Website privacy policy: what it should cover and how to keep it accurate

The short answer

A website privacy policy explains what personal data you collect, why, how long you keep it, who receives it, and how people can contact you about it. Write it from a real audit of your forms, analytics and tools, link it from every page, and update it when your practices change. Ask a qualified lawyer to review it.

Start with a data map, not a template

Copying a policy from another site is the most common mistake. Their site collects different things, uses different tools and may serve different countries. If your policy says you do not share data and your marketing tool does exactly that, the policy is worse than useless.

Build a simple data map first. For each place your site collects or receives personal information, write down four things: what is collected, why you collect it, where it goes, and how long you keep it.

This is an example layout; yours will differ. The exercise often reveals tools nobody remembered adding.

What a policy usually covers

Requirements differ between countries, so treat this as a common list, not a legal checklist.

• Who you are. The legal name of the business and a way to contact it about privacy.
• What you collect. Information visitors give you, and information collected automatically, such as device and usage data.
• Why you use it. Each purpose in plain words: replying to enquiries, delivering orders, improving the site, sending marketing.
• Who receives it. Categories of recipients such as payment processors, hosting and email providers, analytics tools.
• How long you keep it. A period or the rule you use to decide.
• Visitors' choices and rights. How to ask for a copy, a correction or deletion, how to unsubscribe, and how to complain. The rights available vary by place.
• International transfers. If providers are in other countries, say so in general terms.
• Cookies. What is set and how to change choices, linked to your cookie banner.
• Children. If your site is not meant for them, say so.
• Changes. When the policy was last updated and how updates are announced.

Write it so people can read it

A policy is read by customers, regulators, partners and sometimes by procurement teams checking a supplier. Plain language helps all of them. Use short headings that match the questions people ask, such as "What we collect" and "Your choices". Lead each section with the point, then add the detail.

Avoid vague promises such as "we take your privacy very seriously". Say what you actually do. Avoid saying "we never share your data" unless it is strictly true, including with the tools that run your site. Use "we do not sell your data" only if you have checked what that phrase means in the places you serve, because definitions vary.

For long policies, add a short summary at the top and a contents list. Check the page works on a phone and with a keyboard, as covered in our accessibility basics guide.

Where to put it and how to link it

Link the policy from the footer of every page, from every form that collects personal data, and from the checkout if you sell online. A short sentence beside the submit button, such as "We use your details to reply to your enquiry. See our privacy policy", does more for trust than a long page nobody opens. The website footer guide shows where legal links normally sit.

Keep a stable address for the page. If you move or rename it, redirect the old address so links in older emails and forms do not break.

If you operate a shop, the policy sits beside returns, delivery and terms pages; our ecommerce policy pages checklist covers the set.

Keeping it accurate

A policy goes out of date quietly. Every new tool can change it: a booking plugin, a chat box, an advertising pixel, a new email platform. Build a habit of asking one question whenever you add something: does this collect or share personal data, and is it in the policy?

1. Review the policy on a regular schedule, such as twice a year.
2. Review it whenever you launch a new form, tool or service.
3. Show the "last updated" date.
4. Keep old versions in case you need to show what applied at a given time.
5. If a change affects people materially, tell them in a suitable way, for example by email to subscribers.

Put this in your maintenance routine so it does not depend on someone remembering.

A worked example of one section

Here is how a single part of a policy might read for an example business that runs a contact form. It is a sketch to show tone and level of detail, not wording to copy.

What we collect when you contact us. When you send a message through our contact form we receive your name, email address and the message you write. We use these only to reply to you and to keep a record of the conversation. We keep enquiries for a set period after the last message and then delete them. Our website provider and email provider process this information on our behalf. To ask for a copy of your details or to have them deleted, write to the contact address below.

Notice what it does. It names the data, the purpose, the retention approach, the recipients by category and the way to make a request, in short sentences. Repeat this pattern for each source in your data map: forms, analytics, orders, accounts and marketing. Your actual wording must reflect your own practices and the rules that apply, so have it reviewed.

When to get a lawyer involved

A generator or template can give you a first draft, but it cannot know your business. Ask a qualified lawyer to review the policy if you handle sensitive information such as health, financial or children's data, serve visitors in several countries, share data with many partners, or run advertising and tracking at scale.

Bring your data map to the meeting. A lawyer can then spend time on the rules rather than on finding out what your site does, which usually makes the review quicker and more useful. This article is general information, not legal advice.

Related guides

• Website development
• Cookie Consent Banners Explained for Websites
• Website Terms and Conditions: What to Include
• Website security checklist for small business
• Retargeting explained for small business
• Google ads for small business how it works

Questions and answers

Does my website need a privacy policy?

If your site collects any personal information, even through a contact form or analytics, a policy is widely expected and often required by law in some places. Ask a qualified lawyer what applies to you.

Can I copy a privacy policy from another website?

It is not a good idea. Their site collects different data and uses different tools, and the text may be protected by copyright. Write yours from a map of what your own site does.

Where should the privacy policy link go?

In the footer of every page, beside any form that collects personal data, and in the checkout if you sell online. Keep the address stable and redirect it if it ever changes.

How often should I update it?

Whenever you add or remove a tool, form or purpose for using data, and on a regular schedule such as twice a year. Show the date of the last update on the page.

Is a privacy policy the same as terms and conditions?

No. A privacy policy explains how you handle personal data. Terms set the rules for using your site or buying from you. See our guide to website terms and conditions.

Can a policy generator replace a lawyer?

A generator can give a starting draft, but it cannot check it against your real data practices or the laws that apply to you. For anything beyond the simplest site, have a qualified lawyer review it.