Clients now ask for a DPA before they sign.
A privacy-aware client wants to know who touches their site and ad accounts, which tools you use, and what happens to their data when the project ends. An agency that can answer clearly, and hand over a site that is set up properly, is easier to hire and harder to replace.
You are two things at once
For your own staff, leads and client contacts you are a controller. For client customer data you manage on their behalf you are usually their processor. The pack keeps the two roles apart.
Tool sprawl is the risk
Pixels, ad accounts, heatmaps, email platforms, design tools and freelancers all touch client data. The checklists tell you what to check for each, and who should have access.
Handover without the guesswork
Cookie banners, consent set-up, forms and policies are where agency-built sites go wrong. A launch and handover checklist makes the steps repeatable.
Seven parts. One agency-ready baseline.
Each part stands on its own and also points to the next: the clauses name your sub-processors, the DPA checklist formalises them, and the client report shows the result.
Agency-specific privacy policy clauses Ready to copy
Drop-in wording with fill-in placeholders, one block per topic.
- Client project data and contact information
- Analytics and advertising pixels set up for clients
- Sub-processors used on client work (hosting, CRM, email, design tools)
- Employee and contractor access to client accounts
- Retention of project files and client data after a project ends
- How you handle client customer data when you manage their site or campaigns
Simple ROPA starter for a typical agency
A pre-filled Record of Processing Activities. Edit, don't invent.
- Client onboarding and contract management
- Website and campaign management for clients
- Analytics and ad account access
- Invoicing and project communication
- Sub-processor management
- Employee and freelancer data
- Suggested legal bases, data categories, retention periods and recipient lists for each
Client DPA & processor checklist
For when you act as processor for a client.
- Template clauses or a checklist for a Data Processing Agreement
- Questions to ask clients about their own compliance
- The common agency tools, and what to check for each
- A simple process for adding or removing a sub-processor
Client website handover checklist
Practical steps when you build or manage a client site.
- Cookie banner and consent setup
- Privacy policy and cookie policy in place
- Analytics configured with consent mode (if used)
- Contact forms and lead capture documented
- What to hand over to the client at the end of the project
White-label client report template
A short report format you can send under your own name.
- Summary of compliance gaps found on their site
- Priority fixes
- What the agency has already implemented
- Recommended next steps for the client
Employee & freelancer access rules
Keep client accounts in the right hands.
- Who should have access to client ad accounts and analytics
- How to revoke access when someone leaves
- Basic rules for handling client data
30-day action plan for an agency
A short, prioritised list so the work actually gets done. See the plan below.
- Week by week, in the order that matters to clients
- Each week ends with something you can show a client
Real wording, not a table of contents.
Two short excerpts from the pack. Highlighted fields are the parts you fill in for your own agency.
When we manage a client's website or campaigns
When we build or manage a client's website, analytics or advertising, we may handle personal data about that client's own customers and visitors, such as form submissions, analytics data and ad audiences. In that case the client is the controller and we act as its processor under a written data processing agreement. We process this data only on the client's documented instructions, limit access to the team members who need it for the project, and use sub-processors only as set out in that agreement.
Questions about how we handle client data can be sent to [privacy@youragency.eu].
The full pack adds the controller-side wording for your own leads and staff.
Client onboarding and contract management
| Role | Controller |
|---|---|
| Purpose | Assess enquiries, agree scope, sign and administer client contracts |
| Legal basis | Art. 6(1)(b) contract or pre-contract steps; Art. 6(1)(f) for business contacts |
| Data subjects | Client contacts and decision-makers |
| Categories | Name, work email, phone, job title, company, contract details |
| Recipients | CRM, e-signature tool, accountant |
| Retention | Contract term plus [statutory period] |
Client-side work is recorded separately, as a processor.
These are shortened starting points. Your own policy and records must reflect how your agency actually works, and the pack shows you where to check.
From scattered habits to a repeatable client process.
Prioritised for a small agency with no dedicated compliance person.
Fix your own house
- Update your own privacy policy
- List your main sub-processors
Record and paper it
- Create or update your ROPA
- Prepare a standard client DPA
Build it into delivery
- Add compliance steps to your website launch checklist
Review what's live
- Review current client sites
- Prepare simple handover notes
Who it's for, and who it isn't.
A good fit if you
- Run a web, marketing or design agency, or a freelance team
- Manage client sites, ad accounts, analytics or email tools
- Work with freelancers or contractors who access client accounts
- Have no in-house privacy counsel
Not enough on its own if you
- Process special-category data for clients (health, biometrics)
- Build or run large-scale profiling or data-broker services
- Need a signed, lawyer-reviewed contract; the pack is not legal advice
- Are a SaaS product company: see the SaaS Compliance Pack
Seven parts. One payment.
Everything on this page, delivered together. Adapt it to your agency, send the DPA and report to clients, and answer the next compliance question from the same documents.
- Agency privacy policy clauses
- ROPA starter with six pre-filled activities
- Client DPA & processor checklist
- Client website handover checklist
- White-label client report template
- Employee & freelancer access rules
- 30-day action plan
Before you ask —
Who is the Agency Compliance Pack for?
Web, marketing and design agencies, and freelancers who run teams, that build or manage client websites, ad accounts and analytics and so handle client customer data.
What do I receive?
Seven parts: agency-specific privacy policy clauses, a pre-filled ROPA starter, a client DPA and processor checklist, a client website handover checklist, a white-label client report template, employee and freelancer access rules and a 30-day action plan. You get your download page straight after checkout, with no account to create.
Is an agency a controller or a processor?
Usually both. For your own staff, leads and clients' contact details you are a controller. When you build or manage a client's website, analytics or campaigns and handle their customers' data on their instructions, you are generally the client's processor, which is why a written DPA is needed. The pack keeps the two roles apart.
Is this legal advice?
No. The pack is a practical starting point for agencies. The clauses, records and DPA checklist are drafts you adapt to how you really work. Have a qualified lawyer review any agreement before you rely on it.
Is the DPA a finished, signable contract?
The pack gives you template clauses and a checklist of what a processor agreement needs, so you can start from a sound structure. It is not a lawyer-reviewed contract. Our separate GDPR DPA Template Pack covers the full document.
What if it isn't what I expected?
Email hello@gdprgard.eu within 14 days for a full refund. No form to fill in.
Give clients the answer before they ask.
Get the clauses, records, DPA checklist and handover steps in one pack and run every client project the same way.
Get the Pack — €39