Fixing an Incomplete Privacy Policy
Most weak privacy policies were copied from another site or produced by a generator years ago, and they describe a business that no longer exists: tools you stopped using, purposes that are not stated, no retention periods, and a vague line about "taking your privacy seriously".
The UK GDPR sets out exactly what people must be told, in Articles 13 and 14. This guide shows how to build the policy from what your site actually does, what each required section should say, and how to keep it accurate. It is general guidance, not legal advice.
What the law requires a privacy notice to contain
The right to be informed is set out in Articles 13 and 14 of the UK GDPR. Article 13 applies when you collect data directly from the person, for example through a form or checkout. Article 14 applies when you get it from somewhere else, such as a list provider, a partner or public sources. The table sets out what each one expects.
| Information | Collected from the person (Art. 13) | Obtained elsewhere (Art. 14) |
|---|---|---|
| Your name and contact details, and your representative's if you have one | Yes | Yes |
| Data protection officer's contact details, if you have one | Yes | Yes |
| Purposes of processing and the lawful basis for each | Yes | Yes |
| The legitimate interests you rely on, where that is the basis | Yes | Yes |
| Categories of personal data | No | Yes |
| Recipients or categories of recipients | Yes | Yes |
| Transfers outside the UK and the safeguard used | Yes | Yes |
| Retention period, or the criteria used to set it | Yes | Yes |
| Individuals' rights, including withdrawing consent | Yes | Yes |
| The right to complain to the ICO | Yes | Yes |
| Source of the data | No | Yes |
| Whether providing data is a legal or contractual requirement, and what happens if it is not provided | Yes | No |
| Automated decision-making, including profiling, with meaningful information about the logic and effects | Yes | Yes |
Timing matters too. Under Article 13 the information must be given at the point of collection. Under Article 14 it must be given within a reasonable period and at the latest within one month, or earlier if you contact the person or pass the data on.
This guide is not legal advice. It explains the published requirements and common ways of meeting them. Sites processing health or other special category data, data about children, or data for complex purposes should get specialist advice.
The gaps that audits usually find
- No lawful basis, or one basis for everything. "We process your data with your consent" is rarely true for an order, a contract or a legal duty. Each purpose needs its own basis.
- "We may share your data with third parties". Recipients must be named, or at least described by category specifically enough that people understand who they are.
- No retention periods. "As long as necessary" is not a period. Give durations or the rule you use.
- Missing overseas transfers. Email, hosting, analytics and support tools based outside the UK are rarely mentioned.
- Tools that are no longer used, and tools that are missing. The policy describes an old newsletter platform but not the live chat widget added last year.
- No company details. A trading name without the legal entity, registered address or a working contact route.
- Rights listed but no way to use them. The rights appear as a copied list, with no email address or form for making a request.
- No mention of the ICO. The right to complain to the regulator is required.
- Buried or unreadable. Hidden behind a tiny footer link, or written as dense legal text few visitors can follow.
Build a data map before you write a word
A privacy policy is only as accurate as the list behind it. Before editing, build a simple data map in a spreadsheet, one row per activity. The columns that matter for the notice are:
| Activity | Data | Purpose | Lawful basis | Recipients | Location | Kept for |
|---|---|---|---|---|---|---|
| Contact form | Name, email, message | Answer enquiries | Legitimate interests | Form service, email host | UK and US | 12 months after last contact |
| Newsletter | Email, sign-up date, opens | Send news and offers | Consent | Email platform | US | Until unsubscribe, then suppression list |
| Bookings | Name, phone, appointment | Provide the service booked | Contract | Booking software | UK | 2 years after appointment |
| Invoices | Name, address, payment details | Accounts and tax | Legal obligation | Accountant, accounting software | UK | 6 years from the end of the financial year |
| Website statistics | Pages viewed, device, approximate location | Understand and improve the site | Consent, or an exemption where one applies | Analytics provider | US | 14 months |
The rows above are illustrative, for a fictional appointments business. Your purposes, bases and periods must reflect your own situation. For choosing between the six lawful bases, including the balancing test for legitimate interests, see our guide to fixing an unclear lawful basis.
The fix, step by step
Step 1
Map what data you collect and where it goes
Walk through every place your site and business collect personal data: forms, checkout, accounts, newsletter sign-ups, live chat, cookies, phone calls and email. For each one, list the data, the purpose, the supplier that stores or processes it, the country where that happens and how long you keep it. Check your supplier dashboards and invoices, because the list of tools you actually pay for is usually longer than the one people remember.
Step 2
Set out who you are and how to reach you
Open the policy with the legal name of the business, not just the trading name, together with its company number if it has one, its registered or postal address and a contact email that someone reads. Name your data protection officer if you are required to have one or have chosen to appoint one. If you are based outside the UK but offer goods or services to people here, check whether you need a UK representative.
Step 3
Write one entry per purpose with its lawful basis
Replace any single catch-all paragraph with a section or table row for each purpose from your data map, such as handling orders, answering enquiries, sending marketing, running statistics and meeting tax duties. For each, say what data is used and which lawful basis applies. Where the basis is legitimate interests, say what the interest is in plain words. Where it is consent, say how people can withdraw it at any time.
Step 4
Name recipients and overseas transfers
List the organisations that receive personal data, by name or by a clear category such as payment provider, email delivery service or courier, and say what each one receives. For any supplier that stores or accesses data outside the UK, say which country is involved and which safeguard covers the transfer, such as adequacy regulations, the UK extension to the Data Privacy Framework, or the international data transfer agreement.
Step 5
State retention periods you can actually meet
For each purpose, give a period, such as six years after the end of the financial year for accounting records, or the rule you use to decide, such as two years after the last contact for enquiries. Then check that your systems really delete or anonymise data on that timetable, because a policy promising deletion that never happens is worse than one that is honest. Set calendar reminders where deletion is still a manual task.
Step 6
Explain rights, complaints and choices
Describe each right in one or two plain sentences, including access, correction, erasure, restriction, objection and portability, and make clear that people can object to direct marketing at any time. Give one simple route for requests, such as an email address or form. Explain how to complain to you, and state that people can also complain to the Information Commissioner's Office, with a link to the ICO's website.
Step 7
Publish it in layers and link it where data is collected
Put a short summary at the top of the policy, with the full detail underneath in clearly headed sections. Add a date showing when it was last updated. Link to it from the site footer, and place a brief notice with a link next to every form, the checkout and the newsletter sign-up. Then run the GDPR Audit again and confirm the policy is found and no longer flagged as incomplete.
Making it readable: a layered structure
The UK GDPR requires the information to be concise, transparent, intelligible and easily accessible, in clear and plain language. A long block of legal text meets none of those. The ICO recommends a layered approach: a short summary first, then the detail for people who want it, and just-in-time notices where data is collected.
A structure that works for most small sites:
- Summary. Five or six sentences: who you are, what you collect, the main purposes, who else is involved, and how to contact you.
- What we collect and why. The per-purpose table or sections from your data map.
- Who we share it with. Named suppliers or clear categories.
- Transfers outside the UK. Countries and safeguards.
- How long we keep it. Periods per purpose.
- Your rights. Each right briefly, and how to use it.
- Cookies. A short paragraph and a link to the cookie policy.
- Complaints and changes. How to complain to you and to the ICO, and how you tell people about changes.
A just-in-time notice beside a form can be one sentence, for example:
<p class="form-note">
We use these details to reply to your enquiry and keep them for
12 months. See our <a href="/privacy">privacy policy</a> for
who we share them with and your rights.
</p>Changes to reflect from the Data (Use and Access) Act 2025
The Data (Use and Access) Act 2025 amends the UK GDPR, and its provisions are being brought into force in stages. Several changes can affect what your policy says:
- Complaints to you first. The Act introduces a requirement for organisations to have a way for people to complain to them about the handling of their data, for example an online form, and to acknowledge and respond to complaints. Describe your complaints route in the policy, alongside the right to complain to the ICO.
- Recognised legitimate interests. The Act creates a list of recognised legitimate interests, such as some crime prevention and safeguarding purposes, where the usual balancing test does not apply. If you rely on one, say so.
- Cookies and similar technologies. Some low-risk uses no longer need consent under the amended PECR, subject to conditions. If you rely on an exemption, explain it in the cookie section and say how people can object.
- Automated decisions. The rules on solely automated decision-making have been revised. If you make significant decisions about people automatically, check the ICO's current guidance and describe the safeguards you offer.
Check the ICO's guidance for which changes are in force before rewriting the relevant sections, and date your policy so readers can see when it was last reviewed.
Keeping the policy accurate
- Change the policy when you change a supplier. Add a step to your process for adopting any new tool: update the data map, the policy and, where needed, the cookie list.
- Review at least once a year. Put a date in the calendar, and compare the policy with your live site, your supplier invoices and your forms.
- Keep old versions. Store each previous version with its dates, so you can show what people were told at the time.
- Tell people about significant changes. If you start using data for a new purpose, tell existing customers or subscribers before you do, not just in a silent update.
- Check the rights route works. Send a test message to the address in the policy every few months and make sure someone responds.
For how to handle the requests your policy invites, see our guide to fixing the data subject rights process.
1. Can I copy another website's privacy policy or use a generator?
You can use one as a starting point, but it will almost certainly be wrong for your business in important places. A privacy policy has to describe your own purposes, lawful bases, suppliers, transfers and retention periods, and a copied policy describes someone else's. Generators are useful for structure and wording, but every section needs checking against your data map. An inaccurate policy can be treated as failing the transparency requirements just as a missing one would.
2. Do I need both a privacy policy and a cookie policy?
You need to give people the information about cookies and about personal data generally, but it does not have to be in two documents. Many sites keep a separate cookie policy because it lists many individual cookies and changes more often, and link to it from the privacy policy and the banner. Others include a cookie section in the privacy policy. Either approach works if the information is complete, accurate and easy to find.
3. How specific do I have to be about who I share data with?
You must name the recipients or describe the categories of recipients. The ICO's guidance encourages naming them where you can, and at the least using categories specific enough for people to understand who receives their data, such as email delivery service or card payment provider, rather than a phrase like carefully selected third parties. Remember that people can use their right of access to ask which organisations actually received their data.
4. What should I write for retention periods if I am not sure?
Work out a period you can justify and meet, rather than leaving it vague. Legal duties often set the minimum, for example HMRC generally expects business records to be kept for six years. For other data, choose a period linked to the purpose, such as twelve months after an enquiry closes, or explain the criteria you use. Then make sure your systems or routines really delete the data when the period ends.
5. Does a small business need a data protection officer to be named in the policy?
Most small businesses are not required to appoint a data protection officer. It is mandatory for public authorities and for organisations whose core activities involve large-scale regular monitoring of people or large-scale processing of special category or criminal offence data. If you have not appointed one, you do not need to name one, but you do need to give a clear contact for privacy questions, such as a named person or a monitored email address.
6. Where should the privacy policy be linked on my website?
At minimum from the footer of every page, so it can be found from anywhere. It should also be linked, with a short explanation, at each point where you collect personal data: contact forms, checkout, account registration, newsletter sign-ups and booking forms. The cookie banner should link to the cookie information too. The aim is that people see the relevant information at the moment they give you their data, not only if they go looking.
7. How often should I update my privacy policy?
Whenever what you do with personal data changes, and in any case review it at least once a year. Typical triggers are adding a new supplier or tool, starting a new kind of marketing, collecting a new type of data, moving hosting to another country, or a change in the law such as the Data (Use and Access) Act 2025. Date each version, keep old versions, and tell people directly before any significant new use of their data.
The GDPR Audit checks what a visitor can see, including the privacy policy and the routes people have to exercise their rights, and lists each finding with the guide that fixes it.
Open GDPR Fixes →