Key points
- A privacy policy is an essential document for any organisation that collects personal data, and the GDPR requires it.
- Information for users must be clear, accessible and complete, written in plain language without technical jargon.
- It must cover the purposes of collection, the categories of data, the legal basis, the recipients, the retention period and users’ rights.
- It must also set out how rights can be exercised, the controller’s contact details, transfers outside the European Union and the cookie policy.
- An e-commerce site must emphasise transaction security, retention periods for purchase histories and disclosure to partners.
- For an association, the policy describes the data collected for membership and events, and reminds people that they can exercise their rights.
A privacy policy is an essential document for any organisation that carries out personal data collection. Since the GDPR became applicable on 25 May 2018, every organisation must comply with strict legal obligations on how it drafts and publishes its privacy practices. Information for users must be clear, accessible and complete in order to establish genuine transparency about how the information collected is processed. This guide sets out the essential steps to draw up a privacy policy that fully complies with the GDPR, with examples adapted to different business sectors.
GDPR privacy policy basics
The General Data Protection Regulation (GDPR) requires all entities processing personal data in the European Union to ensure their protection and to inform the individuals concerned transparently. The privacy policy therefore becomes central to demonstrating compliance and clearly explaining how the data collected are managed.
Adopting an accessible policy that is easy to understand not only limits the risk of sanctions, but also strengthens users’ trust in your services. To better understand all the legal and practical issues involved in compliance, you can read this short guide to applying the GDPR (in French) written by our team. Each provision must be written in plain language, without technical jargon, so that everyone can easily understand their rights and how their data are used.
What must a GDPR privacy policy include?
A compliant policy requires a precise structure, imposed by the GDPR. Although some points vary by business sector, several items of information remain essential.
- Purposes of the collection of data
- Categories of personal data processed
- Legal basis for the processing
- Any recipients or processors
- Retention period of the data
- Rights granted to users (access, rectification, erasure, objection, portability, etc.)
- How to exercise these rights and the controller’s contact details
- Any transfers outside the European Union
- Cookie policy and trackers
We recommend presenting this information in a logical order, taking care over clear language and the accessibility of the text, in keeping with the spirit of the GDPR. If you encounter specific difficulties while drafting, tailored support from a GDPR lawyer in Paris can prove decisive in strengthening the compliance of your documentation.
Sector examples: how should you adapt your privacy policy?
Although the general principles apply to everyone, each sector has its own specific features in terms of data collection and uses. Analysing these differences allows you to offer tailored transparency and genuine compliance suited to your own needs.
You should therefore adapt your privacy policy to the nature of the business, the types of data processed and the specific expectations of the target audience.
What are the main issues for an e-commerce site?
An e-commerce site generally processes a large volume of personal data: identity, addresses, banking information, purchasing preferences. The policy must emphasise transaction security and detail retention periods, in particular for purchase histories.
Particular care is needed regarding the disclosure of data to logistics or technical partners, and the management of consents for marketing. Listing precisely the third parties concerned supports a high level of transparency towards customers.
How should an association word its privacy policy?
For an association, data collection often relates to membership, organising events or sending newsletters. It is essential to describe the nature of the information requested (name, address, status, etc.) and the safeguards in place to limit access to authorised volunteers only.
The privacy policy must also remind people that they can exercise their rights without any consequence for their participation in activities. A summary table can help to show the collection channels and how they are used:
| Type of data | Purpose | Recipient(s) | Retention period |
|---|---|---|---|
| Newsletter | Communication volunteers | Until the person unsubscribes | |
| Identity | Membership | Association’s board | For the duration of membership |
What are the legal requirements and recommendations for drafting?
The privacy policy must not only meet the obligation to inform, but also follow the form required by the GDPR. Three pillars are essential: accessibility, intelligibility and completeness.
- Make the text easy to find from every page of the site
- Write in clear language, without ambiguity or unnecessary legal terms
- Always specify how to contact the controller with a request
To ensure lasting compliance, we advise reviewing the policy regularly and updating it whenever there is a change in the processing carried out or new digital tools involving personal data collection are introduced.
What common mistakes should you avoid when drafting?
Using generic templates carries significant risks for compliance. A privacy policy that is too vague or too complex exposes you to sanctions in the event of an inspection and seriously damages your credibility with users.
Some organisations sometimes forget to mention the security measures in place, or oversimplify the description of individuals’ rights. Others neglect translation when the service targets international customers, which undermines understanding and compliance with the rules applicable in each country.
Why update your privacy policy regularly?
Any change in the way personal data are processed must be reflected in the privacy policy. Introducing a new form, changing service provider or anticipating new uses all require a rigorous update.
Neglecting this obligation creates a gap between actual practices and the information provided. Yet transparency remains the foundation of the compliance expected under the GDPR.
How can you ensure accessibility and clear language?
Accessibility is not limited to the visibility of the link to the privacy policy. It also means structuring the text in short paragraphs, using descriptive headings, and including lists and, where needed, tables to make reading easier.
User testing and an external review make it possible to check that the information meets GDPR criteria and remains understandable for the target audience.
FAQ: writing a GDPR-compliant privacy policy
What is the risk of failing to comply with the GDPR?
An incomplete or missing policy exposes you to inspections and to the financial penalties provided for by the GDPR. For a breach of the obligation to inform, fines can reach €20 million or, for an undertaking, 4% of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 83(5) GDPR). Beyond the financial aspect, it damages the organisation’s reputation and causes a loss of user trust.
| Type of non-compliance | Possible sanction |
|---|---|
| No policy at all | Fine + temporary or definitive limitation of processing (Article 58 GDPR) |
| Insufficiently protected data | Fine of up to €10 million or 2% of worldwide annual turnover (Article 83(4) GDPR) |
Which formats make a privacy policy easier to read?
Favour a logical breakdown into sections, the use of bullet points and the addition of explanatory tables to aid understanding. Complex or technical words should be avoided in favour of everyday, direct language. Providing concrete examples also helps users better understand the uses described.
- Clear headings that describe the content
- Lists to set out purposes or rights
- Tables to illustrate retention periods
- Short paragraphs, never too long
What procedure should you follow to handle requests for access to or erasure of personal data?
We recommend appointing a point of contact, such as the Data Protection Officer (DPO) where there is one, to respond to requests within one month, which may be extended by two months taking into account the complexity and number of requests (Article 12(3) GDPR). This procedure must be explained simply in the policy, with a dedicated form or e-mail address. Traceability and archiving of requests make it possible to demonstrate the organisation’s diligence in the event of a dispute.
- Receipt of the request
- Verification of the requester’s identity
- Processing and response within the deadlines
- Protected archiving of the request and the response
Do you need to appoint a Data Protection Officer?
Appointing a Data Protection Officer is mandatory for certain organisations, in particular public bodies or those processing sensitive data on a large scale. For others, the appointment remains optional but is a sign of good management and better GDPR compliance, while making communication with the authorities and the individuals concerned easier.
- Mandatory in the public sector
- Mandatory for regular and systematic monitoring on a large scale or large-scale processing of sensitive data
- Optional but advisable to strengthen transparency
