Privacy policy: required content

In short: A privacy policy informs visitors in an understandable way about which data a website processes. The required content follows from Art. 13 GDPR.

Not legal advice. A privacy policy should match actual operation and, if in doubt, be legally reviewed.

In more detail: It must be easily accessible (link in the footer of every page) and in clear language. It describes what actually happens, not what would theoretically be possible.

In Depth

What typically has to be included

1. Name and contact details of the controller (and data protection officer, if any)
2. Purposes and legal bases of each processing operation
3. Legitimate interests, if relied upon
4. Recipients or categories (hoster, payment provider, email service)
5. Transfers to third countries and safeguards
6. Retention period or criteria
7. Data subject rights, right to withdraw consent, right to complain to the supervisory authority
8. Whether provision is required by law or contract
9. Automated decisions, if any

Typical building blocks of a website

server log files, cookies and browser storage (cookie consent (TDDDG)), contact form, registration, newsletter, payment handling, embedded content, tools with local storage.

Maintenance

Check with every new feature whether the policy needs updating. State the date of the last change.

See also: GDPR: principles and legal bases, Impressum