Privacy policy: what yours must say, section by section

A privacy policy is the page that tells people what you do with their personal data: what you collect, why, who else gets it, how long you keep it and what they can do about it. Its content is not a matter of taste. Articles 13 and 14 of the GDPR, and of the UK GDPR, list the information you owe people, and Article 12 asks for it in clear, plain language, somewhere easy to find.

This guide goes through what to include in a privacy policy, section by section, with wording that suits small-team businesses in the EU and outside it (the UK, Switzerland, the US, Canada, North Africa) when they sell to people in the EU or track them there. My complete guide to the GDPR explains when the regulation covers you.

This is general information, not legal advice.

When you need a privacy policy, and when people must see it

You need one as soon as you collect personal data, which on a website happens early: a contact form, a newsletter sign-up, a booking tool, analytics, or simply the emails people send you. The timing depends on where the data comes from:

• From the person (Article 13): when you collect it, which is why the link belongs next to every form.
• From elsewhere (Article 14), such as a prospect list or a directory: within a reasonable period and one month at the latest, or in your first message if you contact the person sooner.

What to include in a privacy policy, section by section

Grouped by topic, the items Articles 13 and 14 require make ten sections. Here they are in the order I would put them on the page.

1. Who you are and how to reach you

Give your business’s legal name, its address and an email address someone actually reads (a sole trader gives their own name, as on their invoices). Add your data protection officer’s contact details if you have one. Most small teams do not need one: Article 37 requires a DPO for public bodies and for businesses whose core activities involve monitoring people on a large scale or processing sensitive data on a large scale.

A business outside the EU that targets people in it usually needs an EU representative (Article 27), whose details go here too; the UK has the same rule for businesses outside the UK that target people there. See my guide to the EU representative under Article 27.

2. What data you collect, and where it comes from

List categories rather than every field: identity and contact details, messages, order and payment details, technical data such as IP addresses. When the data does not come from the person, Article 14 also asks for its source, such as “your firm’s listing in a professional directory”, and whether that source is public.

3. Why you use it, and on which legal basis

This is the core of the page: each purpose with its legal basis from Article 6 and, for legitimate interest, the interest you pursue. A table works best:

“We process your data on the basis of consent, contract and legitimate interest” tells people nothing: they need to know which basis goes with which use.

4. Who receives the data

Name the recipients, or at least their categories: website builder or host, email and newsletter tools, CRM, booking and payment tools, analytics, accountant. Categories are allowed, but names are clearer and force you to check the list against what you really use. Tools that process data on your behalf are your processors, and Article 28 requires a contract with each one, usually the data processing agreement in their terms.

5. Transfers outside the EU or the UK

Say whether any provider stores or accesses the data outside the EU (or the UK, for a UK business), which safeguard covers the transfer (an adequacy decision such as the EU-US Data Privacy Framework, or standard contractual clauses) and, for contractual clauses, how people can get a copy. For example:

Our newsletter tool, Mailchimp (Intuit, United States), is certified under the EU-US Data Privacy Framework and its UK Extension.

My guide to US tools and the Data Privacy Framework covers Google, Microsoft and the other usual names.

6. How long you keep it

Give a period for each purpose, or the criteria that set it; “as long as necessary” is neither. In France, the CNIL’s reference for prospects who never became clients is three years from collection or from the last contact that came from them, such as a reply or a click on a link, and commercial law requires invoices to be kept for ten years. UK data protection law sets no fixed periods: beyond what tax rules require for your accounts, the ICO expects you to set them and justify them. My article on retention periods for client and prospect data covers the usual cases.

7. People’s rights, and how to use them

List the rights that apply: access, rectification, erasure, restriction, portability, objection and, where you rely on consent, withdrawing it at any time. Say how to use them (an email address is enough) and that you reply within one month, which Article 12(3) lets you extend by two months for complex or numerous requests. The right to object to direct marketing needs a sentence of its own: Article 21(4) requires it to be presented clearly and separately.

8. The right to complain

Tell people they can complain to a data protection authority (Article 77): the CNIL in France, the ICO in the UK (formally the Information Commission since 30 September 2026), or the authority where they live or work in the EU. In the UK, since 19 June 2026, people can also complain to you directly under the Data (Use and Access) Act 2025: you must make it easy, with an online form for example, acknowledge complaints within 30 days and handle them without undue delay. Your privacy policy is the natural place to say how.

9. Whether people have to give the data

Say what is required and what happens without it: “We need your delivery address to send your order.” Optional fields should look optional, on the form and in the policy.

10. Automated decisions

If software alone makes decisions with significant effects on people, such as refusing an application with no human review, Article 22 applies and you must explain the logic involved and the likely consequences. If you make none, one sentence saying so beats silence.

How to write it so people read it

Article 12 asks for information that is concise, transparent, intelligible and easily accessible. In practice:

• Layer it. A short summary of the main points first, the details below under clear headings, and a one-line notice with the link next to each form.
• Drop the vague words. The EU regulators’ transparency guidelines (WP260, from the group that preceded the EDPB) say qualifiers such as “may”, “might”, “some”, “often” and “possible” should be avoided. “We may share your data with selected partners” says too little: name the partners and the reason.
• Write for your readers. Short sentences, no legal jargon, examples from your own business, and wording a child can follow if children use your service (Article 12(1) mentions them).
• Date it. Show the date of the last update and keep the old versions, in case someone asks what the policy said when they signed up.

What does not belong in your privacy policy

Three other documents often get merged into the privacy policy. They work better apart:

• The legal notice (mentions légales in France): who publishes the site, the registration details, the host. It is a separate duty; see what a website legal notice must include.
• Cookie details: the cookie list and how to change your choice can be a section of the policy, but the consent banner is a separate mechanism with its own rules, and the analytics exemptions differ between France and the UK; see what cookie banners must do in 2026.
• Terms of sale or of use: contract terms have their own page, and the transparency guidelines ask for privacy information to stay clearly separate from them.

Templates, generators and the trouble with copied policies

You do not have to start from a blank page. Two official starting points are free:

• In the UK, the ICO’s Create your own privacy notice tool asks questions step by step and produces a notice to copy, with versions for customers and suppliers, for staff and volunteers, and for some sectors; the ICO updated it in 2026 for the Data (Use and Access) Act. It is not designed for organisations that handle large amounts of sensitive data, make automated decisions or must appoint a DPO.
• In France, the CNIL publishes worked examples of privacy information (in French), including one for an online shop’s customers and one for prospects contacted by post, presented as illustrations to adapt, not ready-made models.

Some consent plugins, such as CookieYes on WordPress, also include a policy generator. A template gives you the structure; the facts have to come from you. The usual problems with a copied policy:

1. It lists tools you do not use and misses the ones you do.
2. It gives no retention periods, or only “as long as necessary”.
3. It says “we may share your data with partners” without naming anyone.
4. It names the wrong company, or countries where you do not operate.
5. It has not changed since the site went live, three tools ago.

Where to publish it, and how to keep it current

Put the link wherever people decide something about their data:

• in the footer of every page;
• next to every form, with one line on what the data is for;
• in your first email to anyone whose details you found elsewhere, with where you found them and how to object;
• in your app’s store listing and inside the app.

Update the page and its date whenever you add or drop a tool, collect something new or start selling in another country. If you plan to use data for a new purpose, Article 13(3) asks you to tell people before you start.

Your checklist before publishing

1. List every place you collect data: forms, emails, calls, bookings, payments, analytics, prospect lists.
2. For each one, write down the purpose, the legal basis and the retention period.
3. List every tool that touches the data, where it is based and, outside the EU or the UK, the safeguard.
4. Write the page in plain language, with a summary at the top and the date.
5. Set a yearly reminder to check it against the tools you use.

For a typical small-team website, a template and an afternoon with this list are enough. Bring in a lawyer or a DPO if you handle health or other sensitive data, children’s data, profiling or automated decisions, or data shared between several companies or countries. On the sites I build, the privacy page, the legal notice and the links next to the forms are part of the website project; the facts in them still come from you, because only you know what you collect and why.