Engineering a Web-Based Generator for GDPR-Compliant Privacy and Legal Notices - A Case Study in a Large Research Organization

This paper presents a centrally hosted web application that supports the creation and maintenance of GDPR-compliant privacy notices and legal imprints (Impressum) within a large research organization. Researchers frequently need to establish institutional, departmental, project, or survey websites, yet typically lack up-to-date data protection expertise. The application addresses this gap through a guided, wizard-style process that generates compliant documents and serves them as centrally managed resources for dynamic embedding into external sites. This centralization enables the legal department to maintain authoritative content in a single location, with updates propagating automatically to all connected sites—reducing the risk of outdated or inconsistent information. We describe the requirements, system architecture, and technology stack; report initial adoption metrics and user feedback; and reflect on lessons learned regarding organizational integration and sustaining legal accuracy in an evolving regulatory environment.