The introduction of the EU’s GDPR has brought about a significant evolution in the privacy-legal landscape. The shift from the “digital era” to the “digital privacy era” has given individuals greater control over their personal data. GDPR emphasizes the importance of data transparency and requires businesses to provide clear information regarding their data practices to individuals. Therefore, having a comprehensive privacy policy is not only a legal requirement but also a strategic asset for businesses.

What is a privacy policy?

A privacy policy is a public document that elaborates on how controllers process personal data, the categories of personal data collected, the purpose for processing, data subject rights, and related information to individuals. In simple terms, it serves as a guide for the data subjects to understand how an organization processes their personal data and what they can do about it.

Privacy laws across the world including GDPR emphasize the need to provide a privacy policy to users. It ensures fair and transparent data processing.

A privacy policy is also known as a privacy notice, privacy statement, data protection notice, etc.

Who should display a privacy policy under GDPR?

Data controllers in the European Union or overseas, who process the personal data of EU residents should provide a privacy policy. A data controller is any entity that decides the purpose and nature of processing personal data—for example, businesses. 

Know if GDPR applies to you: GDPR compliance checklist

Articles 13 and 14 of the GDPR enumerate the information to be included in a privacy policy. The regulation also prescribes the guidelines to be followed in Article 12

If you collect the personal data of Europeans, you must provide a privacy policy regardless of where your location is.

Penalties for violation of GDPR can be up to €20 Million or 4% of the global annual turnover. 

Create a GDPR privacy policy
for free!

Create Privacy Policy for Free

No signup required

What are the GDPR privacy policy requirements?

GDPR imposes strict requirements for privacy notices. Following are the guidelines/requirements to be observed while drafting a privacy policy under GDPR: 

  • Do not charge a fee to access the privacy policy.
  • It should be concise and provided conspicuously.
  • Always use plain language and avoid jargon.
  • Privacy policies must be in writing. 
  • If required, privacy policies can also be provided in other forms (Eg: by electronic means).
  • Privacy policy can also be orally provided if there is a verifiable request from the data subject (user).
  • If possible, combine the information provided with a standard and meaningful icon for easy understanding. The icon must be machine-readable.
  • If personal data is collected from the data subject, the privacy policy should be provided at the time of collection.
  • If the personal data is collected from other sources, the privacy policy should be provided within a reasonable time not exceeding 30 days.

It is best to avoid using vague words like may, might, often, etc to ensure clarity in the privacy policy. Additionally,  if you want to use the personal data for a new purpose, inform the data subject about it before further processing.

What are the key components of a privacy policy under GDPR?

A privacy policy is the key to fair and transparent data handling. Therefore, it is pertinent to include accurate and relevant information in it. The following are the key ingredients of an ideal privacy policy for your organization. 

Identity and contact information

Provide the legal/business name of the controller and the contact details in the privacy policy. It could be an email ID, contact number, address, etc. In addition, include the contact details of your data protection officer and representatives of your business, if applicable. Let us take a look at how Meta shares their contact information.

GDPR privacy policy-contact information

Categories of personal data

The privacy policy must contain all the categories of personal data you collect from the data subjects including cookies and IP addresses. 

Some examples of categories of personal information are location information, contact information, payment and transaction information, usage information, etc. These categories will mostly depend upon your business. Here is how CookieYes fulfills the requirement.

GDPR privacy policy- collected personal data

Data processing

A privacy policy must also contain why the personal data is processed, where it is processed, etc. This will depend upon many factors such as your business type, the information you collect, the purpose of collection, etc. For instance, here is how KFC describes it in their privacy policy.

GDPR privacy policy- use of personal data

Cookies and tracking technologies

Almost all online platforms use cookies and other tracking technologies to improve their functionality. It is pertinent to inform your customers about how and why you use it. Look at this example from the Volkswagen’s website.

GDPR privacy policy-cookies and tracking technologies

Specific purposes and legitimate interests

It is important to include the specific purpose for processing the personal data and its lawful basis. The lawful basis for processing can be a contract, consent, legitimate interest, etc. A specific purpose may be to verify the identity, send the latest updates, etc.

If there is a legitimate interest in the processing, you must mention it specifically.

CookieYes has a dedicated table in our privacy policy for the list of purposes and legitimate interests.

GDPR privacy policy legitimate interest

Data sharing

GDPR requires businesses to inform data subjects about who has access to their personal data. Therefore include the recipients and the categories of recipients in the privacy policy. Volkswagen’s privacy policy accommodates the requirement like this.

GDPR privacy policy- disclosure of personal data

Cross-border transfer

If the personal data collected from your users are transferred internationally, it should be specified in the privacy policy along with the implemented safeguards.

The law also requires businesses to mention how a copy can be obtained or how the information relating to the transfer can be accessed. For example, Forbes describes the cross-border transfer in their privacy policy this way.

GDPR privacy policy- cross border transfer

Data retention period

If you have already decided for how long the personal data will be retained, it must be provided in the privacy policy. If not, mention the criteria used to decide that period. Here is an illustration from Decathlon’s website.

Rights of data subjects

GDPR gives the control of personal data to the data subjects by giving them various rights. However, if they are unaware of the guaranteed rights, it would be of no use. That is why, businesses should provide the rights to request access, erasure, correction, and restriction in addition to the right to portability and right to object in the privacy policy. 

The privacy policy must also contain information regarding the right to complain to the supervisory authority. Below is an illustration from the iapp’s privacy policy.

GDPR privacy policy data subject rights

Data requirements and consequences

Incorporate the reason for requiring personal data in the privacy policy. It can be a contractual or a statutory requirement. This is usually provided under the heading ”uses of personal data”.

Furthermore, inform the data subjects whether the personal data is necessary and the consequences if they refuse to provide it.

GDPR privacy policy- consequences for not providing personal data

Consent withdrawal

Inform the data subjects that they have the right to withdraw consent from the processing of their sensitive data or if the lawful basis of processing is consent. Also, mention the process for withdrawal of consent.

GDPR privacy policy- consent withdrawal

Automated decision making

GDPR requires businesses to inform the data subjects whether they would use personal data for automated decision-making including profiling. Also, include its consequences as well as its significance. This can be commonly found under the heading “uses of personal data” on online platforms related to marketing, insurance, etc. For instance, Target’s website provides an example of how you can present this information in a privacy policy.

GDPR privacy policy-automated decision making

Information collected from other sources

There is a provision under GDPR that applies to personal data not collected directly from the data subjects. You must specify the source and indicate whether it is publicly available if you collect personal data from sources other than the individual. Here is an example from CookieYes.

GDPR privacy policy- personal data from other sources

Other components

In addition to all the above requirements, you may also provide the date of publication of the privacy policy. Avoid any jargon or include a dedicated section for the definitions of jargon.

Your privacy policy should be written in a way that is easy to understand, even for children.

How to create a GDPR-compliant privacy policy?

You can create a privacy policy using any of the following methods:

Online tools

This is the easiest and most convenient way to create a privacy policy. You can resort to CMPs like CookieYes to publish a GDPR-compliant privacy policy. The free privacy policy generator of CookieYes is reliable, no-cost, hassle-free, and easily customizable.

Create a GDPR privacy policy
for free!

Create Privacy Policy for Free

No signup required

Privacy policy templates

Another method to create a privacy policy for your business is by using templates. They already contain the required format and basic information and are customizable. The GDPR privacy policy template and guide to GDPR are some of the templates available online. You may also read our privacy policy guide for more details.

Legal consultant

Drafting a privacy policy can be a complex process. It requires careful attention, especially the legal aspects. Therefore, you can consult a legal expert to create your privacy policy.

Create one yourself

You may also create a privacy policy from square one. Go through the reference materials, gather enough information, organize it, and draft one yourself.

Where can a privacy policy be posted?

A privacy policy must be posted conspicuously on your website. Though no hard and fast rule exists, here are some of the common ways that you might be familiar with:

  • The header of the homepage
  • Footer of webpages
  • Sign-up forms, or any other forms collecting information. 
  • Consent banners or cookie pop-ups.
  • Settings menu

Infographic: GDPR privacy policy checklist

GDPR privacy policy checklist

FAQ on GDPR privacy policy

What are the 7 principles of GDPR?

The seven principles of GDPR are lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. You may include the principles in your privacy policy.

Can I copy the privacy policy from other websites?

No, a privacy policy is a copyrighted intellectual property. Therefore write a unique privacy policy to evade legal repercussions.

Can I use Artificial intelligence to write a privacy policy?

The best way is to avoid AI-generated privacy policies because they are not necessarily compliant and accurate. However, you may use AI to create an outline. Read our blog on AI-generated privacy policies for more details. The best alternative is to use a privacy policy generator.

Can I call a privacy policy a privacy notice?

Yes. Privacy policies are also known as privacy notices, privacy statements, data protection assessments, privacy practices, etc.