GDPR Privacy Policy Template

Your privacy policy must clearly name who you are, the data controller making decisions about how data is processed. Include your full legal or trading name, registered address or country of operation, a dedicated privacy contact email address, and (if applicable) the name and contact details of your Data Protection Officer (DPO). A DPO is required if you process data at large scale or handle sensitive categories of data.

For every category of personal data you collect, you must state the specific purpose and which of the six GDPR lawful bases applies: Consent, Contract performance, Legal obligation, Vital interests, Public task, or Legitimate interests. You cannot simply state legitimate interests without identifying what those interests are. Vagueness here is one of the most common reasons regulators issue enforcement notices.

Be specific about the categories of data you collect. Common categories include: identity data (name, date of birth), contact data (email, phone, address), technical data (IP address, browser type, device ID, cookie data), usage data (pages visited, time on site, referring URLs), transaction data (purchase history, payment information), and communications data (messages from contact forms, support tickets).

Map each data category to its specific use case and lawful basis. For example: We use your email address (a) to send order confirmations under contract performance, (b) to send marketing emails where you have opted in under consent, and (c) to detect fraudulent activity under legitimate interests. This mapping is what separates a GDPR-compliant privacy policy from a generic template.

List all third parties that receive personal data, grouped by category: service providers (hosting, payment processors, email platforms), analytics tools (Google Analytics, Hotjar, Clarity), advertising platforms (Meta Pixel, Google Ads), and professional advisers. For each category, describe what data is shared and under what legal framework. Where you use data processors, you must have a Data Processing Agreement in place with each one.

If data is transferred outside the UK or EU, including to US-based services like Google Analytics, AWS, Mailchimp, or Stripe, you must disclose this and the safeguard used: UK adequacy regulations, EU adequacy decisions, Standard Contractual Clauses (SCCs), or Binding Corporate Rules (BCRs). In the UK, the International Data Transfer Agreement (IDTA) is the standard mechanism replacing EU SCCs.

State how long you keep each category of data. Phrases like as long as necessary are not GDPR-compliant on their own. You must specify timeframes and the reason for each. Retention should be limited to what is genuinely necessary for the stated purpose. See the retention table in the template preview section below for concrete examples.

Detail all eight rights and explain how individuals can exercise each one, including your response timeframe (typically 30 days from request): Right of access (Subject Access Request), right to rectification, right to erasure (right to be forgotten), right to restriction of processing, right to data portability, right to object, rights related to automated decision-making and profiling, and right to withdraw consent at any time.

A separate cookie policy is often advisable, but your privacy policy must at minimum reference your use of cookies, categorise them (essential, functional, analytics, marketing), explain what they do, and direct users to your cookie consent mechanism. If you use advertising cookies or tracking pixels, these require explicit opt-in consent under GDPR. Pre-ticked boxes are not valid consent.

Describe the technical and organisational measures protecting personal data: encryption of data in transit (SSL/TLS) and at rest, access controls and role-based authentication, regular security assessments and penetration testing, staff training on data protection, and incident response procedures. You do not need to expose implementation details. A high-level description is both sufficient and safer.

Under GDPR, you must notify the relevant supervisory authority of certain personal data breaches within 72 hours of becoming aware. Where a breach is likely to cause high risk to individuals, you must also notify those individuals without undue delay. Your privacy policy should acknowledge this obligation and reference your internal breach response procedure.

Include a clear privacy contact email address and inform users of their right to lodge a complaint with the supervisory authority. In the UK, that is the Information Commissioner's Office (ICO) at ico.org.uk. In the EU, individuals should be directed to their national data protection authority. Providing this information is an explicit Article 13/14 requirement.