Privacy Panic Attack? Learn How to Write a Privacy Policy Today

Disclaimer: This blog provides general information about writing a privacy policy. However, privacy laws can be complex and vary by jurisdiction. We advise that you get legal advice from a qualified lawyer to ensure that the privacy policy meets the specific needs of your website and business.

According to Penn State University research, only one third of companies make a privacy policy available to their website visitors.

That’s a pretty damning statistic, though one that reflects a general lack of awareness about legal requirements, and common misconceptions businesses have that they don’t actually need one.

But simply put, the privacy policy is a website essential. It’s another key building block of compliance with data protection laws, and builds trust with customers who can use it to understand how their data is handled. It also protects businesses from the potential legal and financial repercussions associated with data breaches and non-compliance.

And while there’s no shortage of free privacy policy generators available online, the pages they create are superficial at best. They may look like short, simple documents, but only a specialist lawyer can create one that meets the specific legal requirements of your business.

If you’re looking for advice on writing a privacy policy for your company, then this blog is a good place to start. In it, you’ll learn what a privacy policy is and how this document differs from platform to platform. It will also run through the basics of what you need to do to create one that meets legal requirements.

Let’s dive in!

The short answer to who needs a privacy policy is everybody.

It’s an essential page if you collect any personal data from users. And while privacy-focused martech is growing in popularity as a way to simplify workflows and protect customers, most businesses will still be collecting personal data as an operational necessity - we’re a privacy-first company for instance, but we still need to collect personal information as part of our user onboarding and payment processes.

Given this, the privacy policy is there to ensure transparency and build trust with internet users who are more aware about the vulnerability of their personal information online than ever before.

But crucially, a privacy policy is also a legal requirement that businesses need to comply with, it’s central to many of the pieces of data privacy legislation that have mushroomed in most places around the world, including the GDPR in the EU and the CCPA in California. 

It’s also important to remember that websites often have a wide range of different third-party services installed. These could be analytics, payment gateways, CRM platforms, or social media plugins. 

These integrations will all rely on data from your website visitors to function. And since you remain the data controller under privacy legislation, you’re ultimately responsible for what these third parties do with this data. As such, you’ll certainly need a privacy policy so that you can detail what these other businesses are doing with your website visitors’ data.

However, some websites won’t need a one, because of course there are some exceptions:

Exception #1: Websites that Don’t Collect Personal Data

1. Static Websites: If your website is purely informational and does not collect any personal information from users (e.g., no contact forms, no user accounts, no analytics tracking), you might not need a privacy policy.
2. Personal Blogs: If your blog does not have comments enabled, does not use any tracking cookies, and does not collect any user information, you may not need a privacy policy.

Exception #2: Websites that Don’t Use any Third-Party Services

1. No Analytics: Websites that do not use Google Analytics, social media plugins, or any other third-party services that track user behavior might not need a privacy policy.
2. No Advertising: Websites that do not display ads or use advertising networks that track user behavior may not require a privacy policy.

Exception #3: Websites with Limited Geographic Scope

Sites that operate in jurisdictions with no strict privacy laws might have fewer requirements. 

Today, these locations are few and far between. Most countries (or trading blocs) are in the process of drafting legislation if they haven’t enacted something already, with UNCTAD research showing that less than 5% of the world is turning a blind eye to the data protection of its residents.

However, it's important to note that many privacy laws (like GDPR) have extraterritorial reach, meaning they can apply to websites outside their jurisdiction if they serve users within it.

As such, this limited geographic scope extends to the location of website visitors, and businesses would need to implement technologies that control which locations of origin can access their site if they’re to use this as a reason to not have a privacy policy.

By now, you should have a pretty good grasp of what goes into a privacy policy. And if you’re now trying to work out what to write in a your privacy policy page, you’ll find further information on the process below:

Familiarize Yourself with Data Privacy Laws

We haven't got the crawl budget to go through every data privacy law here, but you’ll need to research the data privacy legislation that is relevant to your business and audience. 

This work will ensure absolute privacy policy compliance with all the laws that matter to your business.

But when in doubt, follow GDPR. It’s the gold standard that other data privacy laws aspire to and if your privacy policy meets the requirements of this law, it meets the requirements of every law.

We’ve also written elsewhere about how to write a GDPR-compliant privacy policy for our TWIPLA users, and this short copy might help you to understand the work involved.

What Personal Information is Collected

Next, you’ll need to work out what personal data is being collected by your website or app and any third-party dependencies that serve it. 

This is ultimately just a fact-finding mission and the information should be freely available from the different organizations involved. If not, get in touch with them.

How You Collect Personal Data

After this, you’ll want to go into detail about the methods you use to collect the data of website visitors (or app end users) in the first place.

More specifically, you’ll need to include information rebates to any website forms, cookies, app permissions, third party services. And remember, be open and transparent about ALL your data collection practices.

How the Personal Information is Used

Next, you’ll need to detail the various ways that your website and business uses the data that is collected from website visitors.

This could be for personalizing the user experience, analyzing website performance, or for any wider marketing purposes. But ultimately, your customers need to be able to read the privacy policy and understand from it exactly why your business needs their data in the first place.

Who the Data is Shared With

Now, you’ll want to draft information about any third-party companies that you’re sharing website visitor data with. This could be business partners, service providers, or advertisers.

They’ll all have their own specific reasons for needing website visitor data, and they’ll also have privacy policies that will go into detail about this. So explain why you’re sharing personal data with these entities, and write about the safeguards that are in place to protect his information.

How Personal Information is Protected

Personal data protection is central to the purpose that underpins privacy legislation.

As such, you’ll need to detail the security measures that your business has implemented to protect personal information from the risks of unauthorized access, data breaches, and other threats.

This can include anything from data encryption and data minimization to secure data storage and regular security audits.

How Users Can Opt Out

The privacy policy also needs to include clear instructions on how users can opt out of data collection, marketing communications, or any other data processing activities done by your organization.

Ensure that the process is simple and accessible via simple web forms, email links, mobile app settings, dedicated contact information, and straightforward instructions on a user-friendly interface.

Communicate Users’ Rights

Finally, don’t forget to inform your users about their rights regarding their personal data. These include their right to access, correct, delete, or restrict the processing of their information at any time.

Then, include instructions on how they can exercise these rights. For instance, they could do this by visiting your “Privacy Settings” page, contacting your business directly, or using any links provided in the privacy policy or elsewhere to manage their data preferences.

Once drafted, there’s a certain amount of freedom with regard to where to put the privacy policy on your website.

It should have its own webpage or app screen/view.

However, it should also be easily accessible from every page of the website or app. This can be done by including a link in the website footer, adding it to the app menu, or making it a part of the account registration process.

But regardless of what you decide here, remember to ensure that the link to your privacy policy is clear and visible to users.