GDPR Privacy Policy Generator

What GDPR Articles 13 and 14 actually require

The GDPR does not ask for a 'privacy policy' by name — it lists information you must give people when you collect their data. That list is concrete, which is good news: you can check your document against it line by line. Missing a lawful basis or omitting retention periods are the two most common gaps.

• Identity and contact details of the controller (and DPO or EU representative if you have one)
• Purposes of processing and the lawful basis for each
• Recipients or categories of recipients
• Transfers outside the EEA and the safeguard relied on
• Retention periods, or the criteria used to set them
• Data subject rights, including withdrawal of consent and complaints to a supervisory authority
• Whether automated decision-making with legal or similarly significant effects takes place

Consent, legitimate interests, and cookie banners

Analytics and advertising cookies generally require consent under the ePrivacy rules before they are set, which is a separate requirement from the policy itself. A policy that describes cookies while the site drops them on load is a mismatch regulators notice. Pair the document with a consent tool, and make sure declining is as easy as accepting.