What is a privacy policy?

A privacy policy explains how an organization collects, uses, shares, and retains personal information. It identifies who is responsible for the data, outlines people’s rights, and provides contact details.

The exact information a privacy policy should include depends on applicable laws, such as the GDPR, and the organization’s activities. Common disclosures cover data types, processing purposes, recipients, and retention periods, with additional details about legal bases, international transfers, and complaint procedures where required.

A policy can cover websites, apps, and offline activities. Often called a privacy notice, it should describe actual practices in clear, accessible language. Providing this information is different from asking users to accept a privacy policy: publishing or acknowledging a notice does not itself establish valid consent or make processing lawful.