A privacy policy explains how a business collects, uses, and shares personal data, promoting transparency and user trust. As global data privacy laws become stricter, having a clear and compliant privacy policy is essential. By the end of this blog, you will know how to write one easily.
Create a compliant privacy policy today!
What is a privacy policy and why does it matter?
A privacy policy is a legal document that explains how an organization collects, uses, shares, and protects personal data such as phone numbers and credit card information. It outlines users’ rights and tells them how their data will be handled, often in accordance with global privacy regulations such as the GDPR, CCPA, UK GDPR, and others.
These documents are sometimes called a privacy notice or a privacy statement. They contain information about the organization, the categories of user data it collects, the purpose of data processing, with whom it shares the data, user rights and methods to exercise them, the date of the last update, and more.
Therefore, it serves as a gateway to data transparency and assists users in determining whether to interact with your company.
Why do websites need a privacy policy?
You should publish a privacy policy on your website for many reasons. Here are some of them:
- Legal compliance: Almost all privacy laws worldwide, including GDPR and CPRA, require businesses to disclose data practices. Failure to comply with this requirement can result in severe consequences.
- Customer trust: Customers expect data privacy, so they favour organizations that give them an overview of how their personal data will be handled.
- User rights: Privacy policies inform users of their rights such as to delete or correct their personal data and opt out of certain types of processing. Similarly, it also lets them know how these rights can be exercised.
- Business credibility: A well-crafted policy demonstrates credibility and attracts more customers.
What happens if you don’t have a privacy policy?
Failure to publish one can lead to regulatory fines, reputational damage, and loss of user trust. This can lead to a trust cliff, which results in potential customers avoiding your business.
What should a privacy policy include for compliance?
Below is an outline of the key elements that your privacy policy must contain:
Controller’s name
Provide the legal name of your business in the policy. GDPR also requires some controllers to provide the name and contact information of their data protection officers.
Categories of information
Including the types of information you collect from consumers/data subjects is a key requirement by most privacy regulations. For example- IP addresses, social security numbers, location, contact information, health information, etc.
Purpose of processing
It must also contain the specific purposes for which each category of data is used. For GDPR compliance, you must also specify the legal basis for processing.
Sources of information
Identify the sources from which you collect personal information such as websites or directly from the consumer. According to GDPR, it is also important to specify whether data collected from any other source than from the individual is publicly available.
Cross border transfer
If your organization engages in the cross-border transfer of personal data, it must be mentioned in your policy. Also, add details about the security safeguards that you have adopted for the same. This is particularly important for GDPR.
Data sharing or sale
Specify whether you share or sell personal data with third parties. This includes the names of the recipients and the types of personal data you share with them.
Consumer rights
Almost all data privacy laws empower users with privacy rights such as the right to access and delete. It is mandatory to enumerate such rights as provided under the law in your privacy policy along with the methods to exercise them. For example- an email address.
Cookies and other tracking technologies
Cookies are an integral part of website optimization. Likewise, it is also important to inform users about the cookies and other trackers you use. This includes the categories of cookies, their purposes, retention period, etc.
Controller’s contact information
Provide contact details of your organization. For example: An email address, physical address or phone number.
Data retention period
You cannot store consumer data infinitely. Instead, you must inform the users how long your organization will retain the collected data.
This period must be reasonable and proportional to the purpose of collection.
If you cannot determine the retention period, at least mention the criteria used for its determination.
Updates to the policy
Specify how you will notify users of any changes made to the privacy policy.
Effective date
Include the effective date/ last update date of your privacy policy. You can also provide the older/ archived versions.
What are some privacy policy examples?
Businesses can customize privacy policies according to their data practices and style. Here are some examples.
Below is a snippet from Pepsico’s privacy policy. They have adopted a user-friendly approach by adding accordions for each category of information and have also included the last update date.
CookieYes’s privacy policy has a dedicated section for cookies and other tracking technologies, which is essential for almost all websites.
The image below shows how Louis Vuitton has enumerated the purposes of data processing. This is just one of the numerous ways to present the information.
Slack’s privacy policy defines the retention period of the collected data in the following way.
Here is an example from McDonald’s privacy policy describing their international data transfer standards.
Privacy policy requirements under global data privacy laws
Many countries require organisations to be transparent. Let’s explore some of these laws.
GDPR
The General Data Protection Regulation (GDPR) requires businesses that collect personal information from EU citizens to provide a privacy policy containing information such as the controller’s name, types of data collected, legal bases of processing, use of cookies and other trackers, data subject rights, etc. Fines for each violation may reach up to 20 million euros or 4% of the global annual turnover.
CPRA
California Privacy Rights Act (CPRA), the amended version of the California Consumer Privacy Act (CCPA), applies to businesses targeting California residents on a threshold basis. Businesses to which the law applies must provide consumers with a privacy policy/privacy notice.
It must contain the categories of personal data collected, specific purposes, consumer rights including the right to opt-out, methods to exercise these rights, etc. Penalties for non-compliance can range up to $7500 per violation.
LGPD
Brazil’s federal law, LGPD, requires applicable businesses to provide users with information such as the categories of data they collect, the purpose of processing, data subject rights, methods to exercise the rights, data retention period, etc. Non-compliance may result in fines of up to 2% of annual global turnover or $10 million.
PIPEDA
The federal data privacy law of Canada, known as PIPEDA, also includes provisions for privacy policies. It must contain information about the privacy officer, collected data, etc. Penalties for breaches may reach up to CAD 100,000.
HIPAA (USA)
The law applies to healthcare providers and requires data privacy for protected health information.
Australian Privacy Act
The Privacy Act of 1998 along with the Australian privacy principles require businesses to provide clear and accessible privacy notices.
What are the best practices for writing a privacy policy?
It is important to consider specific key points to create a compliant privacy policy. The following is an overview of best practices for drafting one.
- Understand legal requirements: Seek a legal expert or conduct your own research to learn the key policy ingredients
- Use plain language: Avoid jargon; write in an easy-to-understand manner.
- Keep it concise and scannable: Use headings, bullet points, and tables where helpful.
- Be transparent: Clearly state what data you collect and why.
- Make it accessible: Display it in the website footer, app settings, or during sign-up.
- Update regularly: Reflect changes in laws, business operations, or data practices.
How can I create a privacy policy?
Now that you know what a privacy policy should look like, let’s create one using the insights provided above.
- Use a policy generator: Tools like CookieYes provide compliant, customizable privacy policies.
- Consult templates: Refer to templates as a starting point, but customize them for your specific needs.
- Hire a legal expert: Especially useful if your operations span multiple jurisdictions.
Need a compliant privacy policy?
CookieYes can simplify the process
with its free privacy policy generator
No signup required
FAQ on privacy policy
Websites have privacy policies for several reasons, including compliance with various data privacy regulations, such as GDPR in the European Union, Canada’s PIPEDA, the Australian Privacy Act, California CCPA, and more. Additionally, privacy policies help foster customer trust, increase credibility, and inform consumers of privacy practices.
A privacy policy discloses an organization’s data practices, such as the categories of data collected and their sources, specific purposes of processing, user rights, privacy practices, etc.
On the other hand, a cookie policy provides information about the cookies used on a website.
You need a privacy policy if your business collects personal data from users, such as email addresses, phone numbers, social security numbers, health information, IP addresses, etc. The content varies with jurisdictions, such as federal laws such as PIPEDA, LGPD, and UK GDPR, or at higher levels, such as the GDPR of the European Union.
The purpose of a privacy policy is to inform users about how their personal data will be handled by an organization, their rights and how these rights can be exercised.
You can place your privacy policy in the footer or header of your website. For mobile applications, you can also include it in the settings menu. Use terms like “privacy” or “privacy policy” to hyperlink it.
There is no silver bullet for determining what you must include in your privacy policy. It depends upon your organization’s information practices and the laws that apply to you. Therefore, a good privacy policy of a California-based organization may not be the same as that of a European organization.
Safna Y Yacoob is a lawyer turned data privacy writer. At CookieYes, she transforms complex privacy regulations into actionable insights for businesses. On off-hours, find her brightening days with one-liners, spinning playlists, or watching feel-good movies.
