Drafting a privacy statement: what belongs in it

You draft a privacy statement by recording, for each processing activity, which personal data you use, for what purpose, on what legal basis, and how long you retain it — supplemented by the rights of data subjects and the parties to whom you transfer data. The GDPR (Art. 13/14) determines the minimum content. The pitfall is not the form, but honesty: the statement must describe your actual practice, not a borrowed sample text.

The short answer

1. Inventory which personal data you process and why.
2. Determine the legal basis for each purpose (agreement, statutory obligation, legitimate interest, or consent).
3. Establish retention periods per type of data.
4. Specify processors and recipients and any transfer outside the EU.
5. Describe the rights of data subjects and how they exercise them.
6. Publish and update the text in an understandable way on your website.

Drafting a privacy statement starts with taking stock

Before you write anything, map out your data processing activities. Review your processes: customer administration, quotations, invoicing, personnel, newsletter, website analytics, job applications. For each process, note what data you collect, for what purpose, from whom, and where it ends up. This inventory is the foundation. Without this overview, you will write a text that does not correspond to reality — and that is precisely what the Dutch Data Protection Authority disapproves of.

The mandatory components

Your statement contains at least:

• Your identity as the data controller, with contact details.
• Purposes per processing.
• Basis per objective.
• Categories of data that you process.
• Recipients and processors: suppliers who process data on your behalf.
• Retention periods or the criteria therefor.
• Rights: access, rectification, deletion, restriction, objection, data portability and the right to lodge a complaint with the AP.
• Transfer outside the EU, with the safeguards used.

Determine basis per objective

This is the most difficult part in terms of content. Every processing operation requires exactly one legal basis. A selection from practice:

• Deliver order: necessary for the agreement.
• Retaining invoices: legal obligation (fiscal retention obligation, seven years).
• Payroll administration: legal obligation and agreement.
• Newsletter to non-customers: consent.
• Fraud prevention or security camera: legitimate interest, following a balancing of interests.

Choose wisely and state the legal basis explicitly. Using “consent” as a safety net for everything is wrong: if you cannot deliver an order without the data, consent is not the correct legal basis.

Making retention periods concrete

“We do not retain data longer than necessary” is too vague. Make it concrete: invoices seven years (for tax purposes), application data four weeks after rejection (or one year with consent), personnel files typically two years after termination of employment, camera footage four weeks. Where an exact term is not fixed, state the criterion. Concrete time limits demonstrate that you actually control the processing.

Processors and the boundary with other documents

In the statement, you name the categories of recipients: hosting provider, accounting software, email marketing tool, payment service provider. You conclude a separate data processing agreement with each of these processors (Art. 28 GDPR) — that is a contract, not part of your statement. Also, do not confuse it with the cookie declaration: that specifically describes the tracking technology on your website and is part of your cookie banner. Three documents, three functions.

Practical example

A webshop sells sportswear. During the drafting, the following emerge: customer data for delivering orders (agreement, retention period of seven years via invoices), a newsletter (consent, until withdrawn), a retargeting pixel (consent via the cookie banner), and an accounting link (processor, with a data processing agreement). Four processing activities, four legal bases, one coherent statement that describes exactly this.

Honest recommendation

If you have a straightforward business with standard processing activities — customer administration, a standard newsletter, no special categories of data — you can draft the statement yourself based on a reliable template, provided you carefully fill in the legal bases and retention periods. In that case, you do not need a lawyer. However, do engage one as soon as you process special categories of personal data, profile data, share data outside the EU, or market on a large scale. The substantive work lies in the choice of legal base, and that is precisely where things often go wrong when tinkering with it yourself.

In-depth: what is a privacy statement, a privacy statement example, or have a privacy statement drafted.

Frequently Asked Questions