Website Privacy Notice template

Overview

A website privacy notice is the transparency document required under Articles 13 and 14 of the UK GDPR whenever a website collects or otherwise processes personal data about its visitors — through contact forms, account creation, analytics, cookies, or newsletter sign-ups. It must be concise, transparent, intelligible and in plain language, made easily accessible (typically linked from every page footer), and provided at the point personal data is collected, in line with the Information Commissioner's Office (ICO) guidance on privacy notices. The notice must set out, at minimum: the identity and contact details of the controller (and, where appointed, its data protection officer); the purposes of processing and the lawful basis relied on for each (consent, contract, legal obligation, legitimate interests, and so on); the categories of personal data and recipients; the retention period, or the criteria used to determine it; and the data subject's rights, including the right to access, rectify, erase or restrict processing, the right to data portability, the right to object, and the right to complain to the ICO. Where cookies or similar tracking technologies are used, the Privacy and Electronic Communications Regulations (PECR) additionally require consent for all but strictly necessary cookies, generally addressed through a separate cookie banner and cookie policy linked from the privacy notice. When to use it: for any website — marketing site, SaaS product, e-commerce store — that collects personal data from visitors or customers in any form. Parties: the website operator, as controller (or joint controller, where relevant) of the personal data collected, and the website visitor, as data subject. Key sections: identity of the controller; categories of data collected and sources; purposes and lawful basis for each processing activity; recipients and any international transfers, with the applicable safeguard; retention periods; data subject rights and how to exercise them; use of cookies and a link to the cookie policy; and the right to complain to the ICO. Pitfalls to avoid: publishing a generic, boilerplate notice that does not reflect what the site actually does (a notice must be accurate to the real processing activities, not aspirational); listing every possible lawful basis for every purpose instead of identifying the single basis genuinely relied on for each; omitting the international transfer position where analytics or hosting providers are based outside the UK; and failing to keep the notice in sync with the actual cookie banner and consent management tool.