Privacy Policy Template
What you collect, why, who sees it and how long you keep it.
Details
privacy policy templateUploads
Your logo
A photo or picture
Goes on this page only. Drag it anywhere and pull its corner to resize it.
Your signature
Draw it with a finger, a mouse or a trackpad, and it goes on the page like a picture.
Pictures and signatures stay on this device. Nothing is uploaded to a server.
Red highlights mark what is still blank. Click anything on the page to change it. Your draft is kept on this device as you work.
This policy explains what personal data [company] collects through [website], why we collect it, and what you can do about it. It applies from October 14, 2026.
1. What we collect
| Data | Why or when |
|---|---|
| [add what you collect] |
2. What we use it for
| [add purposes] |
3. Who we share it with
| [add recipients] |
4. How long we keep it
[retention period]
5. Your rights
Depending on your state you may have the right to know what we hold, to request deletion, to correct it, and to opt out of its sale or sharing. We do not sell personal information.
6. Contact
Questions or requests about this policy go to [email].
What is a Privacy Policy?
A privacy policy is the notice you publish telling people what personal data you collect, why, who else sees it, how long you keep it and what rights they have. It is not decoration. Data protection regimes almost everywhere require this information to be given at or before the point of collection, and app stores, payment processors and advertising platforms will not onboard a business that cannot produce one that matches what it actually does.
Anyone collecting personal data from the public needs one: a site with a contact form, an online shop, a mobile app, a clinic booking system, a recruitment page, a newsletter signup. It is read by ordinary users occasionally, by procurement teams assessing you as a supplier fairly often, and by a regulator after a complaint. Separate notices usually sit alongside it — an employee privacy notice, a candidate notice, and a cookie notice with a working consent mechanism — because one document cannot serve all of those audiences well.
The required content varies, so check the regimes covering your users rather than only your own location. UK and EU GDPR specify a list including the lawful basis for each purpose, retention periods, international transfers and the safeguards relied on, and the right to complain to a supervisory authority. US law is state by state, with California, Virginia, Colorado and others each setting disclosures and opt-out rights, plus sector rules such as HIPAA and COPPA. India's DPDP Act, Canada's PIPEDA and provincial laws, and the Australian Privacy Principles each have their own requirements.
Publishing a policy does not make processing lawful. You still need a valid basis, and a sentence saying you may share data with partners is not consent. It does not replace a cookie banner or consent management tool where consent must be obtained before cookies are set. It does not cover employees, who need their own notice. And it is not a data processing agreement — a supplier handling data on your behalf needs a contract with specific terms, not a link to your public policy.
What to put in a Privacy Policy
These are the details this template asks for. Anything left blank is marked in red on the preview so you can see what is still missing.
| Field | What goes in it |
|---|---|
| Legal entity name | For example: Barton Supply Co. |
| Your address | For example: Unit 7, Barton Road, Columbus, OH 43212 |
| Website or app | For example: www.example.com |
| What you collect | One per line: Data | Why or when |
| What you use it for | One per line |
| Who you share it with | One per line |
| How long you keep it | For example: For as long as the account is active, and for seven years afterwards where accounting law… |
| Privacy contact | For example: privacy@example.com |
How to write a Privacy Policy
List every collection point you have
Walk your own site, app and back office: forms, checkout, account creation, newsletter, chat widget, analytics, advertising pixels, CCTV, call recording, CVs arriving at a careers address. Note what each collects and where it goes. Most inaccurate privacy policies are inaccurate because nobody made this list, and one that omits your analytics is wrong from the day it is published.
Say what you collect and why, per purpose
Group by purpose rather than by field. For each purpose, state the data used, the reason, and the lawful basis or equivalent justification where your regime requires one: fulfilling an order, sending marketing to people who asked for it, preventing fraud, meeting a legal obligation. To improve our services is the single most criticised sentence in privacy notices, because it explains nothing.
Name who else receives the data
List the categories of recipients and, where you can, the actual providers: payment processor, hosting, email platform, CRM, analytics, delivery firm, professional advisers, and disclosures required by law. If data leaves the country or region where it was collected, say so and name the transfer mechanism you rely on. Vagueness here is what turns a routine complaint into an investigation.
State retention and rights with real routes
Give retention periods by category, or the criteria used to set them. Then set out the rights available under the applicable regime — access, correction, deletion, objection, portability, opt-out of sale or sharing where that concept exists — and, critically, how to exercise them: a named address or form, and how long you take to respond. A rights list with no route generates complaints.
Date it, version it, keep it accurate
Put a last-updated date on it, retain previous versions, and say how you notify people of material changes. Then tie the policy to a trigger: any new tool, market or purpose means the policy is checked before launch. An out-of-date policy is worse than a short one, because it is a written record of a promise you have stopped keeping.
Common mistakes
- Copying another company's policy and leaving in services you do not use or omitting ones you do, which turns the document into a written record of inaccurate statements about your own processing.
- Claiming consent as the basis for everything, when consent must be freely given and withdrawable and you must be able to stop the processing the moment somebody withdraws it.
- Setting analytics and advertising cookies before collecting consent where consent is required, which the policy does not fix and which is among the most commonly enforced failures.
- Giving no named route for rights requests, so requests arrive scattered across mailboxes, statutory response deadlines pass unnoticed and complaints follow.
- Treating the policy as a launch task, so a chat widget or advertising pixel added months later silently makes the published notice untrue.
Frequently asked questions
Do I need a privacy policy for a small website?
If the site collects any personal data — a contact form, an email signup, comments, analytics that identify users — then almost certainly yes under the regimes covering your visitors. It is also a practical requirement, since payment providers, app stores and advertising networks all ask for one. Size affects the scale of your obligations, not whether they apply to you at all.
Can I use a free privacy policy template?
A template gives you the structure and reminds you what to cover, which is genuinely useful. What it cannot know is which tools you run, where your users are, or what basis you rely on — and those are the parts a regulator actually reads. Use it as a checklist, fill it from your own inventory, and get it checked if you handle sensitive data.
Where should the privacy policy link go?
In the footer of every page, next to any form that collects data, at account creation, at checkout, and in the app store listing where relevant. Most regimes require the information to be available at or before collection, so a link one click from the homepage but absent from the signup form does not meet the requirement.
What is the difference between a privacy policy and terms of use?
Terms of use are a contract governing how people may use your service. A privacy policy is a notice, not a contract, telling people what happens to their personal data. Merging them is a common error: it buries the privacy information and blurs the line between what a user agrees to and what you are legally obliged to tell them.
How often should a privacy policy be updated?
Whenever what you do changes — a new processor, a new purpose, a new country, a new tracking tool — and on a scheduled review at least annually otherwise. Keep the date visible and keep old versions, because a complaint or a claim usually concerns processing that happened under an earlier version of the notice rather than the current one.
This page explains general practice and is not legal advice. Requirements differ between countries and, in some cases, between states — check what applies where the document will be used.