How to write a privacy policy?

Start by identifying what personal information you process and what happens to it. Then cover:

1. Your organization’s identity and relevant contact details.

2. The information collected, its sources, and collection methods.

3. Processing purposes and legal bases where required.

4. Recipients, service providers, and relevant international transfer safeguards.

5. Retention periods or the criteria used to determine them.

6. Applicable rights, request procedures, consent withdrawal, and complaints.

7. Additional disclosures where relevant, such as significant automated decisions or mandatory data collection.

The ICO’s disclosure checklist provides a UK GDPR reference.

A privacy policy template can help structure the text. Before publishing, compare it with your actual tools and data flows, remove inapplicable statements, and show its effective or updated date. Make it accessible at collection points and review it when practices change.