GDPR compliance is essential for any business handling data from individuals in the European Union, whether your company is based in Berlin or Boston.
This guide walks through every section your GDPR compliant privacy policy needs, with concrete wording examples and a checklist you can hold up against your current document today.
Table of Contents
- What makes a privacy policy GDPR compliant
- Checklist of required elements for a GDPR privacy notice
- Identifying your role and contact information
- Describing your personal data collection
- How and why you collect personal data
- Explaining your lawful bases for processing
- Third-party sharing and data processors
- International data transfers outside the European Economic Area
- Data retention and deletion
- Data security and data breach communication
- User rights under GDPR and how to exercise them
- Cookies, tracking, and analytics disclosures
- Design, language, and placement for GDPR compliance
- Example GDPR privacy policy structure and mini template
- Key Takeaways
- FAQ
- Do I need a GDPR compliant privacy policy if my company is not based in the EU?
- Can I use one privacy policy for both GDPR and other laws like CCPA?
- Is consent always required under GDPR for processing personal data?
- How detailed do my data retention periods need to be in the policy?
- Do I have to name every single third party and data processor?
What makes a privacy policy GDPR compliant
A GDPR compliant privacy policy is a document that tells site visitors and customers exactly what personal data your company collects, why it collects that data, who it shares data with, how long it keeps records, and what rights users have over their own information. The policy must also name the legal basis for every type of data processing you do.
The General Data Protection Regulation grounds these requirements in four areas: transparency (Articles 12–14), lawful bases for processing personal data (Article 6), data subject rights (Articles 15–22), and rules for international transfers (Chapter V).
Businesses have a legal obligation to provide a GDPR compliant privacy policy under Articles 12, 13, and 14.
Your privacy policy should reflect actual business practices. A document copied from another company website or generated from a generic template, without mapping to your real data flows, creates risk rather than reducing it.
The WhatsApp case illustrates this: the Irish Data Protection Commission fined WhatsApp €225 million for failing to give non-users required transparency information and for not presenting such information in an easily accessible form written for a general audience.
The privacy notice must also be available before or at the moment you collect personal data. That means placing it on contact forms, sign-up flows, checkout pages, and in-app screens where data collection happens.
If you’re unsure whether your business needs a privacy policy or a privacy notice, see our privacy policy vs privacy notice comparison.
For the universal clauses every privacy policy should include regardless of jurisdiction, see the site’s data privacy policy guide.
Checklist of required elements for a GDPR privacy notice
Include eight GDPR required elements in your privacy policy. Here is the core list:
- Identity and contact details of the data controller (and data protection officer, if applicable)
- Categories of personal data you collect (names, emails, IP addresses, billing data, etc.)
- Purposes for which you process data
- Legal basis under Article 6 for each processing purpose
- Third-party sharing: categories of recipients and data processors
- International data transfers outside the European Economic Area, with safeguards described
- Retention periods for each category of data
- User rights under Articles 15–22 and how to exercise them
Beyond these eight, also cover data security measures you have in place, your process for reporting data breaches (notification obligations under Articles 33–34), and how users can file a complaint with a supervisory authority.
Founders can use this checklist as a quick gap analysis. Print it out, open your current privacy notice template, and check off each item. Any missing element is a compliance gap.
Over 2,800 enforcement cases and €7.1 billion in cumulative fines have been recorded since the regulation took effect; the most common triggers are insufficient legal basis and poor transparency.
Identifying your role and contact information
Article 13 requires you to name the data controller at the top of your policy. Include your legal entity name, postal address, and a main contact email. If your organization describes a registered office in one country but operates from another, list both.
If you have appointed a data protection officer or an EU representative (required when your company is outside the EEA but processes EU citizens’ data), include their role title, email address, and postal contact in this section. Business partners and customers reviewing your policy will look for this information first.
Include the effective date and “last updated” date so readers can see the policy is current, for example: “Effective 1 March 2026; last updated 15 August 2026.”
Describing your personal data collection
Specify what data you collect and why you collect it. Avoid vague wording like “we may collect any information you provide.” Instead, list concrete categories of personal identifiable information: full names, email addresses, billing details, phone numbers, IP addresses, device identifiers, support messages, and any other data your company collects.
If you collect personal information that falls into a special category under Article 9 (health data, biometric data, or racial or ethnic origin), call it out explicitly. Special category data requires additional protections and a separate legal basis.
Data you collect directly
This category covers information users hand you through sign-up forms, checkout flows, contact forms, customer support submissions, and account profile updates. A typical list: name, email, shipping address, payment card details, and any free-text content the user types into a support ticket.
Data you collect automatically
When someone visits your company website, your servers and third-party tools can collect data without the user typing anything. Examples: IP addresses, browser type, operating system, device identifiers, referring URLs, pages viewed, timestamps, and cookies.
If you use analytics tools like Google Analytics, name them here rather than saying “we use analytics services.”
How and why you collect personal data
Your policy should briefly explain the main channels through which you collect data: website forms, product sign-up, payment processing, customer support interactions, and data received from a data processor or partner companies.
If you receive personal data from third parties (such as lead lists or referral partners), note that here. Under Article 14, you must communicate data obtained from third parties within one month of receiving it.
Describe your purposes in separate paragraphs rather than lumping them together:
- Account creation and service delivery: you process data to set up accounts, authenticate logins, and deliver the product or service the user signed up for.
- Billing and payments: you store personal data tied to invoices, payment methods, and transaction records.
- Security and fraud prevention: you monitor login patterns, flag suspicious activity, and store logs.
- Analytics and product improvement: you analyze usage patterns to fix bugs, prioritize features, and improve navigation. Link this to specific data categories (page views, feature usage events, device type).
- Marketing communications: you send newsletters or promotional emails to users who opted in.
Each purpose must tie back to specific data categories. The French data protection authority (CNIL) fined the ad-tech company Criteo €40 million in part because its privacy notice described purposes vaguely and failed to map them to concrete data types or lawful bases.
GDPR discourages incompatible reuse of data. State in your policy that if you introduce a materially different use for existing data, you will notify users before that processing begins.
Explaining your lawful bases for processing
Article 6 of the data protection regulation (GDPR) lists six lawful bases: consent, performance of a contract, legal obligations, vital interests, public task, and legitimate interests. Every processing purpose in your policy must map to one of these.
| Processing purpose | Primary legal basis |
|---|---|
| Account management and payments | Contract |
| Tax record-keeping | Legal obligation |
| Basic analytics and product improvement | Legitimate interests |
| Email marketing and newsletters | Consent |
| Fraud detection and prevention | Legitimate interests |
| Responding to a legal or regulatory request | Legal obligation |
Using Legitimate Interests as Your Legal Basis
When you rely on legitimate interests, name the specific interest (such as preventing fraud or improving product stability) and state that users have the right to object. If the user objects and no overriding interest applies, you must stop that processing.
Using Consent as Your Legal Basis
For consent-based processing, explain how consent is collected (unticked checkboxes, a preference center, double opt-in for emails) and how users can withdraw consent. Withdrawal must be as easy as giving consent in the first place; a one-click unsubscribe link in every marketing email meets this standard.
Third-party sharing and data processors
A data controller decides why and how personal data is processed. A data processor handles data on the controller’s behalf, under documented instructions.
Most small businesses act as controllers and rely on several processors: hosting providers, payment gateways, email platforms, and analytics services.
List categories of recipients rather than leaving this abstract. For example: “cloud hosting providers in the EU,” “payment processors in the US,” “email delivery services,” and “professional advisers (accountants, legal counsel). ” GDPR mandates transparency about data sharing with third parties, so name the types clearly.
Confirm in the policy that you have written data processing agreements with each processor and that processors may only process data under your documented instructions.
If any third-party sharing involves advertising, social media tracking, or profiling, state that explicitly and explain how users can opt out (cookie settings, ad preference pages, or a direct request to your team).
International data transfers outside the European Economic Area
An international data transfer happens any time personal data leaves the EEA. Common examples: hosting on US-based cloud servers, using a global customer support team, or sending data to a payment processor based outside Europe.
Name the countries or regions where data may be sent and which appropriate safeguards are in place. The main mechanisms under Chapter V are adequacy decisions (the European Commission has confirmed the destination country provides comparable protection), standard contractual clauses (pre-approved contract terms between sender and receiver), and binding corporate rules (for transfers within a corporate group).
If you transfer data to the United Kingdom, the United States (under the EU-US Data Privacy Framework), or other common destinations, say so. Offer users the ability to request more detail on specific safeguards by contacting you.
Do not promise that transfers are “risk-free.” Instead, state that protections are in place and reviewed regularly.
Data retention and deletion
Organizations must disclose data retention periods in privacy policies. GDPR requires you to keep personal data only as long as necessary for each stated purpose. Write retention in plain ranges rather than precise internal schedules.
| Data type | Typical retention period | Reason |
|---|---|---|
| Account data | While the account is active, plus 3 years | Service delivery, dispute resolution |
| Invoicing and billing records | 7–10 years | Tax law and legal obligations |
| Support messages | 2 years after resolution | Quality review, dispute resolution |
| Server and analytics logs | 90 days | Security monitoring, debugging |
| Marketing consent records | Until consent is withdrawn | Proof of consent |
Uber was fined €10 million for failing to disclose data retention details in its privacy notice. Avoid the same mistake by including at least a summary table like the one above.
Explain how users can request deletion of their personal data and what exceptions apply. For instance, you may need to store personal data to meet legal obligations (tax records) or to resolve ongoing disputes, even after a deletion request.
Anonymous or aggregated data may be kept longer because it no longer identifies individual users.
Data security and data breach communication
Describe your data security practices in everyday terms. Instead of claiming “industry-leading security,” list the specific measures: HTTPS for all pages, encryption at rest for stored personal data, role-based access controls limiting who on your team can view customer records, regular backups, and staff training on data handling.
No electronic storage method is 100% secure. Acknowledge that, while emphasizing ongoing efforts to identify and reduce risk.
Reporting Security Issues to Us
Include a way for users to report suspected security issues, such as a dedicated email address (e.g., [email protected]).
Our Data Breach Notification Process
If a data breach poses a high risk to individuals, your organization will follow GDPR’s breach notification rules: notifying the relevant data protection authority within 72 hours and contacting affected users directly when required.
User rights under GDPR and how to exercise them
The right to be informed is a core principle of the GDPR. Beyond that, inform users of their rights regarding their personal data under Articles 15–22:
- Users have the right to access their personal data and receive a copy.
- Users can request correction of inaccurate personal data (rectification).
- Users have the right to request deletion of their personal data (erasure), subject to exceptions.
- Users can restrict processing of their personal data under certain conditions.
- Users can object to the processing of their personal data, especially for marketing or profiling based on legitimate interests.
- Users have the right to data portability to transfer their data to another service in a structured, commonly used format.
- Users can refuse to be subject to decisions made solely by an automated decision-making system that produces legal or similarly significant effects.
- Users can withdraw consent at any time for consent-based processing.
Exercising these rights involves two separate steps: submitting the request itself and escalating if you’re not satisfied with the response.
How to Submit a Rights Request
Explain how to submit a request: an email address, an online form, or an in-app feature. State what information you may need to verify identity (name, account email, and description of the request).
Your company normally responds within one month. If a request is complex, you may extend that period by two additional months with notice.
Filing a Complaint with a Supervisory Authority
Remind users that if they are unhappy with your response, they can complain to their local data protection authority, such as the Irish Data Protection Commission or another supervisory authority in their country.
Cookies, tracking, and analytics disclosures
Cookies and similar technologies (pixels, local storage) count as personal data collection when they can identify or profile site visitors. Your GDPR privacy notice should acknowledge this.
Summarize your main cookie categories: necessary (login sessions, security tokens), preferences (language, display settings), analytics (usage patterns, page views), and marketing (ad targeting, retargeting).
Point readers to a separate cookie policy or cookie banner where they can see full details and individual cookie lifetimes.
For non-essential cookies, you must obtain consent before setting them for users in the European Union. Explain how users can change their cookie settings or withdraw consent, whether through your cookie banner, a preference center, or browser settings.
If you use Google Analytics, social media pixels, or other data processing tools, name them. Avoid generic placeholders like “we use third-party analytics.”
Design, language, and placement for GDPR compliance
Privacy policies must be clear and easy to understand. Write in plain language at a reading level that does not require a law degree. Use short paragraphs (2–4 lines), descriptive headings, and bullet lists where they help.
Under Articles 12–14, the privacy notice must be easily accessible. Place a link in your website footer, within sign-up and checkout flows, and inside apps where data collection happens.
Add a short “at-a-glance” summary or key points box at the top of the page, followed by the full detailed policy. This supports both quick scanning and deeper reading.
Review and update your privacy policy at least annually, and whenever data processing practices change (new tools, new markets, or new types of processing).
Show the updated date near the top. Netflix learned this the hard way: the Dutch Data Protection Authority fined the company €4.75 million for, among other things, failing to keep its transparency disclosures current on purpose, legal basis, recipients, retention, and international transfers.
Example GDPR privacy policy structure and mini template
Here is a section-by-section structure a founder could use as a starting point for a single-page GDPR compliant privacy notice:
- Who we are (controller identity, contact details, DPO if applicable, effective date)
- What data we collect (categories, direct vs. automatic)
- Why we collect it (purposes linked to data types)
- Our legal basis (table mapping each purpose to a lawful basis)
- Who we share data with (categories of recipients, data processing agreements)
- International transfers (destinations, safeguards)
- How long we keep data (retention periods by type)
- Data security (measures, breach process)
- Your rights (list of rights, how to exercise, response time, complaint to supervisory authority)
- Cookies and tracking (categories, consent, named tools)
- Changes to this policy (review schedule, notification method)
Two sections of this structure are worth spelling out with sample wording, since founders often get stuck on exact phrasing:
Sample wording for purposes and lawful basis
“We process your email address and account credentials to provide and maintain your account. Our legal basis for this processing is performance of a contract (Article 6(1)(b) of the GDPR).”
Sample wording for user rights
“You may request a copy of the personal data we hold about you by emailing [email protected]. We will respond within one month. If you believe we have handled your data unlawfully, you may contact your local data protection authority.”
This is an example structure, not legal advice. Your final document must reflect your company’s specific services, data flows, and use of data processors.
Use it as a starting point to generate or refine your own GDPR privacy policy template, then have it reviewed by a legal professional if your risk profile warrants it.
Key Takeaways
- Map every category of personal data you collect, link each to a stated purpose and a lawful basis under Article 6, and document third-party sharing and international data transfers with the appropriate safeguards.
- List all user rights under Articles 15–22 (access, correction, deletion, portability, restriction, objection, and consent withdrawal) and give concrete, simple instructions for exercising them.
- Make your GDPR privacy notice easy to find (website footer and every data collection point) and tailored to your actual data collection and security practices—not copied from a generic template.
- Write everything in clear, plain language, in short 2–4 line paragraph blocks, aimed at founders and small teams rather than lawyers.
- Treat GDPR compliance as ongoing: schedule annual reviews, keep records of your lawful-basis decisions, and update the policy whenever tools or processing activities change.
- A GDPR compliant privacy policy reduces regulatory risk (fines can reach €20 million or 4% of global annual turnover), strengthens negotiations with larger customers, and builds user trust.
Ready to build your own GDPR compliant privacy notice? Preview or generate a tailored policy based on the structure above, then customize every section to match your real data processing. A policy that reflects what your business actually does is the one that protects you.
FAQ
Do I need a GDPR compliant privacy policy if my company is not based in the EU?
GDPR applies whenever you offer goods or services to people in the European Union or European Economic Area, or when you monitor their behavior online (for example, through analytics or ad tracking).
If you ship to EU countries, accept euro payments, or target EU citizens with localized content, you need a GDPR compliant privacy notice regardless of where your company is incorporated.
Can I use one privacy policy for both GDPR and other laws like CCPA?
Many companies maintain a single global data protection policy with clearly labeled sections covering GDPR requirements alongside other laws like CCPA or CPRA. One document can work, but it must satisfy each regime’s specific rules.
GDPR requires mapped lawful bases and data subject rights disclosures; CCPA requires separate disclosures about selling or sharing personal information. Label each section so readers can find the rules that apply to them.
Is consent always required under GDPR for processing personal data?
Consent is only one of six lawful bases under Article 6. For core operations like delivering a service under contract, processing payments, or complying with tax law, consent is not the right basis.
Consent is typically used for optional activities: marketing emails, non-essential cookies, or behavioral profiling. If you rely on consent, users must be able to withdraw consent as easily as they gave it.
How detailed do my data retention periods need to be in the policy?
GDPR does not require publishing exact deletion dates but expects clear retention logic. For example: “We keep account information while your account is active and for up to 3 years after closure.”
Include typical ranges and explain that some records (like invoices) are kept longer to meet legal or accounting obligations.
Do I have to name every single third party and data processor?
GDPR allows listing categories of recipients instead of naming every vendor. Stating “cloud hosting providers,” “payment processors,” and “email delivery platforms” meets the baseline.
That said, many organizations choose to name key services (like their payment gateway or primary analytics tool) because it improves trust.
You can offer to provide more detailed information on specific processors upon request, balancing clarity with the flexibility to change vendors without rewriting the entire policy.
Keep data processing agreements in place with every processor so you can demonstrate compliance if asked.
