Research guide
What should a privacy policy include?
A privacy policy should tell a reader who is responsible, what information is collected and from where, why it is used, who receives it, where it goes, how long it is kept, how it is protected, what rights and choices exist, and how to make contact. Regional laws add specific items on top of that core, so the right contents depend on your audience and features rather than on a fixed template.
Who is responsible and how to reach them
Name the legal entity or individual that decides how information is used, the product or website the policy covers, a postal address where required, and a working contact route. The UK ICO list of privacy information starts with the organization's name and contact details, and the GDPR also asks for the contact details of a data protection officer and an EU or UK representative where one is appointed. Quebec's Law 25 requires the title and contact details of the person in charge of protecting personal information to be published on the business website.
What information is collected and from where
Describe categories a normal reader recognizes, such as contact details, account information, payment records, device and usage data, location, content users upload, and communications. Say whether the information comes directly from the person, is collected automatically through cookies, SDKs, or logs, or is received from third parties such as sign-in providers, payment processors, or advertising partners. Where information comes from someone other than the individual, GDPR Article 14 adds the categories and the source to the required notice.
Why it is used and on what basis
Connect each purpose to the information involved: providing and securing the service, accounts and support, payments, communications, analytics, marketing, and advertising. Under the GDPR and UK GDPR you must also state the legal basis for each purpose, such as contract, consent, legal obligation, or legitimate interests, and name the legitimate interests you rely on. Avoid listing every possible purpose; unused purposes make the notice inaccurate.
Who receives it and whether it leaves the country
Identify recipient groups and, where readers need them, the specific providers: hosting, payment, analytics, email, support, advertising, and AI providers, plus professional advisers and authorities where legally required. Explain international transfers and the safeguard used, such as an adequacy decision or standard contractual clauses. Australia's APP 1.4 asks whether information is likely to be disclosed to overseas recipients and, if practicable, the countries involved.
How long it is kept and how it is protected
Give retention periods or the criteria used to decide them, for example keeping account data while the account is active and billing records for statutory accounting periods. The GDPR requires the period or the criteria. Describe security measures in general terms, such as encryption in transit, access restriction, and monitoring, without promising that information can never be accessed without authorization.
Rights, choices, and requests
Explain the rights that apply to your audience and how to exercise them: access, correction, deletion, portability, objection, restriction, withdrawal of consent, and the right to complain to a supervisory authority under the GDPR; the rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive information under California law; and access and correction rights under Canadian, Australian, and New Zealand law. Give request methods that actually work and explain verification. CalOPPA also requires a description of how users can review and request changes to their information, where such a process exists.
Children, tracking signals, changes, and dates
State the intended audience and how children's information is handled; if the service is directed to children under 13 in the United States, COPPA requires specific parental notice and consent content. CalOPPA requires the policy to explain how the operator responds to browser Do Not Track signals, whether third parties collect information about users across sites, how users are notified of material changes, and the effective date. Keeping an effective date and a record of previous versions lets you show which version applied at a given time.
What to leave out
Leave out clauses for features you do not have, providers you do not use, and laws that do not apply. Avoid guarantees of compliance or absolute security, blank fields and bracketed tokens, and statements that contradict your consent banner or app-store disclosures. The Legal Policy Generator blocks generation when an active clause lacks a required fact and never publishes unresolved tokens.
Official sources checked for this guide
Platform rules and legislation can change. Verify the current text before publishing or making a high-risk decision.
Common questions
How long should a privacy policy be?
Long enough to cover every required item for your actual processing and no longer. Layered structure, clear headings, and a table of contents help readers find what they need.
Do I need a separate cookie policy?
Not necessarily. Cookie and tracking information can live in a dedicated section of the privacy policy. A separate cookie policy is useful when the list of technologies is long or managed by a consent tool.
From the blog
How to write a privacy policy, step by step
Write a privacy policy from your actual data practices. Follow nine steps covering data, providers, rights, publication, and a final checklist.
Where to put your privacy policy link on a website
Place your privacy policy link in the footer, beside forms, at checkout, and in apps. Check clear labels, public access, and keyboard usability.