Without a GDPR privacy policy (also commonly referred to as a GDPR privacy notice or GDPR privacy statement), you’re at risk of noncompliance fines that could put you out of business.
Read on to learn what the GDPR Policy Template is, if you need to comply, why a privacy policy is mandatory under the GDPR, and what a GDPR privacy policy includes.
Download our free GDPR privacy policy template to easily get started on your own GDPR compliance journey.
The GDPR is a data privacy law in effect since May 25, 2018. Passed by the EU, but affecting companies around the world, the GDPR gives users more rights over the personal information they share with businesses, and penalizes companies that are negligent with this data.
The GDPR aims to protect the data rights of users in the European Economic Area (EEA). The EEA is comprised of the EU, Iceland, Liechtenstein, and Norway. Additionally, the GDPR applies to users in Switzerland.
To comply with the GDPR, you need a privacy policy.
GDPR Training guidelines focus on transparency, so companies must clearly explain how they collect, share, and process user data in a privacy policy.
Three articles within the GDPR address the privacy notice requirement:
Article 12 — Information about data collection, storage, and transfer must be presented to users in writing.
Article 13 — If you collect users’ data, you need to provide them with certain information, such as your contact details and data-processing purposes.
Article 14 — When data is not directly collected from the user, you need to provide details about relevant partners, affiliates, or third parties.
A GDPR privacy policy is a notice on your website that clearly explains how you process the personal data of EEA users.
Your GDPR data protection policy template doesn’t need to be separate from your regular privacy policy. In fact, “GDPR privacy policy” only refers to a privacy policy that includes the necessary controls and information to meet GDPR requirements.
The GDPR is a new data and privacy security legislation which was developed by the European Parliament and Council for the protection of data rights of the EU citizens. Companies (including websites, mobile, and desktop apps etc.) that do business transactions with EU Representative citizens are going to be affected by this regulation.
On May 25, 2018, the GDPR replaced the existing data protection law i.e. the Data Protection Directive that has been in effect since 1998. If your company collects or processes the data of EU citizens, you are required to comply with this regulation. Non-compliance can result in hefty fines of up to €20 million or four percent of annual revenues, whichever is higher.
While you likely already have a Privacy Policy for your business, website or app, the GDPR calls for you to revisit it and update it to make it more informative, concise and with some specific information that wasn’t required before.
You’ll also need to make your cookie consent requests more robust with checkboxes, Agree buttons and clear text surrounding these features that informs users what exactly they’re agreeing to.