A privacy policy, also called a privacy notice, is a public statement in which an organization explains how it collects, uses, shares and protects personal data, how long it retains that data, and how individuals can exercise their rights over that data. Among privacy fundamentals, it is the main instrument of transparency: data protection laws in many jurisdictions require it, and regulators treat its promises as binding commitments that can be enforced when practice differs from what the text says.
Practitioners often separate the two names. The external notice addressed to customers, users or visitors is what most people call the privacy policy, while an internal privacy policy sets rules for staff. This page covers the public-facing document, which is the meaning used in most laws and on most websites and apps.
What a privacy policy must explain
The content is driven largely by law. Under the GDPR, Articles 13 and 14 list the information that a data controller must provide to the data subject, and Article 12 requires it to be concise, transparent, intelligible and easily accessible, written in clear and plain language. Other laws, such as the CCPA in California, add their own disclosure items.
| Element | Question answered | Typical content |
|---|---|---|
| Controller identity and contact | Who is responsible | Legal name, address, privacy contact or data protection officer |
| Categories of data | What is collected | Contact details, usage data, payment data |
| Purposes and legal bases | Why it is processed | Contract, consent, legitimate interests, legal obligation |
| Recipients | Who receives it | Processors, partners, authorities |
| International transfers | Where it goes | Countries and safeguards used |
| Retention periods | How long it is kept | Periods or criteria for deletion |
| Individual rights | What people can do | Access, correction, deletion, objection, complaint |
A policy must also mention any automated decision-making with significant effects, whether providing data is mandatory or optional, and where data came from when it was not collected directly from the person.
How requirements differ between major privacy laws
The same document often serves several jurisdictions, so organizations map the strictest overlapping requirements. The differences concern mainly what must be disclosed, how often the text must be reviewed and which special links or statements are needed.
| Law | Key disclosure duties | Notable specifics |
|---|---|---|
| GDPR in the EU | Detailed list of purposes, legal bases and rights | Information at the time of collection |
| UK GDPR | Largely the same as the EU version | Complaints to the UK regulator |
| CCPA as amended by CPRA | Categories collected, sold or shared and consumer rights | Update at least every 12 months |
| CalOPPA | Policy for commercial websites and online services | Must be conspicuously posted |
| Other US state laws | Similar disclosures with local variations | Opt-out rights for targeted advertising |
In the United States, the Federal Trade Commission can treat a privacy policy that misrepresents real practices as a deceptive practice, even where no specific privacy statute applies. This makes accuracy as important as completeness.
Privacy policy compared with related documents
A privacy policy informs; it does not by itself create consent or a legal basis. Confusing it with consent forms or contractual terms is one of the most common compliance errors.
| Document | Main purpose | Addressed to |
|---|---|---|
| Privacy policy | Explain data practices and rights | Users, customers, the public |
| Cookie notice | Explain cookies and similar trackers | Website and app visitors |
| Consent request | Obtain a specific, informed agreement | The individual at a given moment |
| Terms of service | Set contractual rules of use | Users of the service |
| Data processing agreement | Bind a data processor to instructions | Service providers |
| Internal privacy policy | Set staff rules for handling data | Employees and contractors |
Writing and maintaining an effective policy
The best policies are built from a data inventory, not from a template. Teams first map which data flows exist, which tools receive data and for what purposes, and only then write the text. A policy that describes an ideal rather than actual processing creates legal risk.
- Use a layered structure: a short summary at the top with links to detailed sections below.
- Write in plain language and define necessary legal terms once.
- Provide just-in-time notices in apps and forms where specific data is collected.
- Keep a version history with effective dates and explain material changes to users.
- Review the text whenever new tools, vendors or purposes are introduced, and at least once a year.
App platforms add their own expectations. Mobile stores require a link to the policy in the app listing, and their privacy labels or data safety forms must match what the policy and the app actually do.
Common weaknesses
Regulators and courts repeatedly criticize policies that are vague, outdated or contradictory. Phrases such as data may be used to improve services, without further detail, do not meet transparency standards in stricter jurisdictions.
- Copying another organization’s text, which then describes tools and purposes that do not apply.
- Hiding sharing with advertising partners behind general wording.
- Stating that data is never sold while trackers share it for targeted advertising, which some laws treat as selling or sharing.
- Failing to name retention periods or the criteria used to set them.
Understanding it simply
A privacy policy is a page where a company explains what it does with your information: what it collects, why, who else sees it and how long it keeps it. It also tells you how to ask for a copy of your data or have it deleted.
Think of it as the company’s written promise about your data. Because laws make the company stick to that promise, an honest and clear privacy policy matters as much as a clear price list.
Applied in practice
A growing online language school sells courses to students in the EU and California. Its privacy policy was copied from a template three years ago and still mentions a payment provider it no longer uses, while saying nothing about a new video lesson platform or the analytics tool on its website.
The school maps its data flows and finds eleven services that receive personal data. It rewrites the policy with a one-screen summary, a table of purposes and legal bases, named categories of recipients, retention periods for recordings and separate sections for EU and California rights. It also aligns its app store privacy labels with the new text. When a student later requests access to her data, staff can answer within the legal deadline because the policy and the internal inventory now describe the same reality.