Question 1

Does my website need a privacy policy?

Accepted Answer

Yes, in most cases. You are required to have a privacy policy if: you collect any personal data from users (names, emails, IP addresses, cookies); you operate in the EU/EEA and process personal data of EU residents (GDPR applies regardless of where your business is located); you operate in the UK (UK GDPR and Data Protection Act 2018); you operate in California (CCPA applies if revenue exceeds $25M, you handle data of 100k+ consumers, or you earn over 50% of revenue from selling data). Beyond legal requirements, a clear privacy policy builds trust with users and is required by most advertising platforms (Google Ads, Meta), app stores (Apple App Store, Google Play) and payment processors (Stripe, PayPal).

Question 2

What are the six GDPR lawful bases for processing personal data?

Accepted Answer

Under GDPR Article 6, processing personal data is only lawful if it falls under one of six bases: (1) Consent: the individual has given clear consent for a specific purpose. Must be freely given, specific, informed and unambiguous. (2) Contract: processing is necessary to perform a contract with the individual (e.g. processing their address to fulfil an order). (3) Legal obligation: processing is required to comply with a legal obligation (e.g. keeping financial records for HMRC). (4) Vital interests: processing is necessary to protect someone's life. (5) Public task: processing is for official functions or public interest tasks. (6) Legitimate interests: your processing is necessary for legitimate interests of your business or a third party, unless overridden by the individual's interests or rights. Legitimate interests is the most flexible but requires a 3-part test (purpose, necessity, balancing). Consent is the most commonly used for marketing.

Question 3

What rights do users have under GDPR?

Accepted Answer

GDPR grants data subjects eight rights: (1) Right to be informed: you must provide clear privacy information (your privacy policy). (2) Right of access: individuals can request a copy of their personal data (Subject Access Request — SAR). You have 1 month to respond. (3) Right to rectification: individuals can request corrections to inaccurate data. (4) Right to erasure ('right to be forgotten'): individuals can request deletion of their data in certain circumstances. (5) Right to restrict processing: individuals can request you stop processing their data while a dispute is resolved. (6) Right to data portability: individuals can request their data in a machine-readable format. (7) Right to object: individuals can object to processing based on legitimate interests or for direct marketing. (8) Rights related to automated decision-making: protection against decisions made solely by algorithms with significant effects.

Question 4

What must a GDPR-compliant privacy policy include?

Accepted Answer

A GDPR-compliant privacy policy must include: identity and contact details of the data controller (your business); contact details of your Data Protection Officer if applicable; what personal data you collect and how; the lawful basis for each type of processing; how long you retain data (retention periods); who you share data with (third parties, processors); whether data is transferred outside the EEA and what safeguards apply; all eight data subject rights and how to exercise them; right to lodge a complaint with the supervisory authority (ICO in the UK, your national DPA in the EU); whether providing data is a requirement and consequences of not providing it; details of automated decision-making including profiling; and if you collect data from children, your age-verification approach.

Lawful basis	When to use	Example
Consent	User has given clear, specific, freely given consent	Newsletter sign-up, marketing emails, non-essential cookies
Contract	Processing necessary to perform a contract with the user	Processing address to fulfil an order; processing payment details
Legal obligation	Required by law	Keeping financial records for HMRC/tax authorities
Vital interests	Necessary to protect someone's life	Emergency health data processing
Public task	Official functions or public interest tasks	Government or public authority functions
Legitimate interests	Necessary for legitimate business interests (unless overridden by user rights)	Fraud prevention, network security, product analytics

Privacy Policy Generator

The 6 GDPR lawful bases for data processing

Frequently asked questions

Related tools

Stay GDPR-compliant and build user trust