Legal & ComplianceContent Creator

Privacy policy template: sections to write and facts to check

A privacy policy tells people what personal information your business collects, why it collects it, who receives it, and how they can ask questions or make requests. A template helps with structure, but every statement has to match what your site, forms and tools actually do. Have counsel review the final text, because the rules that apply depend on where you operate and where your users are.

Section outline

Build the policy from an inventory of your data

  1. Who you are and how to reach you

    Name the business or site operator and one route for privacy questions. Add a postal address only where your situation calls for one.

    50 words
  2. Information you collect

    List the categories you actually collect, such as contact details from a form, account details, booking history, or usage data from analytics. Tie each category to where it comes from.

    110 words
  3. How you use each category

    For each category, state its purpose: replying to a message, processing a booking, or improving a page. Avoid vague purposes such as business purposes.

    90 words
  4. Who receives it

    Name the types of providers that process data for you, such as an email tool or a payment processor, and any case where data is shared outside your business. Leave out vendors you no longer use.

    90 words
  5. How long you keep it

    Give the period for each category, or the rule you use to set it, and describe how you delete or de-identify records when that period ends.

    70 words
  6. Choices and requests

    Explain how a person can ask for a copy, a correction or a deletion, and what you do when a request arrives. Offer only the rights your process can honor.

    90 words
  7. Cookies and similar tools

    If your site uses cookies or trackers, name the kinds and how visitors can control them. Describe only the tools that are installed.

    60 words
  8. Changes and the date

    Show the last-updated date and say how you will tell people about material changes.

    40 words

Total: 600 words

Example excerpt

A sample information section for a fictional florist

Sample section

Illustrative example. The business and details below are fictional. Replace every statement with what your own site and tools actually do. Information we collect. When you place an order, we collect your name, delivery address, phone number and email address. If you create an account, we also store your order history and saved addresses. Our website uses a small number of cookies to keep your cart and to count visits to each page. How we use it. We use your details to confirm and deliver your order, to send a receipt, and to answer messages you send us. We use order history to show you past orders when you ask for them. We use visit counts to decide which pages to update. Who receives it. Our email service sends your receipts, and our delivery partner receives your name, address and phone number so the order can be delivered. We do not sell your information. How long we keep it. We keep order records for as long as our accounting rules require, then delete them. Account details are deleted when you close your account. Your choices. You can ask for a copy of your details, ask us to correct them, or ask us to delete your account by emailing [email protected]. We reply to these requests within the period stated on our contact page.

Quality checklist

Check each statement against your practice before you publish

  • Each category of data in the policy matches a form, booking, account or tool you actually use.
  • Every category has a stated purpose and a source.
  • The third parties named are providers you use today, and no provider that processes your data is missing.
  • Retention periods, or the rule used to set them, are written out rather than left blank.
  • The contact route works, and a named person is responsible for privacy questions.
  • Sensitive categories such as health, children's or financial information are either avoided or covered after review by counsel.
  • The last-updated date on the page matches the text readers see.
  • Counsel has reviewed the final text for the places where your users are located.
Share the finished page

Put the policy where people share their details

Public link

Publish a public link when the policy is final, then place it in the site footer and next to every form that asks for personal details. A link only on a separate About page is too far from the moment someone submits information.

Team link

Share a team link with the people who answer privacy requests, so they work from the same wording and the same last-updated date.

HTML download

Download the generated HTML file for your records, with the last-updated date in the file name. Keep earlier files so you can show which wording was published on a given day.

Frequently asked questions

Is there a privacy policy generator that makes my policy compliant?

No. Attain OS Content Creator builds one self-contained HTML page from the description, documents and details you give it. It does not make a policy compliant with any law. Have counsel review the final wording.

Does my privacy policy have to meet GDPR?

That depends on where you operate and where your users are, and this page does not explain what any law requires. Ask counsel which rules apply and what the policy must say. A template does not make a site meet any law by itself.

Can I copy a privacy policy example from another website?

It is risky. Another company's policy describes its own data practices, not yours, and copying it can leave you with promises you do not keep. Use other policies to see how sections are ordered, then write from your own data inventory.

What should a privacy policy for a website cover?

Start with the categories of information your site collects, the purpose of each, who receives it, how long you keep it, and how people can contact you. Add cookie and analytics details only for tools the site really uses.

Where should the privacy policy link go?

In the footer of every page, and next to any form that asks for personal details. Readers look for the link at the point where they hand over information, so place it there as well as in the footer.

Browse by category

More documents in Legal & Compliance

How to build it

  1. Follow the eight-step wizard: type, assets and description, images, branding, contact and call to action, Atty Suggestions, blueprint, and generate. Atty generates one HTML page in the background. Review it, then publish and share the page link or download the HTML file.

Attain OS BETA