How to Write a GDPR-Compliant Privacy Policy

A GDPR privacy policy is far more than a legal formality tucked away in a website footer. It is the primary instrument through which organisations fulfil their transparency obligations under European data protection law. Articles 13 and 14 of the GDPR set out detailed requirements for the information that must be provided to data subjects, and failure to meet these requirements is one of the most frequent grounds for regulatory enforcement actions across the European Economic Area.

This guide walks through what a GDPR-compliant privacy policy must contain, how to structure it for clarity, and what pitfalls to avoid so your policy genuinely serves its legal purpose.

The Importance of Transparency Under the GDPR

Transparency is one of the core data protection principles enshrined in Article 5(1)(a) of the GDPR. It requires that personal data be processed lawfully, fairly, and in a transparent manner in relation to the data subject. Your privacy policy is the most visible expression of this principle.

In 2026, transparency is under the regulatory spotlight: the EDPB’s 2026 Coordinated Enforcement Framework specifically targets compliance with Articles 12-14, with 25 DPAs simultaneously auditing controllers across Europe to assess whether privacy notices are genuinely informative rather than boilerplate disclosures.

The practical consequences of getting it wrong are significant. According to the EDPB’s transparency guidelines, a privacy policy that is unclear, incomplete, or difficult to find may itself constitute a breach of the regulation. Supervisory authorities have imposed fines specifically for transparency failures – the French CNIL fined Google EUR 50 million in 2019 partly because its privacy information was spread across multiple documents and required several clicks to access. More recently, the Italian Garante and Spanish AEPD have sanctioned smaller organisations for privacy notices that failed to identify the legal basis for processing.

What Must a GDPR Privacy Policy Contain?

Articles 13 and 14 of the GDPR prescribe the specific information that must be provided to data subjects. The requirements differ slightly depending on whether data is collected directly from the individual (Article 13) or obtained from a third party (Article 14).

Identity, contact details, and purposes

Your policy must clearly identify the data controller, including the organisation’s name, registered address, and contact details. If you have appointed a Data Protection Officer, their contact information must also be included. Our guide to the DPO definition and missions explains when this appointment is mandatory. For each processing activity, you must state both the specific purpose and the legal basis relied upon. The GDPR provides six legal bases, and simply listing them generically is not sufficient. If you rely on legitimate interest, you must also describe the legitimate interest pursued. If you rely on consent, you must explain how consent can be withdrawn.

Retention periods and data subject rights

The storage limitation principle requires that personal data be kept no longer than necessary for the stated purposes. Your privacy policy must specify the retention period for each category of data, or the criteria used to determine that period. Vague statements such as “we retain data as long as necessary” have been specifically criticised by supervisory authorities as non-compliant.

Your policy must also inform individuals of their rights under the GDPR, including the right of access, the right to erasure, the right to rectification, and the right to lodge a complaint with a supervisory authority. You should explain the procedure for exercising these rights, including how to submit a data subject access request.

International transfers and automated decisions

If you transfer personal data outside the EEA, you must disclose this fact and identify the safeguards in place, such as Standard Contractual Clauses or an adequacy decision. According to the CNIL’s guidance on international transfers, this information must be specific enough for the data subject to understand the level of protection applied to their data.

Additionally, if your organisation uses automated decision-making, including profiling that produces legal or similarly significant effects, Article 13(2)(f) requires you to disclose this fact, provide meaningful information about the logic involved, and explain the significance and envisaged consequences for the data subject.

How Should You Structure the Policy for Clarity?

The GDPR requires that information be provided in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. This is not a stylistic preference; it is a legal requirement under Article 12(1).

Practical formatting recommendations

• Use layered notices. Consider a short summary layer with links to the full policy for each topic. The ICO’s privacy notice code of practice recommends this approach for complex processing environments.
• Organise by purpose. Rather than listing all legal bases in one section and all data categories in another, group information by processing activity so readers can find the details most relevant to them.
• Avoid legal jargon. Phrases like “legitimate interest pursuant to Article 6(1)(f)” are meaningless to most readers. Explain the concept in plain language, then reference the legal provision if needed.
• Include a table of contents. For longer policies, a clickable table of contents significantly improves navigation.

Research by the Cisco Data Privacy Benchmark Study found that 84% of consumers care about data privacy and want more control over how their data is used. A policy that is genuinely readable – not merely technically compliant – builds trust and reduces the volume of enquiries your organisation receives.

Common Mistakes That Undermine Compliance

Even organisations that invest effort in their privacy policy often fall into recurring traps that create compliance gaps.

Vague language and missing updates

Statements like “we may share your data with third parties for business purposes” fail the specificity test. You must identify the categories of recipients and the purposes for each sharing arrangement. The accountability principle requires you to demonstrate, with documentation, that your policy accurately reflects your actual processing activities.

A privacy policy is not a static document. Whenever you introduce new processing activities, change a legal basis, engage a new processor, or modify retention periods, the policy must be updated. Under Article 13(3), if you intend to process data for a purpose other than the one for which it was originally collected, you must inform the data subject before that further processing takes place.

How Does a Privacy Policy Fit into Broader GDPR Compliance?

A privacy policy does not operate in isolation. It is one component of a wider compliance framework that must be coherent and mutually reinforcing.

Your GDPR compliance checklist should include a periodic review of all information notices to ensure they remain accurate. A Data Protection Impact Assessment may identify new processing activities that require updates to your privacy policy. The internal processes you build to respond to data subject rights requests must be consistent with the procedures described in your policy.

The privacy by design principle also has a direct bearing on your policy: if data protection is embedded into the design of your systems and processes from the outset, your privacy policy will naturally be more accurate and easier to maintain because the underlying processing is better controlled and documented.

Steps to Take After Publishing

Publishing the policy is only the beginning. Ongoing management is essential to maintaining compliance.

Establish a review schedule – at minimum annually, and after any significant change to your processing activities. Train staff who handle personal data so they understand what the policy commits the organisation to. Monitor regulatory guidance from your supervisory authority and the EDPB for updates that may affect your disclosure obligations. According to a survey by the International Association of Privacy Professionals, over 75% of organisations that experienced a data protection complaint in the prior year had not updated their privacy policy within the preceding twelve months, suggesting a strong correlation between stale policies and enforcement risk.

FAQ

Does a privacy policy need to cover every processing activity?

Yes. Articles 13 and 14 require that information be provided for each distinct purpose of processing. If you process personal data for marketing, service delivery, analytics, and fraud prevention, each purpose must be separately described with its corresponding legal basis. Omitting a processing activity from your policy is itself a transparency violation.

Can a privacy policy double as a cookie notice?

A privacy policy and a cookie notice serve different legal requirements. Cookie consent is governed primarily by the ePrivacy Directive, which imposes specific consent obligations before placing non-essential cookies. While you can include cookie information within your privacy policy, most organisations find it clearer to maintain a separate cookie notice that links to the privacy policy for broader data processing details.

How often should a privacy policy be reviewed?

There is no fixed statutory frequency, but best practice is to review the policy at least once a year and after any material change to your processing activities, data recipients, or legal bases. The key test is whether the policy accurately reflects current processing at all times. An outdated policy that no longer matches your actual data practices creates both a transparency violation and an accountability gap.