What needs to be documented?

The entire processing chain for personal data must be documented and the justification and purposes for collecting personal data must be specified in a Privacy Policy document.

What constitutes personal data?

Any information relating to an identified or identifiable natural person (name, identifiable photo, phone number, address, email address, IP address)

Who is responsible for the Privacy Policy?

The data controller is responsible for the Privacy Policy.