an adequacy decision.
Retention periods Data by category Specify how long you retain data or which criterion determines the period.
Technical and organizational measures General or by activity Describe the security in broad outlines, such as access control, encryption, and backups.
Basis for processing Per activity Indicate the legal basis, for example consent, agreement, or statutory obligation.
Use in practice

How do you use this document correctly?

The register is not a one-time document to be filled in, but a living overview. The steps below help you use it correctly and keep it up to date.

Situation What should you do? Point of attention
When drafting Inventory all processes and fill in the fixed fields for each activity This creates a complete picture and ensures you do not miss any processing.
In case of changes Update the register immediately after a new system, process, or supplier An outdated register gives an inaccurate picture and offers no protection.
Periodically Review the register comprehensively at least annually You ensure that purposes, bases, and retention periods remain correct.
Upon inspection Keep the register available to show to the AP upon request You demonstrably demonstrate that you comply with your documentation obligation.
Common mistakes

Common mistakes

Organizations frequently make mistakes when compiling a processing register. These errors undermine the value of the register and increase the compliance risk.

Wrong Consequence Better approach
Forgot to include processes The register is incomplete and gives a distorted picture Conduct a department-wide inventory and involve process owners in the inventory.
Describe goals too vaguely The basis and necessity cannot be verified Describe each goal concretely and link it to an appropriate basis.
Do not set retention periods Data is retained for too long, and this violates the retention obligation Determine a time limit or a clear criterion per category.
Do not update registry The document is becoming outdated and no longer offers protection Make updating part of change processes and the annual review.
Do not list processors Recipients are missing and the processor relationship is not secured Name all processors and conclude a data processing agreement with them.
Risk profile

What is your situation and what do you pay attention to?

The content of your register depends heavily on your situation. If you recognize yourself in one of the cases below, you know what to pay extra attention to.

Risk profile Example Focus in the document
Small business You process limited data, primarily from customers and staff Even with few processing operations, the registration requirement often applies; keep the overview compact but complete.
Many external suppliers You work with cloud, payroll, or marketing providers Identify all recipients and processors and safeguard processor agreements.
Special details You process, for example, health or criminal data Precisely define the basis and additional safeguards, and restrict access.
International activities You share data with parties outside the EEA Document the transfer and the guarantee, such as model contract clauses.
Additional documents

When is this document not enough?

A processing register documents your processing activities, but does not cover every GDPR obligation. You need additional documents in the following situations.

Situation Supplementary document Why
Situation Related document Explanation
You engage an external party that processes data for you Data Processing Agreement In this, you record the agreements with your processor regarding security and processing.
You share confidential information with another party Confidentiality Agreement This protects business-sensitive information separate from personal data.
You process data of your employees Employment contract In this, you regulate the employment relationship within which personnel processing takes place.
Explanation of this document

Setting up a GDPR Processing Register, why?

Not every entrepreneur knows exactly what a GDPR processing register is, when you need one, and which risks they must cover. That is why we explain below what this document entails, what you should look out for, and why legal customization is important.

What is a GDPR processing register?
A GDPR processing register — also known as a processing activities register or register of processing activities — is the internal document in which an organization records which personal data it processes, for what purpose, on what legal basis, for how long, and with whom it is shared. The register is mandatory under Article 30 of the General Data Protection Regulation (GDPR) and forms the core of the accountability obligation — the obligation of every organization to be able to demonstrate that it complies with the GDPR. The Dutch Data Protection Authority (AP) may request the processing register during an audit or investigation and consider its absence or incompleteness as evidence of structural non-compliance. The fines imposed by the AP for GDPR violations can amount to up to 20 million euros or 4% of the global annual turnover. A processing register is therefore not a mere paper exercise but an essential compliance instrument. Our lawyers draw up a complete and up-to-date GDPR processing register for your organization that aligns with your business processes, your industry, and the current interpretation of the DPA — and that protects you during a GDPR audit, a data breach, or a complaint from a data subject.
When are you required to maintain a processing register?
The obligation to maintain a processing register applies to virtually every organization. Under Article 30(5) of the GDPR, organizations with fewer than 250 employees are in principle exempt, but this exemption does not apply if the processing poses a risk to the rights and freedoms of data subjects, the processing is not incidental, or the organization processes special categories of personal data or criminal data. In practice, this means that virtually every organization must maintain a processing register. You are not processing incidentally as soon as you structurally process customer data, employee data, or supplier data — which every entrepreneur does. Special categories of personal data — health data, biometric data, data concerning race or religion — are already present as soon as you maintain personnel files regarding sick leave notifications. The Dutch Data Protection Authority (AP) confirms that the practical exception for small organizations is minimal. Our lawyers will assess for you which processing activities you must register.
What must be included in a processing register?
Article 30 of the GDPR prescribes the minimum information the processing register must contain. As a controller, you record: the name and contact details of the controller and — if appointed — the Data Protection Officer (DPO), the purposes of each processing operation, a description of the categories of data subjects and personal data, the categories of recipients to whom the data are disclosed, the expected retention periods, and — where applicable — the transfer of data to countries outside the EEA with the corresponding appropriate safeguards. As a processor , you record: your name and contact details, the name of the controllers for whom you process, the categories of processing operations you carry out on their behalf, and the security measures. A good processing register goes beyond these minimum elements: it also contains the legal basis for each processing operation — consent, contract, statutory obligation, legitimate interest — and the results of any Data Protection Impact Assessments (DPIAs). Our lawyers ensure that your register complies with GDPR requirements and serves as a useful compliance tool.
How do you identify which processing operations must be included in the register?
The processing inventory is the most time-consuming step in compiling a processing register. You must analyze which personal data is processed for each business process. The most common processing categories are personnel management — employment contracts, payroll administration, sickness and reintegration, performance reviews — customer relationship management — CRM systems, quotations, invoices, customer service — supplier management, marketing and communication — newsletters, social media, cookies and analytics tools — physical and digital security — CCTV, access control, computer surveillance — and financial administration. For each category, you must identify the purposes, the personal data involved, the legal basis, the retention period, and any processors for each processing activity. Our lawyers guide your organization through the inventory phase and ensure that all processing activities are fully documented.
How do you arrange the data processing agreements associated with the register?
The processing register does not stand alone: ​​it is closely linked to the data processing agreements you must conclude with all parties processing personal data on your behalf. Any cloud application that stores customer or employee data — your accounting package, your CRM, your HR system, your email service, your website hosting provider — is a processor with whom you must have a data processing agreement pursuant to Article 28 of the GDPR. Your processing register must name the processors for each processing activity. If a data processing agreement with one of your processors is missing, you run the risk of the Dutch Data Protection Authority (AP) holding you liable for a GDPR violation committed by the processor. Our lawyers draft both the processing register and the associated data processing agreements for you and ensure that they are aligned.
How do you keep the processing register up to date?
A processing register that is complete upon creation but is never updated offers no protection during an audit or data breach. The GDPR requires the register to be an up-to-date representation of all processing activities. This means that you must update the register for every new application or system that processes personal data, for every new category of processing you start, for changes in retention periods or recipients, for the termination of processing activities, and for organizational changes affecting the controller or the DPO. An annual review is the absolute minimum. In practice: designate an internal person responsible for maintaining the register and make updating the register part of your processes for new suppliers and new systems. Our lawyers advise you on a management structure for your processing register and draw up an update procedure.
What are the most common mistakes with GDPR processing registers?
In practice, our lawyers consistently observe the same shortcomings at organizations. The first is a register that contains only the most obvious processing activities and omits marketing tools, security cameras, and external HR systems. The second is the lack of a legal basis for each processing activity, meaning the register formally complies with Article 30 but cannot be used to defend the lawfulness of the processing. The third is an incorrect retention period that deviates from statutory retention obligations — Article 52 of the Dutch Tax Act (AWR) prescribes seven years for financial records, whereas the GDPR prescribes shorter periods for personal data. The fourth is the absence of a link to the data processing agreements for each processing activity, making the coherence between the register and the processor structure undemonstrable. The fifth is a register that has not been updated following a company acquisition, merger, or new application. And the sixth is a register that does not align with the privacy policy and privacy statement provided to data subjects.
How does it work at MKBjuristen?
After a brief intake, our lawyers map out your business processes, your application landscape, and your existing GDPR documentation. Based on a processing inventory, we draw up a GDPR processing register that is complete, contains the correct legal grounds, aligns with statutory retention periods, and is aligned with your processor agreements. We also provide a management protocol to help you keep the register up to date. Do you have an existing processing register that you would like to have checked for completeness and currency? We will then assess it against all GDPR requirements and draw up the necessary additions.
Are you unsure whether your document is legally correct? We would be happy to assess the sensible course of action: drafting, reviewing, or amending.
Request a quote

Why not use a standard document?

A standard document often seems like a quick solution, but usually does not fully align with your company, agreements, risks, and way of working. Our legal experts draft documents that fit your situation.

Standard document
SME Lawyers
Not tailored to your business
Tailored to your company, industry, and working methods
No control over your specific situation
Consultation with a lawyer and assessment of your risks
Possibly outdated or incomplete
Verification of current and practical provisions
No personal explanation
Explanation regarding the use of the document

A standard document seems cheap, until it doesn't fit your situation properly. That is why we provide custom legal solutions tailored to your business.

Custom solutions per industry and company

Every business operates differently and faces different legal risks. Therefore, we tailor the document to your industry, customers, agreements, and way of working.

Webshops & e-commerce

Focus on online sales, delivery, returns, complaints, payment, digital products, and consumer regulations.

Business services

Attention to the assignment, additional work, liability, payment, termination, and reliance on client information.

Construction, installation & execution

Attention to planning, delivery, warranties, additional work, materials, delays, and liability risks.

Software, SaaS & digital services

Attention to licenses, availability, support, updates, data, intellectual property, and limitation of liability.

Trade, supply & wholesale

Attention to delivery, transport, payment, retention of title, warranties, delivery times, and international agreements.

Consultants, freelancers & advisors

Attention to scope, best efforts obligations, cancellation, payment, liability, and confidential information.


A legal document only has value if it suits your practice. That is why we look not only at the text, but also at how you use the document in your business.

Common mistakes with legal documents

A legal document often seems simple, but small errors can have major consequences later on. In practice, we see that entrepreneurs run the greatest risk when a document does not align well with their business, agreements, or way of working.

  • Using a standard document that does not suit the company
  • Forgot important agreements regarding payment, delivery, liability, or termination
  • Have a document generated without legal review
  • Continuing to use old documents while the company has changed
  • Not knowing how the document should be used correctly in practice

A legal document only prevents problems if it suits your situation. That is why we look not only at the text, but also at your company, agreements, and risks.

Why is a standard document often not enough?

Because a standard document does not take into account your industry, customers, risks, and specific agreements, important provisions may be missing or not align well with your practice.

Can I create a legal document myself using AI?

AI can assist in creating text, but does not independently assess whether the document is legally appropriate, complete, and usable for your business. Legal review therefore remains important.

When do I need to have my document checked?

Have your document checked if your business has changed, you have new customers or services, you have doubts about existing agreements, or the document has not been updated for a long time.

Will I also receive an explanation about the use of the document?

Yes. We explain how to use the document in practice, what to look out for, and which steps are important to prevent disputes afterwards.

Contact us

Annelore Hendriks

Want to know more about our services?
Then contact our specialists.

Newsletter for entrepreneurs

Receive practical legal tips in your mailbox

Register now

Enter your email address and receive our newsletter.

No spam. Only legal tips.
By registering, you agree to our privacy statement.
SME Lawyers at the Chamber of Commerce Source: Chamber of Commerce 2019
Free consultation