Privacy Policy Generator

A privacy policy is a factual disclosure

A privacy policy describes what your organisation actually does with personal data. Generators get a bad reputation because they produce something that reads well and describes nothing real. This one is structured around the disclosures GDPR Articles 13 and 14 require, and it asks you what you actually collect rather than assuming a template.

The sections that matter

Identity and contact details of the controller. The categories of personal data you collect and where they come from. The purpose of each processing activity and the lawful basis you rely on for it. Who you share data with, including named processors. Whether data leaves the country and under what transfer mechanism. How long you keep each category. The data subject rights available and how to exercise them. The right to complain to a supervisory authority.

Legal basis is per purpose, not per site

The most common defect in a generated policy is claiming a single legal basis for everything. In practice a typical site relies on several: contract for delivering the service a customer signed up for, legitimate interests for security logging and fraud prevention, consent for marketing email and non-essential cookies, and legal obligation for retaining invoices. Stating the basis per purpose is what makes a policy credible, and it is what a regulator will look for first.

Name your processors

Vague references to "trusted third parties" are not adequate. If you use a specific analytics provider, email service, payment processor or hosting company, name it and say what it receives. The generated policy produces a processor table for exactly this. It also prompts you for international transfers, because if your processors are outside the EEA you need to state the safeguard you rely on, such as Standard Contractual Clauses or an adequacy decision.

Retention periods

"As long as necessary" is not a retention period. GDPR expects either a defined duration or the criteria used to determine it. Being concrete here is genuinely useful internally too, since it forces a decision about when data actually gets deleted.

This is a starting point

A generated policy is a structured first draft that captures the required disclosures. It is not legal advice, and it cannot know your internal practices. If you process special category data, handle children's data, operate in multiple jurisdictions, or make automated decisions with legal effects, have a practitioner review the result.