Privacy Policy Writers
What are Privacy Policies?
Privacy policies outline how an organisation collects, uses, stores and protects personal data relating to employees, customers, suppliers or service users, in line with UK data protection laws.
These policies help demonstrate accountability under the UK GDPR and Data Protection Act 2018, and ensure that individuals understand their rights and how their data is handled.
What Do Privacy Policies Cover?
A privacy policy typically includes:
-
The types of personal data collected and processed
-
The legal basis for processing that data
-
How data is collected, stored, used and shared
-
How long personal data is retained
-
Rights of individuals under data protection law
-
Contact details for data protection queries or complaints
-
Links to subject access request procedures and data breach policies
A clear privacy policy is essential for transparency and helps build trust by showing that your organisation takes data protection seriously and operates lawfully.
It also reduces the risk of enforcement action by demonstrating that the organisation has thought carefully about its data handling practices and can provide clear information to staff and service users.
Privacy policies must be kept up to date and tailored to your organisation’s specific processing activities, with versions available for both employees and external stakeholders if applicable.
By embedding good privacy practices into your operations and clearly communicating them through your policy, you support compliance, reduce risk and strengthen your organisation’s reputation.
Legal Basis
A privacy notice is the public-facing document that satisfies UK GDPR Articles 13 and 14 (right to be informed).
Distinct from an internal data protection policy, it must tell individuals who you are, why you process their data, who you share it with, how long you keep it, and what their rights are.
The ICO has published prescriptive expectations on form and content. PECR 2003 imposes additional disclosure rules for cookies and electronic marketing.
Common Compliance Pitfalls
- Lawful basis stated as "consent" when the actual basis is contract or legitimate interests, undermining defensibility.
- Recipients of data described in vague generic categories ("our service providers") without enough specificity for the data subject to understand.
- Retention periods missing or stated as "as long as necessary" without category-specific schedule.
- International transfer mechanism (UK Addendum, IDTA, Data Bridge) not identified.
- Children's privacy notices written in adult language despite ICO Age Appropriate Design Code expectations.
What Policy Pros Delivers
Our Privacy Notice writing service includes a layered notice (just-in-time, full notice, child-friendly version where relevant) compliant with UK GDPR Articles 13/14, the ICO's prescriptive content expectations, the Age Appropriate Design Code where children are users, and PECR 2003 for cookies and marketing.
We also draft the supporting employee privacy notice, supplier privacy notice and candidate privacy notice as a coherent set.
Frequently Asked Questions
How is a privacy notice different from a data protection policy?
A privacy notice is the public-facing document that tells data subjects how you process their personal data, in plain language. A data protection policy is the internal governance document that tells your organisation how to comply with UK GDPR. You need both.
Should we have one privacy notice or several?
Several, layered by audience: customer notice, employee notice, candidate notice, supplier notice, and (where applicable) a child-friendly notice. A single all-purpose notice rarely satisfies the Article 13/14 specificity requirements.
What does the ICO Age Appropriate Design Code require?
For services likely to be accessed by children, the highest privacy settings by default, minimisation by design, no nudging towards lower-privacy choices, and clear age-appropriate transparency. The Code applies to information society services, not to traditional services.
