How to Write a Privacy Policy
Write a privacy policy by identifying what personal data you collect, your lawful basis for processing, how long you retain it, who you share it with, and how individuals can exercise their data subject rights under UK GDPR.
Last updated: February 2025
Step-by-Step Guide
Audit your data processing activities
Map out what personal data you collect, where it comes from, why you process it, and who receives it.
- •Include data from website cookies, contact forms, email marketing, and employee records.
Identify your lawful bases
For each processing activity, determine the lawful basis under Article 6 of UK GDPR (consent, contract, legal obligation, legitimate interests, etc.).
- •Do not default to consent for everything; legitimate interests or contractual necessity may be more appropriate.
Draft the privacy policy content
Include your identity and contact details, DPO details if applicable, data processing purposes, lawful bases, recipients, international transfers, retention periods, and data subject rights.
- •Write in clear, plain language. Avoid legal jargon.
- •Use layered notices for complex processing.
Publish and maintain the policy
Make the policy easily accessible on your website footer and at points of data collection. Review and update it whenever processing activities change.
- •Date the policy and keep an archive of previous versions.
Legal Requirements
Articles 13 and 14 of UK GDPR specify the information that must be provided to data subjects. The policy must be concise, transparent, intelligible, and easily accessible. The ICO (Information Commissioner's Office) provides detailed guidance on what to include.
Common Mistakes
Template / Example
When to Get a Solicitor
If you process sensitive (special category) data, make automated decisions about individuals, transfer data internationally, or are unsure about your lawful bases.
FAQ
Is a privacy policy legally required in the UK?
Yes. Under UK GDPR and the Data Protection Act 2018, any organisation that processes personal data must provide a privacy notice to data subjects explaining how their data is used.
What happens if my privacy policy is not GDPR compliant?
The ICO can issue enforcement notices and fines of up to £17.5 million or 4% of annual global turnover, whichever is higher. Non-compliance also undermines customer trust.
Let AccountsOS handle this for you
Our AI generates UK-compliant contracts and guides you through every step. From £10/month.
Get Started FreeThis is guidance, not legal advice. Consult a solicitor for complex matters.
View all how-to guides