The eleven mandatory items
- Identity and contact details of the controller
- Contact details of the DPO (if applicable)
- Purposes and legal bases for processing
- Legitimate interests pursued (if relevant)
- Recipients or categories of recipients
- International transfers and safeguards
- Retention periods or criteria
- Existence of data subject rights
- Right to lodge a complaint with a supervisory authority
- Whether provision is statutory or contractual
- Existence of automated decision-making, including profiling