GDPR Overview
The General Data Protection Regulation (GDPR) governs the processing of personal data and provides individuals in the European Economic Area with defined privacy rights. It may apply to organizations established in the EEA and, in certain circumstances, to organizations outside the EEA that offer goods or services to, or monitor the behavior of, individuals in the EEA.
vScrawl is designed to support responsible handling of personal data within electronic-signature and document-workflow processes. Customers remain responsible for determining their own controller or processor obligations and configuring the Services accordingly.
Core GDPR Principles
| Principle | What It Requires |
|---|---|
| Lawfulness, fairness, and transparency | Process personal data on a valid legal basis, treat individuals fairly, and provide understandable information about processing. |
| Purpose limitation | Collect personal data for specified, explicit, and legitimate purposes and avoid incompatible further use. |
| Data minimization | Use only personal data that is adequate, relevant, and necessary for the intended purpose. |
| Accuracy | Take reasonable steps to keep personal data accurate and correct or remove inaccurate data. |
| Storage limitation | Keep identifiable personal data only for as long as necessary for the stated purpose and applicable obligations. |
| Integrity and confidentiality | Use appropriate security to protect personal data against unauthorized access, loss, alteration, or destruction. |
| Accountability | Be able to demonstrate compliance through policies, records, contracts, assessments, and appropriate controls. |
Roles in a vScrawl Workflow
In many customer workflows, the customer determines why and how personal data is processed and acts as the data controller. vScrawl may act as a processor when it handles personal data on the customer’s documented instructions.
For website administration, account management, billing, security, and direct business operations, vScrawl may process certain information for its own purposes and may act as a controller for that processing.
Lawful Bases for Processing
Organizations must identify an appropriate legal basis before processing personal data. The correct basis depends on the purpose and relationship with the individual.
- Contract: Processing necessary to perform or enter into a contract.
- Legal obligation: Processing required to comply with applicable law.
- Legitimate interests: Processing necessary for a legitimate interest that is not overridden by individual rights.
- Consent: Freely given, specific, informed, and unambiguous agreement that can be withdrawn.
- Vital interests: Processing necessary to protect a person’s life or physical safety.
- Public task: Processing necessary for an official function or task in the public interest.
Individual Rights Under the GDPR
Rights are subject to conditions and exceptions. Requests should be assessed according to the organization’s role and applicable law.
Right to Be Informed
Individuals should receive clear information about what data is collected, why it is used, and who receives it.
Right of Access
Individuals may request confirmation and a copy of eligible personal data.
Right to Rectification
Inaccurate or incomplete personal data may be corrected.
Right to Erasure
Eligible data may be deleted where no overriding legal or operational reason requires retention.
Right to Restriction
Individuals may request limited processing in defined circumstances.
Right to Portability
Certain data may be provided in a structured, commonly used, machine-readable format.
Right to Object
Individuals may object to processing based on legitimate interests or direct marketing.
Automated Decisions
Individuals have protections concerning decisions based solely on automated processing that produce legal or similarly significant effects.
How vScrawl Supports Privacy Rights
vScrawl provides administrative and document-management capabilities that can assist customers when responding to valid privacy requests. Available functions depend on permissions, retention settings, deployment, and customer configuration.
- Search for and review account, document, and workflow information.
- Correct eligible profile or account information.
- Export documents, audit evidence, and relevant records.
- Delete or restrict eligible information where permitted and technically supported.
- Manage user access, roles, authentication, and account lifecycle.
- Document actions and maintain evidence of privacy-request handling.
Data Protection by Design and Default
Privacy and security should be considered when selecting data fields, recipients, access permissions, authentication methods, retention periods, integrations, and document workflows.
Customers should minimize personal data, avoid unnecessary sensitive information, restrict access, and select configurations appropriate to the risk of the transaction.
Security of Personal Data
vScrawl applies technical and organizational controls intended to protect service data. Measures may include encryption, authentication, role-based permissions, audit logging, secure development practices, monitoring, backup, and incident-response procedures.
Customers share responsibility for endpoint security, user access, recipient verification, document contents, integration credentials, and on-premise or customer-managed infrastructure.
International Data Transfers
Where personal data is transferred from the EEA to a country without an applicable adequacy decision, an appropriate transfer mechanism and supplementary safeguards may be required.
Depending on the service arrangement, mechanisms may include Standard Contractual Clauses, approved binding corporate rules, an applicable certification framework, or another lawful derogation or safeguard. Customers should review data location and subprocessors relevant to their deployment.
Data Processing Agreements and Subprocessors
Where vScrawl processes personal data on behalf of a customer, the parties may enter into a Data Processing Agreement describing instructions, confidentiality, security, subprocessors, assistance, deletion, and audit-related obligations.
vScrawl may use subprocessors to support infrastructure, communications, security, billing, or other service functions. Appropriate contractual and security reviews should apply according to the nature of the processing.
Retention and Deletion
Personal data should not be kept longer than necessary for the relevant purpose, legal requirement, dispute, or contractual obligation. Customers should define retention periods for documents, audit trails, user records, and workflow data.
Deletion may be limited where law, litigation holds, fraud prevention, security, backup cycles, or contractual obligations require continued preservation.
Personal Data Breaches
vScrawl maintains procedures for assessing and responding to suspected security incidents. Where vScrawl acts as a processor, it will notify the relevant customer according to applicable contractual and legal requirements after becoming aware of a qualifying personal-data breach.
Controllers are responsible for assessing whether supervisory-authority or individual notification is required and for meeting applicable timelines.
Customer Responsibilities
Using a GDPR-supporting platform does not by itself make an organization compliant. Customers must establish their legal basis, notices, policies, contracts, retention rules, request procedures, security measures, and accountability records.
- Provide transparent privacy information to signers, users, and recipients.
- Collect only data required for the document or workflow.
- Configure authentication and permissions according to risk.
- Review subprocessors, transfer mechanisms, and data locations.
- Respond to privacy requests and maintain appropriate records.
- Conduct Data Protection Impact Assessments where high-risk processing requires them.
- Consult legal or privacy professionals for sector-specific obligations.
GDPR FAQs
Does using vScrawl automatically make an organization GDPR compliant?
No. vScrawl provides features and controls that can support compliance, but each organization must determine and fulfill its own controller or processor obligations.
Is vScrawl a controller or processor?
The role depends on the processing activity. vScrawl may act as a processor for customer documents and workflows and as a controller for certain account, billing, security, and website operations.
Can vScrawl help with data-subject requests?
Administrative search, access, export, correction, deletion, and permission functions may assist, subject to configuration, legal exceptions, and the customer’s role.
Does the GDPR require all data to remain in the EU?
No. Transfers outside the EEA can occur when an adequacy decision, approved safeguard, or valid derogation applies. The transfer must preserve an essentially equivalent level of protection.
How long should signed documents be retained?
The GDPR does not prescribe one universal period. Retention should reflect purpose, legal obligations, limitation periods, evidentiary needs, and customer policy.
Can sensitive personal data be included in documents?
Only where a valid Article 9 condition or other applicable basis exists and appropriate safeguards are used. Customers should avoid unnecessary sensitive data.
Privacy Questions
Questions about privacy or data-protection practices may be sent to info@dictalabs.com.
This overview is general information and not legal advice. Last updated: August 4, 2026
