What is a privacy policy?
A privacy policy, also called a privacy notice or privacy statement, is the text in which you tell people what you do with their personal data. On a website it is usually a separate page, linked in the footer.
The obligation comes from the GDPR. Article 12 says the information must be given in a concise, transparent, intelligible and easily accessible form, in clear and plain language. Articles 13 and 14 list what you must say: article 13 when you collect data from the person, for example through a form, and article 14 when you get the data from someone else. The information must be given free of charge.
In the UK the same rules apply through the UK GDPR and the Data Protection Act 2018. The differences are explained in the UK chapter below.
What must be in it?
When you collect personal data from someone, article 13 requires this information:
- Who you are: the name and contact details of your organisation, and of your representative if you are based outside the EU but offer goods or services there.
- Your data protection officer, if you have one, with contact details.
- The purposes and the legal basis. For each purpose, which legal basis you rely on: consent, a contract, a legal obligation or legitimate interests. The European guidelines on transparency stress that the purposes and the legal basis must be clear.
- Your legitimate interests, if that is your legal basis. Name the specific interest.
- Recipients: who receives the data, including processors such as your hosting or email provider. According to the guidelines, naming the actual recipients is generally the most meaningful; if you only give categories, make them as specific as possible.
- Transfers outside the EU or EEA: that the transfer takes place, whether there is an adequacy decision and, if not, which safeguard you use and how people can get a copy. The guidelines say the countries should generally be named.
- How long you keep the data, or the criteria for deciding that. "As long as necessary" is not enough, according to the guidelines.
- The rights of the person: access, rectification, erasure, restriction, objection and data portability.
- The right to withdraw consent at any time, where you rely on consent.
- The right to complain to a supervisory authority.
- Whether people must provide the data, for example because you need it for a contract, and what happens if they don't. The guidelines add that online forms should show clearly which fields are required.
- Automated decision-making, including profiling, if it has legal or similarly significant effects, with meaningful information about the logic and the consequences.
The right to object deserves extra attention: article 21 requires that it is brought to people's attention explicitly, clearly and separately from other information, at the latest at the first communication with them.
Where to show it
Article 13 requires the information at the time you collect the data. The European guidelines on transparency, endorsed by the EDPB, explain what that means on a website:
- A link on every page. Every website should publish a privacy statement, with a direct link that is clearly visible on each page, under a commonly used name such as Privacy or Privacy policy. A link that is hard to see because of its position or colour does not count as easily accessible.
- At the point of collection. As best practice, put a link to the privacy policy next to each form that collects personal data, or give the information on the same page.
- Not hidden in the terms and conditions. People must not have to search for it among other information.
- Layered if it is long. A layered privacy statement lets people jump to the part they need instead of scrolling through all of it. The complete information should still be available in one place.
- In the visitor's language, if you target people who speak other languages, with an accurate translation.
Privacy policy, cookie policy and cookie banner
The three do different jobs:
- The cookie banner asks for consent before you place non-essential cookies, and links to the details.
- The cookie policy explains which cookies and similar technologies you use, who sets them and how long they last.
- The privacy policy covers all personal data you process, also outside cookies: forms, orders, newsletters, customer service.
They should refer to each other. Your privacy policy mentions analytics and marketing tools, the legal basis (usually consent) and any transfers outside Europe, and links to the cookie policy for the cookie details. The cookie banner links to both. Withdrawing consent must be as easy as giving it, so tell people in both texts where they can change their cookie choice.
Cookie Confirm shows a banner that records each visitor's consent and links to your cookie policy and privacy policy.
Extra for webshops
A webshop processes more data than an ordinary website, so its privacy policy needs more:
- Orders: the data you need to deliver, on the legal basis of the contract. Say that you can't deliver without it.
- Invoices: tax law requires you to keep them for a fixed period. The legal basis is a legal obligation; put the period that applies in your country in the policy.
- Payment: name the payment provider and say whether you receive card or bank details yourself.
- Delivery: name the carriers that receive the delivery address.
- Newsletter: you normally need consent to send marketing emails. There is one exception in the ePrivacy Directive: you may email your own customers about your own similar products, if they can object free of charge and in an easy way when you collect their email address and in every message. Say in your privacy policy which of the two you rely on.
- Reviews: if a review service invites customers after a purchase, name it and say which data you share with it.
- Customer accounts: say how long you keep an account and what happens after inactivity.
Common mistakes
- Copying a generic text. A privacy policy from another website or a generator describes other tools and other data. If it doesn't match what your site really does, it is not transparent.
- Vague purposes. The European guidelines give examples of phrases that are not clear enough, such as using data to develop new services, for research, or to offer personalised services, without saying what that means.
- No legal basis per purpose. One general sentence such as "we process data on the basis of the GDPR" says nothing.
- US tools without transfer information. Analytics, email marketing and hosting are often American. Name the provider, the country and the safeguard, such as the EU-US Data Privacy Framework or standard contractual clauses.
- "As long as necessary." Give a period or the criteria.
- No mention of the regulator. People must be told they can complain to a supervisory authority.
- Outdated. Every new plugin, tool or processor can change what you need to say.
The UK: UK GDPR and the ICO
In the UK, the right to be informed comes from the UK GDPR, together with the Data Protection Act 2018. The list of what to include is the same as above; the ICO's guidance on the right to be informed sets it out in the same way. The main differences for a UK privacy notice:
- The regulator is the ICO. If you are based in the UK or regularly collect data from people in the UK, tell them they can complain to the Information Commissioner's Office and give its contact details.
- Complaints to you first. Since 19 June 2026, the Data Protection Act 2018 gives people the right to complain to the organisation itself, and you must make that easy, for example with an electronic complaint form, and acknowledge a complaint within 30 days. The ICO says you should tell people at the point of collection, for example in your privacy notice, that they can complain to you and to the ICO.
- Transfers under UK rules. The UK has its own adequacy regulations, which cover the EEA countries, and for the US the UK Extension to the EU-US Data Privacy Framework. Otherwise you use the ICO's International Data Transfer Agreement or the Addendum to the EU standard contractual clauses.
- A representative, if you are based outside the UK but offer goods or services to people in the UK or monitor their behaviour.
The ICO offers a free privacy notice generator for sole traders, start-ups, small businesses and charities. The ICO notes that its guidance on the right to be informed is under review because of the Data (Use and Access) Act 2025. If you serve both the UK and the EU, one privacy policy can cover both; name the regulators and the transfer safeguards for each.
The template
Below is a template you can copy. Fill in everything between [brackets], remove the sections you don't need and add any processing that is missing, so that the text describes what your website really does. A template is not legal advice: if you are unsure whether it fits your situation, have it reviewed by a lawyer.
Sources
- GDPR, articles 6, 7, 12, 13, 14, 21, 27 and 77
- Article 29 Working Party: Guidelines on transparency under Regulation 2016/679 (WP260 rev.01)
- EDPB: Endorsed WP29 guidelines
- ePrivacy Directive 2002/58/EC (consolidated), article 13
- ICO: What privacy information should we provide?
- ICO: Create your own privacy notice
- ICO: What's the right way to handle a data protection complaint?
- Data Protection Act 2018, section 164A
- ICO: A brief guide to international transfers
- ICO: How does the UK Extension to the EU-US Data Privacy Framework work?
- European Commission: Adequacy decision for the EU-US Data Privacy Framework