In today’s internet, where personal data has become currency and users are increasingly aware of their privacy, transparency is no longer an option but an obligation. Every company conducting business online, from a simple blog to an extensive e-commerce store, must clearly and understandably inform its visitors how it collects, uses, and protects their data. The basic tool for this purpose is the privacy policy.
This is not just another formal legal document that nobody reads. It is a public declaration of responsibility and a company’s business card that shows its attitude toward one of the most fundamental values in the digital world – privacy. According to GDPR requirements, having a properly constructed and easily accessible privacy policy is an absolute necessity, and its absence or flaws can lead to serious legal and financial consequences. In this step-by-step guide, we will explain what a privacy policy is, what elements it must contain, what mistakes to avoid, and how to create a document that will not only ensure legal compliance but also build trust with your customers.
What is a Privacy Policy and Why Must Every Website Have One?
A privacy policy is a publicly available document that informs website, application, or service users in detail and transparently about all aspects of processing their personal data by a given organization. It is the implementation of one of the fundamental obligations imposed by GDPR on data controllers – the information obligation. Its purpose is to ensure transparency and enable users to make an informed decision about whether and to what extent they want to share their data.
In practice, almost every website processes personal data, even if it doesn’t have complicated forms or a registration system. Simply collecting analytical data about site traffic (using tools like Google Analytics) or using cookies involves processing online identifiers such as IP addresses, which under GDPR are considered personal data. If the site has a contact form, newsletter, comment system, or online store, the scope of processed data is even broader.
Therefore, having a privacy policy is a legal obligation for virtually every website owner. This arises directly from Articles 13 and 14 of GDPR, which require the controller to provide the data subject with a number of key information at the time of data collection. The absence of a privacy policy or its incompleteness is one of the easiest to detect and most frequently penalized violations of data protection regulations by supervisory authorities.
📚 Read the complete guide: Backup: The 3-2-1 rule and backup best practices
What Key Information Required by GDPR Must Be Included in the Privacy Policy?
GDPR precisely specifies what set of information must be provided to the data subject. The privacy policy is the ideal place to collect all these elements in an organized and complete manner. The document must be written in clear and simple language so that it is understandable to the average user.
The absolutely essential elements that must be included in every privacy policy are:
-
Identity and contact details of the data controller and, if applicable, their representative.
-
Contact details of the Data Protection Officer (DPO), if one has been appointed in the organization.
-
Detailed purposes of personal data processing and the legal basis for each of these purposes (e.g., consent, contract, legitimate interest).
-
Information about recipients of personal data or categories of recipients (i.e., to whom the company may share data, e.g., hosting company, accounting office, courier company).
-
Information about the intention to transfer data to a third country (outside the European Economic Area) and about the safeguards applied.
Additionally, the policy must contain:
- The period for which personal data will be stored, and when this is not possible, the criteria for determining this period.
- Information about user rights, such as the right to request access to data, rectification, erasure, restriction of processing, the right to object, and the right to data portability.
- Information about the right to withdraw consent at any time (if processing is based on consent).
- Information about the right to lodge a complaint with a supervisory authority.
- Information on whether providing data is a statutory or contractual requirement and what are the consequences of not providing it.
- Information about automated decision-making, including profiling, and about the principles of their making and consequences for the user.
Who is the Data Controller and How to Properly Indicate Them in the Document?
Properly indicating the personal data controller is one of the first and most important elements of the privacy policy. It is the controller who bears the main responsibility for lawful data processing and to whom users will direct their requests and any complaints.
According to the GDPR definition, a controller is a natural or legal person, public authority, agency, or other body that alone or jointly with others determines the purposes and means of processing personal data. Simply put, this is the entity that decides “why” and “how” data will be processed. In the case of a company website, the data controller of its users is usually simply the company (corporation or sole proprietorship) that owns the website.
The privacy policy should unambiguously and fully indicate the identity and contact details of the controller. This information should include:
- Full company name (as registered in official registers).
- Registered address.
- Registration data, such as tax ID, registration number.
- Contact details that will allow users easy contact regarding their data matters. This should be at least an email address (e.g., privacy@companyname.com), and often a phone number or mailing address is also provided.
It is an error to provide incomplete data or use generalizations such as “The data controller is the X service team.” The information must allow for unambiguous identification of the responsible entity. If several entities are involved in data processing who jointly decide on the purposes and means (so-called joint controllers), their role and scope of responsibility of each must be described in the policy.
How to Describe the Purposes and Legal Bases of Data Processing in a Simple and Understandable Way?
One of the biggest challenges when creating a privacy policy is describing the purposes and legal bases of processing in a way that is both precise and GDPR-compliant, as well as understandable to the average user. Using complicated legal jargon is contrary to the principle of transparency.
The best practice is to create a clear table or list in which for each specific data processing activity (e.g., handling a contact form, sending a newsletter, processing an order) we indicate three key elements:
-
Purpose of processing: Why are we collecting this data? (e.g., “to respond to the inquiry submitted,” “to send marketing information,” “to fulfill the concluded sales contract”).
-
Scope of data: What specific data is needed for this purpose? (e.g., “email address,” “first name, last name, delivery address”).
-
Legal basis: On what legal basis from Article 6 GDPR do we base this processing?
When describing legal bases, it’s worth avoiding article numbers alone and instead using a simple explanation. For example:
-
Instead of “based on Article 6(1)(a) GDPR,” you can write: “Your voluntary consent”.
-
Instead of “based on Article 6(1)(b) GDPR,” you can write: “Necessity for the performance of a contract you enter into with us (e.g., sales contract)”.
-
Instead of “based on Article 6(1)(f) GDPR,” you can write: “Our legitimate interest (e.g., for statistical analysis of site traffic or pursuing claims)”.
Such a clear layout allows the user to quickly understand what data, for what purpose, and on what basis is being processed, which builds trust and fully fulfills the information obligation.
How to Inform Users About Their Rights (e.g., to Access, Delete Data)?
An integral and mandatory part of every privacy policy is a section dedicated to the rights that users have in connection with the processing of their personal data. This information must be presented clearly so that every person knows how they can exercise control over their data.
The policy should contain a listed list of all key rights granted by GDPR. The user should be explicitly informed that they have:
-
Right of access to their data: the right to obtain information whether their data is being processed, and if so, to what extent.
-
Right to rectification: the right to request correction of incorrect data.
-
Right to erasure (“right to be forgotten”): the right to request deletion of their data in cases specified by GDPR.
-
Right to restriction of processing: the right to “freeze” data in certain situations.
-
Right to data portability: the right to receive their data in a structured format and transfer it to another controller.
-
Right to object: to processing of data based on the controller’s legitimate interest.
-
Right to withdraw consent: at any time, if processing is based on it.
In addition to listing the rights, it is crucial to provide practical instructions on how to exercise them. Contact details (email address, mailing address) to which the user should direct their request should be clearly indicated. It is also good practice to inform that the company generally has one month to respond to a request. Information about the right to lodge a complaint with a supervisory authority should also be included.
What are Cookies and How to Properly Describe Their Use in the Privacy Policy?
Cookies are small text files that a website saves on the user’s device (computer, smartphone). They perform many different functions, from purely technical to analytical and marketing. From the perspective of GDPR and telecommunications law, the way of informing about cookies and managing them is an extremely important element of compliance.
The privacy policy must contain a dedicated section on cookies. It should simply explain what cookies are and for what purposes they are used on the given site. A distinction should be made between:
-
Necessary (technical) cookies: which are essential for the proper functioning of the site (e.g., for maintaining user session, shopping cart operation). Their use does not require consent.
-
Analytical (statistical) cookies: which are used to collect information about how users use the site (e.g., via Google Analytics), in order to improve it.
-
Marketing (advertising) cookies: which are used to track users online to display personalized advertisements (e.g., Facebook pixel, Google Ads remarketing codes).
-
Functional cookies: which allow “remembering” user choices (e.g., language, region).
For each category of cookies (except necessary ones), the company must obtain prior, informed, and voluntary consent from the user. Therefore, the privacy policy must be connected with a properly functioning cookie banner (or Consent Management Platform - CMP). This banner must give the user a real choice – the ability to accept all, reject all (except necessary), or make a detailed selection of which cookie categories they agree to. The privacy policy should describe in detail what specific tools (e.g., Google Analytics) the company uses, who is the provider of these tools, and how long individual cookies are stored on the user’s device. It is also worth including instructions on how the user can manage cookies themselves from their browser settings.
Where Should the Privacy Policy Be Placed and Easily Accessible on the Website?
The principle of transparency, which is one of the pillars of GDPR, requires that the privacy policy be not only complete in terms of content but also easily accessible to every user of the site. Hiding it in complicated corners of the service or making it available only after registration is unlawful and undermines the company’s credibility.
The best and commonly accepted practice is to place a direct link to the privacy policy in the website footer. The footer is an element that displays on every subpage of the service, which guarantees that the user has constant and easy access to it, regardless of where they are on the site. The link should be clearly and unambiguously labeled, e.g., as “Privacy Policy” or “Privacy”.
Additionally, the link to the privacy policy should appear in every place on the site where personal data is collected. This means it should be located directly next to:
- contact forms,
- newsletter signup forms,
- account registration forms,
- order forms in the online store.
Usually, it is placed under the consent checkbox, in the form “I accept the terms of [link to terms] and have read [link to privacy policy].” The link to the privacy policy must also be an integral part of the cookie banner, so that the user, before giving consent to cookies, can read detailed information about them. Such multi-channel availability ensures full transparency and allows the company to properly fulfill its information obligation.
What are the Most Common Errors and Deficiencies in Privacy Policies of Companies?
Analysis of privacy policies available on websites, as well as decisions issued by supervisory authorities, allows identifying several recurring and typical errors that indicate an insufficient understanding of GDPR requirements. Avoiding these pitfalls is key to ensuring compliance.
One of the most common errors is copying ready-made templates without adapting them to the company’s specifics. Many companies use free generators or templates that contain general, imprecise provisions. Such a policy often does not reflect the real data processing processes in the organization – it lists services the company does not use and omits those it actually uses. Such a document does not fulfill its informational function and is easy to challenge during an inspection.
Another common problem is lack of specificity and use of legal jargon. Policies often contain general statements such as “we process data for marketing purposes” without specifying what these purposes entail. Instead of simply describing legal bases, authors paste entire GDPR articles, which is completely incomprehensible to the average user and violates the principle of transparency.
Other common deficiencies include:
- Incomplete identification of the controller (e.g., missing tax ID, registration number).
- Lack of information about all data recipients (omitting e.g., hosting company, newsletter system provider).
- Unclear definition of data retention period (using generalizations like “until consent is withdrawn,” even when other grounds for further storage exist, e.g., tax regulations).
- Incomplete information about cookies and lack of connection with a properly functioning consent management mechanism.
- Lack of regular updates – many policies still contain outdated information or refer to regulations no longer in force.
Can You Use a Ready-Made Generator or Privacy Policy Template?
Using ready-made generators or privacy policy templates is very tempting, especially for small businesses that want to quickly and cheaply “check off” a legal obligation. However, such solutions should be approached with great caution, as they can become a source of serious problems and a false sense of security.
The main advantage of generators is their low cost and speed. In a few minutes, you can click through a document that looks professional at first glance and contains all the sections required by GDPR. This is certainly a better solution than a complete lack of privacy policy. But this is where the advantages end.
The biggest drawback of ready-made templates is their generality and lack of adaptation to the specifics of a particular company. A privacy policy must be a “tailor-made” document. It must precisely reflect what specific data, for what purposes, using what tools, and on what legal bases your organization processes. A generator cannot know this. It creates template text that is often inadequate, incomplete, or contains information about processes that do not occur in the company at all.
Using a generator without thorough, substantive verification and adaptation by someone knowledgeable about GDPR is like buying a ready-made suit without fitting – it probably won’t fit and will look bad. Such a policy will not fulfill its informational function and will be easily challenged during an inspection. A generator can be a good starting point or checklist that helps ensure we haven’t overlooked any important element, but it should never be treated as a ready, final solution. It is always recommended that the final version of the document be prepared or at least verified by a lawyer or data protection specialist.
How Often Should the Privacy Policy Be Updated?
A privacy policy is not a document you create once and forget about. It is a “living” document that must be regularly reviewed and updated to maintain its legal compliance and reflect the actual state of data processing processes in the company. Lack of updates is a common error that can lead to non-compliance.
Updating the privacy policy is necessary in several key situations. Above all, it should be done every time there is a significant change in the way personal data is processed in the company. This may include:
- Starting to collect new categories of data.
- Introducing a new processing purpose (e.g., starting to send a newsletter).
- Implementing a new tool or system that has access to data (e.g., new CRM system, new analytics platform).
- Starting cooperation with a new subcontractor (data recipient).
- Making a decision about transferring data outside the European Economic Area.
The second reason for updating is changes in the law. Although GDPR is a stable regulation, supervisory authorities and courts regularly issue new guidelines and rulings that clarify the interpretation of regulations (an example of which is the evolution of the approach to cookies). These changes should be monitored on an ongoing basis and the document content adjusted accordingly.
Good practice, even if none of the above circumstances occur, is to conduct regular, periodic review of the privacy policy, for example once a year. This allows verification whether the document is still current, complete, and understandable. Users should be transparently informed about any significant change in the privacy policy, for example through a notification on the website or in an email.
What is the Difference Between a Privacy Policy and Website Terms of Service?
The privacy policy and terms of service are two fundamental but completely different legal documents that are often confused with each other. Although both regulate the relationship between the site owner and its user, they concern completely different aspects of this relationship and serve different purposes.
Terms of Service (or Terms of Use) is a document that defines the rules and conditions for using a given service or website. It can be compared to a contract concluded between the service provider and the user. The terms define, among other things, the types and scope of services provided, the rights and obligations of both parties, technical conditions, liability rules, and the complaint procedure. Its content is regulated mainly by laws on electronic services and civil code. Acceptance of the terms is usually a prerequisite for using the service.
The privacy policy, on the other hand, focuses exclusively on one specific aspect – on informing about the rules for processing users’ personal data. Its purpose is not to regulate the rules for using the service, but to implement the information obligation arising from GDPR. The privacy policy describes what data is collected, for what purpose, on what legal basis, and what rights users have in this regard. It is an informational document, not a contractual one.
Although both documents must be available on the site, they should not be combined into one. The user should be able to read them separately. Moreover, acceptance of terms of service cannot be equivalent to consent to process data for marketing purposes. Consent, as described earlier, must be a separate, voluntary declaration of will, and its clauses should be clearly separated from the terms of service provisions.
How Can GDPR Audits and nFlo Advisory Services Help Your Company Create a Professional Privacy Policy Compliant with Current Regulations?
Creating a privacy policy that is not only fully GDPR-compliant but also transparent for users and tailored to the company’s specifics requires knowledge and experience. At nFlo, we offer comprehensive advisory and audit services that help our clients professionally and stress-free tackle this challenge.
Our support usually begins with a detailed GDPR compliance audit. As part of this process, we carefully map and analyze all personal data processing processes in your organization. We identify what data you collect, for what purposes, using what tools, and on what legal bases. This deep insight into your operations allows us to identify any gaps and non-compliances, as well as gather all the information necessary to create a reliable and complete privacy policy.
Based on the audit results, we help prepare or verify an existing privacy policy. We do not use generic templates. We create a “tailor-made” document that precisely reflects the realities of your company. We ensure that it is written in clear and understandable language, contains all elements required by GDPR, and is fully compliant with the latest guidelines from supervisory authorities. We also advise on how to properly construct consent clauses and cookie banners to avoid the most common errors.
Our services do not end with document preparation. We also offer implementation and training support, helping communicate new rules to employees and implement appropriate procedures. By working with nFlo, you gain not only a legally compliant document but above all a partner who will help you build solid foundations in your company for transparent and responsible data protection, which translates into security and trust from your customers.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- CSPM (Cloud Security Posture Management) — CSPM (Cloud Security Posture Management) is a category of cloud security tools…
- Backup — Backup, also known as a backup copy or safety copy, is the process of creating…
- Network Security — Network security is a set of practices, technologies, and strategies aimed at…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
- Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
Learn More
Explore related articles in our knowledge base:
- Amendment to the NSC Act (NIS2): What new obligations await Polish companies and how to prepare for them?
- What Are Group Policy Objects (GPO)? - Their Role and Operation
- What is Business Continuity and How to Prepare Your Company for Unforeseen Crises?
- What is GDPR? A complete guide to data protection for companies operating in the European Union
- What is GDPR and how to implement data protection?
Explore Our Services
Need cybersecurity support? Check out:
- GDPR Advisory - data protection compliance
- DPO Outsourcing - external Data Protection Officer
Related topics
See also:
