Your website’s privacy policy is essential to get right, as it’s both a legal requirement and a way to build vital trust with your customers. It clearly explains how you collect and process your personal data (something that today's consumers are more conscious of than ever). In fact, 75% of consumers said they will not purchase from organizations they don’t trust with their personal data.
But how can you ensure you’ve not left out any important details that could leave you exposed to compliance risks or a damaged reputation?
That's where a blueprint created by privacy experts can help. It's a sure-fire way of making sure the essentials are covered without having to spend a great deal of time.
Download our free privacy policy template, and read on to learn more about the importance of this must-have document.
A privacy policy (sometimes known as a privacy agreement or privacy notice ) is a legal document, but you can also think of it as a formal declaration of trust and transparency to your customers. Its purpose is to include information for anyone interacting with your business about how you collect, use, store, and share their personal data. It also lets users know what their rights are regarding their information, and what choices they have in controlling its handling.
Having this privacy policy page readily and clearly available for your customers helps keep your organization compliant, as there are numerous regulations worldwide surrounding data protection. But it also benefits you by strengthening your relationship with consumers, showing them that you take their privacy seriously.
What’s more, with data privacy and online monitoring being a rising concern for many people, a well-written, easily understood, and regularly updated policy is needed to stay on par with your competitors.
Rather build your privacy page from the ground up? Follow our expert guide on How to Write a Privacy Policy.
It should already be clear that the answer to this question is a resounding yes, but there are a couple of reasons why.
As mentioned earlier, there are numerous regulations regarding user data privacy around the world, and many of them state the need to post a privacy policy. It’s imperative that you comply with all laws applicable to you.
But how do you know which you need to remain compliant with? Usually, this depends on where your business is located, where your customers are located, and how much data you collect and use.
The two major laws affecting organizations like yours are:
The General Data Protection Regulation (GDPR) was enforced in May 2018, and is a primary force behind protecting user privacy. You’ll need to comply with its regulations if you process any personal data of EU residents (yes, even if your business isn’t based there). No matter the size and sector of your organization, if you offer products or services to, or simply monitor the behaviour of, EU citizens, you’re under the GDPR’s jurisdiction.
So, what does the GDPR say about privacy policies? Essentially, it requires all businesses to provide clear, accessible information about:
The GDPR specifically states in article 12 that this information must be provided “in a concise, transparent, intelligible and easily accessible form, using clear and plain language.” Clearly linking to a comprehensive privacy agreement from your website is the easiest way to fulfil this requirement.
Rather than having a federal law, US states have individual regulations regarding data privacy. More than 21 states have data privacy laws (e.g. the Virginia Consumer Data Protection Act or the Colorado Privacy Act), but the first and most influential of these is the California Consumer Privacy Act (CCPA), updated by the California Privacy Rights Act (CPRA).
Also enacted in 2018, but updated in 2020, the CCPA applies to organizations collecting/processing data from resident users in California, but it only covers businesses that meet certain thresholds:
The CCPA requires similar disclosures to the GDPR, with a custom privacy policy being the most appropriate way of providing these.
In short, the CCPA insists that businesses must inform users how data is collected, how it may be used, who it’s shared with and what rights users have over their information. You also need to give instructions on how to exercise these rights, including the right to opt out of the sale of personal data and access, delete, or correct it.
Under the updated version, you also must include a “Do Not Sell or Share My Personal Information” link on your site to enable this opt-out.
All of this information should be made clear within your privacy policy.
Although the GDPR and the CCPA are the two most commonly discussed and influential privacy laws, there are, in fact, over 130 across the globe. Some others to note include:
67% of Americans say they understand little to nothing about what companies are doing with their personal data, and 73% believe they have little control over what companies do with their data.
Clearly, there is a gap in trust between brands and consumers, but a well-written, simple privacy policy outlines the key practices that will battle some of these concerns.
By providing thorough, easily-understandable information on how data is used and why, policies build trust by demonstrating that you’re serious about maintaining user privacy. They also outline what rights your customers have, which reassures them that they remain in control.
As a result, you benefit from better customer relationships as well as more people being willing to engage with your brand.
In order to comply with standard privacy policy requirements from the GDPR and CCPA, your document must clearly provide the information these regulations demand. So, a good checklist to ensure you don’t miss out any important elements is:
By covering all of these individual elements, you’re ensuring your privacy policy is a legal document that is both compliant and user-friendly. Once you’ve included all these sections, take a moment to review the policy from a reader’s perspective. Is it clear and accessible? This is just as important as meeting regulatory requirements.
Your document should also be reviewed regularly, because both your business’s data processes and the laws governing them will inevitably change over time. For example, if you begin collecting new types of data or sharing information with more third parties, you’ll need to amend your policy to disclose these additions.
Any changes to this privacy policy must be communicated clearly to users so they understand how you handle the processing of personal data at all times.
Want a more comprehensive guide to what to include in your privacy agreement? Read our full Privacy Policy Checklist.
Once you’ve finished creating a policy, you’ll need to ensure it’s displayed somewhere that’s easy to find and in an accessible format on your website or app. Laws such as the GPPR specifically require this, so the step cannot be forgotten.
A consent banner, including a link to your full privacy policy, appears as soon as a user enters your website or app. This allows you to immediately obtain consent to collect personal information before doing so, but also offers the user fast access to your privacy agreement.
Slightly less “in your face” but still highly accessible is linking your privacy policy in your website footer, as this is a static menu that appears on every page of your site. Therefore, it allows your privacy page to always be accessible, no matter how a user browses your content.
Alternatively, you could set up a single online space or page where all your legal documents, including your privacy policy and terms and conditions, reside. These require more clicks on a user's part to navigate to, but having all information in one place is still accessible, offering consistency and giving users a single point of truth.
Rather than having a single location where your privacy policy resides, another option is to post it at any point where data is collected. This may be at your checkout or a sign-up page, perhaps.
Privacy policies can be challenging documents to make from scratch, so why not start with a template designed by our data privacy experts?
This free resource helps ensure you cover all bases and end up with a document that’s fully compliant and clear for your users.
We’ve pre-written the most common clauses and left plenty of room for you to customize and add to the template to make it reflective of your individual organization.
Download and use our free sample privacy policy template for your website.