BlogGuides
Website privacy policy: the information you need before writing it
One click, and Google will show my articles more often in your results.
Anyone launching a new website, or updating the one they already have, eventually gets this question from whoever is building it: "can you send me the text for the privacy policy?" That's usually where the work stalls, not because writing a privacy policy is hard, but because nobody has gathered the information needed to write it yet. A website's privacy policy can't be invented or copied from somewhere else: it describes exactly what that site does, with those forms, those providers and those retention periods, and only whoever runs the business has that information.
What it has to contain, according to the GDPR
Article 13 of Regulation (EU) 2016/679 (the GDPR) applies when a site collects data directly from the person, for instance through a contact form or a newsletter signup: that's the case for almost every business website. It lists, point by point, what has to appear in the policy: who the data controller is and how to contact them; the contact details of the data protection officer (DPO), if one has been appointed; the purpose of collecting the data and its legal basis; whether data is transferred outside the European Union; how long it's kept, or the criteria used to decide; what rights the person providing the data has, including the right to complain to the supervisory authority; whether providing that data is required to use the service, and what happens if they don't; whether any automated decisions are made based on the data, such as profiling (source: Regulation EU 2016/679, article 13, checked on October 16, 2026).
If the data doesn't come directly from the person instead, for example because a contact list is bought or received from a partner, article 14 applies, requiring the same information plus two specific additions: the categories of data collected and where it came from, with different timing for informing the person (at most one month, or in any case by the first contact). For most small-business sites, which only collect data through their own forms, article 13 is the one that actually matters.
Why the work stalls at the same point every time
Whoever writes the policy, a legal advisor or whoever builds the site, can handle the form: the text's structure, the wording, where it gets published. They can't invent the content, because every single point in article 13 requires a fact that only whoever runs the business knows for certain:
- which forms the site has (contact, newsletter, booking, account creation) and what data each one asks for;
- whether that data gets passed to third-party tools, for example an analytics tool or an external platform for sending emails;
- how long that data is kept, and whether a written criterion already exists or still needs deciding;
- whether a data protection officer has been appointed, or whether the business has decided it doesn't need one.
Without these answers, whoever writes the text can only produce a generic policy, describing a hypothetical site rather than the real one. It's this gap, more than any difficulty with the text itself, that pushes publication back by weeks.
Do you need a data protection officer (DPO)?
For most small businesses, no. The obligation to appoint a DPO, set out in article 37 of the GDPR, covers public authorities and anyone carrying out regular and systematic monitoring of people on a large scale, or processing special category or criminal data on a large scale as a core activity. Italy's data protection authority, the Garante, in its FAQ on the data protection officer in the private sector, clarifies that a private business limited to the everyday management of supplier and customer relationships, outside those cases, isn't required to appoint one (source: garanteprivacy.it, checked on October 16, 2026). A site with a contact form, a newsletter and an analytics tool falls outside this obligation in the vast majority of cases. It's still worth checking with whoever handles the business's legal side, because the criterion depends on the nature and scale of the processing, not the number of employees.
What the Garante asks about cookies
If the site uses cookies or other tracking tools, a second layer of information is needed, separate from the general privacy policy. The Garante's guidelines of June 10, 2021 call for a two-layer structure: a minimal banner that warns about cookie use, and a longer text reachable with one click, with a stable link in the footer of every page on the site. The same guidelines ask the text to distinguish technical cookies from analytics and profiling ones (source: Garante per la protezione dei dati personali, Provision No. 231 of June 10, 2021, checked on October 16, 2026). It's another point that requires a precise fact: which cookies the site actually installs, not a generic list copied from another project.
Where to start
Before asking whoever maintains the site to write the policy, it's worth showing up with a list already prepared: the forms on the site and what they ask for, the third-party tools connected to them (analytics, email sending, payments), how long data is kept or the intention to decide it, and the choice made on the DPO. It's the same groundwork needed, for instance, to properly set up a newsletter signup form: the consent collected there has to appear, under the same criteria, in the site's general privacy policy. If you want to take stock of this alongside the rest of your business's digital setup, it can be covered inside the digital check-up; otherwise get in touch, a list of the forms your site has is already a good place to start.