Privacy and Data Protection Templates

Privacy law applies to almost every business that collects personal information, from a newsletter sign-up form to a customer database. Organizations must explain what they collect and why, obtain meaningful consent, protect the information, respond to access requests and, in many jurisdictions, record and report privacy breaches. Regulators increasingly expect privacy policies to be specific and readable, not copied boilerplate.

The templates here are written to a named privacy law and the regulator's published guidance. Each privacy policy walks through the principles the law sets out and asks you to describe your actual practices, so the finished policy is accurate for your business. Records and forms include the fields the law requires, with guidance notes that cite each rule and show examples of plain language.

A privacy policy has to match what the business actually does. Review it whenever you add a new tool, vendor or use of personal information, and at least once a year.