What a privacy notice is for
A privacy notice, sometimes called a privacy policy, tells people what you do with their personal information. In many places the law expects one wherever you collect data, and it often specifies what must be included. Those requirements vary by country and change, so this article cannot give you a complete list and is not legal advice. What it can do is explain how to make whatever you must say understandable.
A notice that nobody can follow does not do its job, even if it is technically complete. Regulators in various places have stressed that privacy information should be concise, clear and easy to find. That is the standard worth aiming for.
Start from what you actually do
Before writing a word, find out the facts. A notice that describes practices you do not follow, or leaves out ones you do, creates exactly the surprise that privacy rules try to prevent.
Create a simple inventory:
- What do we collect? Look at forms, accounts, purchases, support messages, analytics and ad tags.
- Why? Name the purpose of each item.
- Where does it go? Email tool, payment provider, delivery partner, analytics, advertising platforms and so on.
- How long do we keep it?
- Who inside the business can see it?
- How can people reach us about it?
Doing this often reveals data you no longer need, which is a good moment to apply data minimisation. It also feeds directly into your process for handling requests to access or delete data.
Plain-language principles
Write to one reader
Imagine a customer with no legal background reading on a phone. Use “we” and “you”. Prefer short sentences and common words. A plain language approach means saying “We keep your order details for seven years because tax rules require it” (if that is true for you) rather than “Data will be retained pursuant to applicable obligations.” The example is illustrative; use your own accurate facts.
Put the important things first
Open with a short summary of the essentials: who you are, what you collect, the main reasons and how to contact you. Detail can follow below it. People rarely read every line, so make the first screen useful.
Use clear headings that match questions
Readers scan. Headings phrased as questions or topics, for example “What we collect”, “Why we use it”, “Who we share it with”, “How long we keep it”, “Your choices” and “How to contact us”, help them find their answer.
Be specific rather than vague
“We may use your information to improve our services” says little. “We use your purchase history to suggest related products in emails you have signed up for” says a lot. Where you can, give concrete examples, and avoid broad words like “partners” without explaining who they are in general terms.
Explain choices where they apply
Say how to unsubscribe, how to change cookie settings, how to ask for a copy of your data and how to complain if someone is unhappy. Make these steps real: a working email address, a settings page, a named contact.
Avoid scare language and false comfort
Do not write “we take your privacy very seriously” in place of detail. Do not promise “we never share your data” if you use processors that handle it for you. Do not claim that data is “100 percent secure”; no one can guarantee that. Accuracy builds more trust than reassurance.
Keep the tone steady
You are informing, not selling. Skip promotional language, and keep the same voice you use elsewhere on the site, in line with a consistent brand voice.
Topics a notice commonly covers
Exact requirements depend on where you operate, so check them. Typical headings include:
- Who you are and how to contact you
- What personal data you collect, and from whom
- What you use it for
- The basis on which you use it, where your law asks you to state one
- Who receives it, such as service providers
- Whether data is sent to other countries, where relevant
- How long you keep it
- Cookies, pixels and similar technologies
- The rights people have and how to use them
- How to complain
- When the notice was last updated
For marketing, make sure the notice matches what you say at sign-up. If your form promises monthly emails, the notice should not describe a broader practice. It should also fit with your wording for email and SMS permission and with your cookie banner.
Make it easy to find and read
- Link to the notice in the website footer, on forms and in email footers.
- Place a short reminder next to sign-up fields, with a link to the full text.
- Use readable type, good colour contrast and headings so assistive technology can navigate it.
- Avoid long walls of text. Short paragraphs and an occasional list help.
- Offer a printable or downloadable version if you expect people to want one.
Test it
Ask someone outside your business to read it and answer three questions: what do they collect, why, and how would I ask them to stop? If they struggle, revise. Fresh eyes spot jargon you no longer notice.
Keep it current
A notice is out of date as soon as your practices change. Review it whenever you add a tool, start a new kind of campaign, change a supplier or begin serving a new country. Set a reminder to review it on a regular schedule even if nothing seems to have changed. Record the date of the last update, and consider keeping previous versions.
A word on templates and advice
Many people copy a notice from another site. That is risky, because it describes someone else’s practices and may include terms that do not fit your business. If you use a generator or template, treat it as a starting point and edit it until it matches reality. For complex or high-risk situations, such as sensitive data, children’s data or large international audiences, a qualified professional can review your text.
The goal is straightforward: a notice that a reasonable person can read in a few minutes and come away knowing what happens to their information.