How to Write a Privacy Policy Like a Pro | A Complete Guide for Beginners

How to Write a Privacy Policy in 10 Steps

There are a few steps in making a privacy policy. Follow them closely so you won’t make mistakes and accidentally break any laws!

Step 1: Include Which Parts of the Users’ Personal Data Your Website or App Collects

Be specific. Saying that you will “collect private information” can be too general and not tell users exactly what data will be collected.

Instead, outline the specific personal data collected by your website. This can range from a few items to a long list, depending on how much data your website collects.

For example, instead of saying, “we collect data”, say, “we will collect your email address, app users’ browsing activity, and postal addresses”.

Place this at the very beginning of your privacy statement because this is often the part most users are interested in reading before they agree to data collection.

PRO TIP: Remember to use plain language when coming up with this part of the privacy policy. Technical jargon will only confuse the average user.

Step 2: Explain Why You’re Collecting Personal Data

The next step is to notify users why you’re collecting their personal information. People want to know where the data will be used before agreeing to have it collected.

Some examples of this include planning to resell the data and use it in business practices, for research purposes, or for news updates and promotions.

FOR EXAMPLE: A great example of explaining this to users is a small business like a bakery collecting the address and phone number of the user to use it to make deliveries quicker.

Step 3: Explain How You Will Collect Information

Next, you’ll want to go into detail on how you’ll collect personal information. There are a few ways to do so, including:

• Online forms
• Email newsletters
• Cookies
• Website analytics like Google Analytics
• Course registrations
• Contact forms
• Surveys

You’ll want to include this in your privacy statement because it lets users know where they can expect to input their personal data.

Step 4: Provide Users the Option to Opt Out

Another common option you’ll see on websites is the option to disagree with privacy policies. Privacy law demands that users have more control over collected data.

Even when users initially agree to the privacy policy of a website, it doesn’t automatically mean that they will agree to let you keep the information indefinitely.

They might want to pull out their data or change it at a future date, and you must comply with that request, as privacy law requires.

Your privacy statement should include the ways that users can request their personal information to be altered from your website’s servers. This includes:

• Right to review collected information
• Right to request that the website should delete data
• Right to request data amendments

You should describe the process for all three on your privacy statement to help the users with these processes if they wish to do any of them.

Make sure to link your Data Subject Access Request form in your privacy policy.

Step 5: Tell Users if Their Collected Data Will Be Shared With Third Parties

Another important thing you shouldn’t forget to include is how the personal data will be shared with third parties like other websites or companies.

When data sharing with these third parties, you must include a disclaimer/disclosure in your own policy. Not doing so can put you at legal risk.

There are multiple ways you may want to share your customers’ personal data with third parties.

FOR EXAMPLE: If you’re an online seller of clothes and apparel, you might need to share user data with credit card companies to process payment information.

Then, what if the credit card company’s servers get hacked, and the user’s personal data gets leaked?

Not only will your own company’s reputation be SMEARED, but you’ll get into LEGAL TROUBLE too.

Step 6: Explain How Long You Will Retain the Collected Information

Data privacy laws aren’t just concerned with the use of personal information right now. It’s also concerned with how you’ll use that data down the road.

According to the GDPR (General Data Protection Regulation) from the European Economic Area, you’re only allowed to keep data no longer than necessary for its intended use case.

For example, when doing data collection for a contract, data usage can only apply up until the contract ends. Afterward, you must DELETE IT.

This is something you need to specify in your privacy policy. Include how long you’ll use it or an optional Data Retention Policy for specific use cases.

This Data Retention Policy can include information on additional uses for customers’ data other than what was originally intended.

Step 7: Specify Your Personal Information Protection of Users’ Data

Remember the data leak example we gave earlier? That’s definitely not something you want to happen to your website and users!

Remember that users are putting their trust in you that their data is stored securely.

Therefore, other than implementing strong security measures like physical access controls, the other thing you need to do is explain how you’ll protect personal information.

However, we recommend not being TOO specific with enumerating the data security measures you’re implementing.

Hackers might read that specific information and figure out how to bypass your data security measures and computer safeguards.

However, there’s one more important thing to point out: Even if your website or app isn’t targeted toward children, you need to include extra provisions for their data privacy.

If your website or app collects data on children 13 years old or younger, you need to include a statement that addresses child privacy.

According to the Children’s Online Privacy Protection Act or COPPA, you must follow the correct separate privacy policy for collecting data for children under 13 years old.

Step 8: Outline the Dispute Resolution Process

The next step is something your users will hopefully never have to use but is something you should include anyways.

Standard website privacy policies include how their dispute resolution process works. Most companies tend to add this to their Terms and Conditions policy.

Even though you might do your best to have a good relationship with your users or customers, at some point, legal disputes might happen.

In your own privacy policy, you should include at least one or two lines on how you handle disputes, which can include contact forms, customer service, legal firms, and more.

Step 9: Explain Your Online Business Transfer Clause

Many businesses go through transitions throughout their lifespan. One of the common things that can happen is a transfer of ownership.

Including this as a disclaimer in your privacy notice will help let users know that their personal information might be transferred to another entity if the business is transferred.

Doing this will prevent you from getting into any legal trouble if your business transfers to another owner, along with the personal information of your users.

Additionally, do your best to include information and disclaimers saying that you’ll do your best to prevent any data leaks from happening to customer information.

Make sure you state that, after the data is transferred, you can’t guarantee the same level of data privacy security or privacy practices for your users’ secured files.

Step 10: Put All of This in an Easily Understood Way

The final step is to review everything you’ve written down so far. Revise any grammatical errors, check spelling, and organize it into easily browsable sections.

Separating each clause required in your privacy notice into different sections isn’t required, but we highly recommend doing so.

This makes updating your privacy policy in the future a lot easier, as you can find each section easily. The same goes for people trying to find specific information in your policy.

The wording you should use should be simple but precise. Both average users and legal entities should be able to understand what you’ve written down.

This is probably one of the most important parts of how to write a privacy policy. What use is your privacy notice if your users don’t understand it?