On this page
Why almost every site needs one
The GDPR obliges you to inform people at the moment you collect their data, in every EU country. Even without a form your host usually keeps IP addresses, and the EU Court of Justice held in the Breyer case that such an address can be personal data. You give that information in a privacy policy: a page reachable from every page, with a short notice and a link at every form.
It is separate from your cookie policy, though they link to each other; whether you also need a banner is on do I need a cookie banner. The EU rules on company details a site must show are a separate duty; Belgium's version is in company number on your website, and whether you need a disclaimer on top in do I need a website disclaimer. For a company in the United States, when the GDPR applies at all is in GDPR for US companies.
What article 13 wants it to say
| Part | What you write | Example for a small business site |
|---|---|---|
| Who you are | name, address, contact | your company name and an email for privacy questions |
| Why, and on what basis | purpose per processing, with the legal basis | answering your enquiry, because you asked |
| Who else sees it | recipients and processors | your host, your email provider, your accountant |
| Outside the EU | whether data leaves the EU, with which safeguard | a US email or AI service |
| How long | a retention period per kind of data | enquiries one year, client files as long as the law requires |
| Rights | access, correction, erasure, objection, portability | an email address to exercise them |
| Complaint | the right to complain | a link to the data protection authority |
Four moments a visitor reads what you do
- At the formShort notice with a linkWhat you ask the data for.
- One click onThe full policyAll of article 13, per processing.
- On a requestAnswer within a monthTwo more months if it is complex.
- With every new toolUpdate the policyWith the date at the top.
Copied template
- Mentions a newsletter that does not exist
- Forgets the analytics and the chatbot
- No retention period
- About everything, so about nothing
Own policy
- Opens with what it covers
- Each processing with purpose and basis
- A period per kind of data
- A date and a contact
Where copied policies go wrong
Many policies are copied from another site or a generator, and then they do not inform correctly. The Belgian data protection authority has ruled that a policy that is hard to follow and names no retention period breaches the GDPR. The GDPR allows fines up to 20 million euro or 4 percent of turnover, and regulators can order the policy fixed; it often starts with a complaint from a visitor. What to check beyond the policy is in the GDPR checklist for your website.
Three kinds of processing are missing most often. An AI chatbot sends what visitors type to a language model, often outside the EU; see also is ChatGPT safe for business. A webshop passes addresses to a carrier and payment data to a payment provider. And a form that forwards enquiries to a CRM or email tool adds a processor, with whom you sign a data processing agreement. Using AI internally as well? The EU AI Act checker shows which rules come on top.
Check your policy in five steps
- Open your site and list every form, tool and script that collects data.
- Set that against what your policy says: remove what is not there, add what is missing.
- Put a retention period on every kind of data.
- Put a short notice with a link under every form.
- Put the date of the last change at the top, as our own privacy policy does.
For a site with a contact form, a newsletter and analytics that takes three to five hours once, then half an hour a year or with every new tool. A webshop or a site with a client portal takes more, because there are more processors.
Cookie policy and data protection officer
Is a privacy policy the same as a cookie policy?
No. The cookie policy says which cookies your site sets. The privacy policy covers all personal data, including what comes from your form or inbox. They may sit on one page, as long as both parts are complete.
Do I need a data protection officer?
For most small business sites, no: that applies to large-scale processing of sensitive data or systematic monitoring of people. Do name a contact point for privacy questions.