GDPR Privacy Policy
- Your first template is free
Free GDPR privacy policy templates
Make sure your business complies with European privacy law if it has a presence in the EU.
Legal Advice And Services
Document Templates
Free Quotes
Get exclusive money-saving offers and guides
Straight to your inbox
By signing up, you agree to the Finder
Privacy & Cookies Policy
and
Terms of Use, Disclaimer & Privacy Policy.
We’re reader-supported and may be paid when you visit links to partner sites. We don’t compare all products in the market, but we’re working on it!
If your company operates in the European Union (EU) in some way, you need to make sure its privacy policy complies with the General Data Protection Regulation (GDPR). Failing to comply can result in hefty fines. This guide defines the GDPR and what you need to know to compose a compliant privacy policy.
What's in this guide?
What is a GDPR privacy policy?
The GDPR is a data protection law that came into effect in 2018 and replaced the Data Protection Act of 1998. GDPR is designed to give EU citizens more control over how their personal information is collected and used by organisations. The law requires organizations to outline what information they collect, why, and what they do with it in a clearly defined privacy policy.
The fine for violating the law can be up to 4% of your company's global revenue or €20 million, whichever is higher.
When should I use a GDPR privacy policy?
According to the Office of the Australian Information Commissioner, an Australian company must have a GDPR policy if it:
- has an office or other presence in the EU,
- sells products or services in the jurisdiction,
- collects and tracks online users in the EU to analyse and predict their personal preferences and behaviours.
You should clearly display your company's GDPR policy on your website. It is recommended that you use a popup or checkbox to confirm that users consent to the way you will use their personal data.
GDPR privacy policy vs standard privacy policy
The GDPR requirements go further than previous European policies and Australian privacy law. GDPR privacy policy expands the definition of "personal data" beyond personal details to include location data, online identification, genetic information, and so on.
GDPR requires users to be able to opt-in to provide consent for the collection of their data. Organisations are directly responsible for their compliance with the legislation and they are required to report data breaches within 72 hours.
What does a GDPR privacy policy include and not include?
A GDPR privacy policy includes specific details of how a company collects, use and stores user data, customers' rights and how the company will comply with the legislation.
What is included in a GDPR privacy policy?
A GDPR privacy policy must include identity and contact details of the organisation and its data protection officer. It should include clauses that explain how and why the company will:
- Collect personal data from consumers
- Use the personal data it collects
- Disclose personal data to third parties safely
- Store personal data and keep it secure
- Host data and transfer it internationally
- Make use of cookies on its website
- Protect customers' rights under GDPR
The policy should also include how long the organisation will retain the data and how it will decide the time period; that users have the right to withdraw consent or lodge a complaint; whether users are required to provide personal data and the consequences if they do not provide the information.
What is not included in a GDPR privacy policy?
GDPR policy must be tailored specifically to the audience, so you should not use the same notice for different situations. You may need to adjust the content and translate the language of your privacy policy for different customer groups or versions of your website.
GDPR policy notices should avoid unnecessary legal jargon and technical terminology that will be difficult for readers to understand easily.
How effective is a GDPR privacy policy?
A clear GDPR privacy policy document is important for making sure that your business complies with the EU legislation. It can provide an effective defence in the event there is a legal challenge against the way customer data is used.
Do I need a lawyer for GDPR privacy policy?
You do not need a lawyer to write a GDPR-compliant policy. However, consulting a data protection lawyer that has specific knowledge of the European legislation can help ensure your company's policy meets the requirements.
Get access to customisable GDPR privacy policy templates online
Does your company belong in this list?
How do I write a GDPR privacy policy?
GDPR requires that you write your company's privacy policy in clear language so that users are well informed of how their data will be used. The wording should be "in a concise, transparent, intelligible, and easily accessible form".
Policy notices should avoid using vague qualifiers such as "might," "some," or "often," that create ambiguity and provide loopholes. Sentences should be well structured in the active tense and use bullet points to highlight specific areas.
The European Commission provides guidelines on how to write a compliant policy, with examples of good and bad practice. Some law firms provide GDPR privacy policy templates you can use to help get started.
Where to get free legal documents and templates like a GDPR privacy policy.
- Lawpath. Lawpath is an online legal resource for small businesses and entrepreneurs. It offers a range of free samples of legal documents on its website, but users must sign up to download and customise them.
- Wonder.Legal. Wonder.Legal hosts more than 140 document templates, all of which you can purchase for a one-time fee. It offers a GDPR-compliant privacy policy that operates under UK law rather than Australian law on its UK site.
- Legal123. Legal123 is an online law firm that offers document templates, legal packages, and free legal guides for small businesses. It provides specific GDPR clauses that companies can append to their existing privacy policy documents for a fee of $59+ tax.
- Found Legal. Found Legal provides legal services, templates, and other resources for small businesses, including a privacy policy template that covers GDPR compliance for a fee of $165.
More guides on Finder
-
Amazon Prime Day 2021 Australia: Early deals on now
Amazon Prime Day 2021 officially starts on June 21 - or does it? Here's a stack of early-bird deals you can get right now.
-
Australian-owned Internet providers
Many Internet providers in Australia are Aussie-owned but you might be surprised at which ones don’t make the list.
-
Today’s ASX top stocks: 8Vi Holdings (8VI ↑23.6%), Avita Medical (AVH ↑12.6%)
The 10 biggest movers on the ASX for Wednesday 16 June 2021.
-
Introducing the Finder app
The Finder app is a powerful savings tool that tracks your money and finds you new ways to save. Download today.
-
Amazon Prime Day top beauty buys: 40% off FOREO, GHD, L’Oreal
From makeup to skincare to haircare, these are the hot beauty offers we're expecting to see this Prime Day.
-
Paul Gallen vs Justis Huni: Fight time and how to watch live online
Undefeated heavyweight Justis Huni and former NRL star Paul Gallen will square off in what's being called Termination Day.
-
eBay kitchen EOFY sale: 75% off with these discount codes
Score up to 75% off cookwares and kitchen appliances when you add these 'hidden' discount codes during the eBay EFOY sale.
-
Why did the Coca Cola (NYSE:KO) share price drop?
Shares in the beverage maker had lifted nearly 15% since February.
-
Amazon Prime Day: Top hacks for Australians in the 2021 sales
From when to shop to how to split the cost of your purchase, we’ve got you covered this Prime Day.
-
How to invest in the Charger Metals IPO
Everything we know about the Charger Metals IPO, plus information on how to buy in.
Ask an Expert
