What to include in a GDPR privacy policy (checklist)
A GDPR privacy policy must tell people who you are, why you use their data and on what legal basis, who receives it, whether it leaves the EEA, how long you keep it, which rights they have and how to complain. Write it in clear, plain language and keep it where people can find it before they share data.
A privacy policy, which the GDPR calls a privacy notice, is how you keep a promise the law makes on behalf of your customers: that they will be told what happens to their personal data. It is also the document a customer, a partner or a regulator reads first. This guide lists what Articles 12, 13 and 14 of the GDPR expect it to say, in the order that is easiest to read.
#Who has to publish a privacy policy?
Any organisation that collects personal data from people in the EU, whether it is a company, a freelancer, a non-profit or a website. If you collect names, email addresses, IP addresses through analytics, payment details or support messages, you are processing personal data and you have to inform the people concerned. The size of the business does not change this duty.
The law does not say "publish a page called Privacy Policy". It says the information must be provided, and a policy linked from your website footer, your sign-up forms and your emails is the usual way to do it.
#The checklist: what the GDPR asks you to say
| What to state | Where it comes from | In practice |
|---|---|---|
| Who you are and how to reach you | Art. 13(1)(a) | Company name, address, an email address a person can really use. Add your representative in the EU if you are based outside it. |
| Data protection officer contact, if you have one | Art. 13(1)(b) | Only if you appointed a DPO. Do not invent the role. |
| Why you use the data, and the legal basis for each purpose | Art. 13(1)(c) | One line per purpose: "to deliver your order (contract)", "to send our newsletter (consent)". |
| The legitimate interest, when that is your basis | Art. 13(1)(d) | Say what the interest is, in a sentence. |
| Who receives the data | Art. 13(1)(e) | Categories or names of recipients: payment provider, email service, hosting, analytics. |
| Transfers outside the EEA and how they are protected | Art. 13(1)(f) | Name the safeguard: adequacy decision, Standard Contractual Clauses, Data Privacy Framework. |
| How long you keep the data | Art. 13(2)(a) | A period, or the rule that decides it ("six years after the invoice, as accounting law requires"). |
| The rights people have | Art. 13(2)(b)–(c) | Access, rectification, erasure, restriction, objection, portability, and withdrawing consent at any time. |
| The right to complain to an authority | Art. 13(2)(d) | Say people can complain to their national data protection authority. |
| Whether giving the data is required | Art. 13(2)(e) | "We need your address to deliver the order" versus an optional field. |
| Automated decisions and profiling | Art. 13(2)(f), Art. 22 | Only if you take decisions with legal or similarly significant effects without a person: explain the logic and the consequences. |
When you obtain data from somewhere other than the person, for example a purchased list or a partner, Article 14 adds two items: the categories of data you hold and the source. You must inform them within a reasonable period, and at the latest one month after you obtain the data.
#When must the policy be shown?
At the moment you collect the data (Article 13), which means before the person submits the form, not after. In practice that is a link next to the form button and in the footer. A policy that nobody can find does not do its job, however good the text is.
#How should it be written?
Article 12 asks for information that is concise, transparent, intelligible, easily accessible and in clear and plain language. Four habits make a real difference:
- Write for a customer, not a lawyer. Short sentences, no legal Latin, "we" and "you".
- Layer it. A short summary at the top, details underneath, so a reader can stop at the depth they need.
- Describe what you really do. A policy copied from another company will list tools you do not use and miss the ones you do.
- Date it. Show when it was last updated, and keep the previous versions if something important changes.
#Common mistakes
- Listing "cookies" without a cookie policy. Say which cookies and trackers run and link to the place where people can choose. Our guide to what the rules ask of a cookie banner explains the consent side.
- Forgetting the tools. Every vendor that touches personal data is a recipient. A policy that omits your email platform, your analytics or your CRM is out of date on day one.
- Saying "your data may be shared with partners". Vague wording fails the transparency test. Name the category and the purpose.
- Missing the transfer. If a vendor processes data in the United States, the policy has to say how that transfer is protected. See international data transfers explained.
- Never updating it. The policy has to match what you do now. Adding a tool is a reason to review it.
#How often should you update it?
Whenever your practices change: a new vendor, a new purpose for the data, a new country, a new retention rule. A reasonable habit is to review it every time you add or remove a tool, and at least once a year. If a change is significant, tell the people affected rather than only editing the page.
#Do you also need a record of processing?
They are different documents. The privacy policy speaks to the public; the record of processing activities is an internal register for you and the authority. Both should say the same things, which is easier when they come from the same list of vendors and activities.
#FAQ
#Is a privacy policy mandatory under the GDPR?
If you process personal data of people in the EU, you must give them the information listed in Articles 13 and 14. A privacy policy that is easy to find is the standard way to do that.
#What is the difference between a privacy policy and a privacy notice?
In the GDPR context they mean the same thing. "Privacy notice" is the term closer to the law, "privacy policy" is the one most websites use.
#Do I need a privacy policy if I only use a contact form?
Yes. An email address and a message are personal data, and you use them for a purpose, so people have to be told who you are, why you use the data and how long you keep it.
#Can I copy a template from another website?
A template can give you the structure, but the content has to describe your own tools, purposes, recipients and retention. A copied policy that does not match reality is worse than a short accurate one.
#Does the privacy policy have to be in the language of my customers?
It has to be understandable to the people it addresses. If you market to customers in a given country, provide the policy in a language they read.
#Do I need to list every vendor by name?
The law allows categories of recipients, but naming the vendors is clearer and increasingly expected, especially for those outside the EEA. A published vendor list, kept in step with your policy, answers the question without cluttering the text.
#Sources
Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to antoine@unmake.io.