What is a privacy center, and what should it include?

When a prospect evaluates your product, the privacy questions arrive early: where is our data stored, who else touches it, do you have a data processing agreement, how do I ask for my data? A privacy center answers them in one place, in public, without anyone writing the same email for the fifth time.

#What is a privacy center?

A privacy center is a page, usually on its own address such as privacy.yourcompany.com or a page hosted for you, that gathers everything a person might want to know about how you handle personal data:

• your privacy policy and cookie policy,
• the list of vendors, also called sub-processors, with what each one does and where it stores data,
• your data processing agreement, for customers who need one,
• how to contact you about privacy,
• a way to exercise their rights, such as a request form,
• optionally, the security practices and certifications you can honestly claim.

It is related to a trust center, which focuses on security evidence such as audits and penetration tests. A privacy center focuses on personal data: what you collect, who receives it and what people can do about it. Small businesses often start with the privacy center, because it needs facts they already have.

#Why would a customer want one?

• It answers the questionnaire. Security and privacy questionnaires ask the same things. Pointing to a page is faster than filling in a spreadsheet.
• It is what the law is asking for. Articles 12 to 14 of the GDPR ask for transparency that is easy to find and easy to understand. A vendor list and a clear contact point are part of that.
• It shows your sub-processors. Under Article 28, a processor has to give its customers a way to know about and object to sub-processors. A public list, with changes dated, does that well.
• It makes rights requests easier. A form with a reference number and a receipt is better for the person, and for you, than a message lost in a shared inbox.
• It builds trust. A company that explains what it does with data stands out from one that hides it in a footer.

#What to put on it

#1. A short, honest introduction

Two or three sentences on how you protect personal data, in your own voice. Avoid slogans and promises you cannot prove.

#2. Your documents

The privacy policy, the cookie policy, and the data processing agreement if you act as a processor. Show the date each was last reviewed, and only publish the ones you have actually checked and approved.

#3. Your vendors, with locations

For each vendor: its name, what it does for you, the kind of data it handles and the region where data is stored. A table is enough. If a vendor processes data outside the EEA, say how the transfer is protected. See our guide to international data transfers.

#4. A way to contact you

A real email address and, if you have one, your data protection officer. Say how fast you answer.

#5. A request form

Let people send access, erasure and other requests in one step. Each request should get a reference number and an automatic receipt, with the deadline counted internally. Our guide to responding to access requests shows what happens next.

#6. Cookie choices

A link to change cookie settings at any time, which the law expects anyway.

#What not to put on it

• Claims you cannot prove. "Fully compliant", "100% secure" and "certified" are risky unless true and evidenced. Say what you do, not what you are.
• Drafts. A policy that has not been reviewed should not be public.
• Marketing copy. The page is for people who want facts.
• A stale vendor list. An outdated list is worse than none, because it tells people something false.

#Keeping it accurate

A privacy center is only as good as the facts behind it. The risk is drift: you add a tool, but the page still shows last year's list. Three habits help:

1. Generate it from the same data as your other documents, so a vendor is added once and appears everywhere.
2. Publish deliberately. Treat updating the public page as a step you take after reviewing, not an automatic mirror of every edit.
3. Show dates. "Last updated" lets a reader judge freshness, and gives you a reason to review.

#An example

We keep ours at privacyboard.io/c/privacyboard: the policy, the list of providers with their regions and a request form, in a light or dark theme that follows the visitor's device.

#FAQ

#Is a privacy center required by law?

No. The law requires that you give people certain information and let them use their rights, and a privacy center is a convenient way to do both. You can also meet the requirement with a privacy policy and a contact address.

#What is the difference between a privacy center and a privacy policy?

The policy is one document. The privacy center is the page that brings the policy together with your vendors, your agreements and your request form.

#How is it different from a trust center?

A trust center usually centres on security evidence, such as audit reports. A privacy center centres on personal data handling. Many companies end up with both, linked together.

#Should the vendor list be public?

Publishing it is good practice and expected by many customers. If a vendor's identity is sensitive for security reasons, you can describe it by category instead.

#Do I need my own domain?

It looks more credible on a subdomain of your own site, but a clearly branded page at a stable address works too, as long as your website links to it from the footer.

#How often should I update it?

Whenever you add or change a vendor, a document or your contact details, and after each review. A date on the page keeps you honest.

#Sources

• Regulation (EU) 2016/679 (GDPR), Articles 12 to 14, 15 to 22 and 28, EUR-Lex