Privacy statement example: the key provisions

A privacy statement example shows which standard components every privacy statement contains: who the controller is, which data you process, for what purpose, on what legal basis, how long you retain data, with whom you share it, and what rights the data subject has. Under the GDPR (Art. 13/14), these provisions are mandatory. An example is useful as a framework, but you must always complete the text with your own processing activities — a borrowed statement that is incorrect does not comply.

The short answer

• Header: who you are and how to reach you.
• Processing: which data, which purpose, which legal basis.
• Retention periods: specifically stated per type of data.
• Sharing with third parties: processors and recipients, transfer outside the EU.
• Rights: access, correction, deletion, objection, complaint to the AP.
• Cookies: reference to or inclusion of the cookie statement.

Privacy statement example: the standard structure

Virtually every privacy statement follows the same structure. At the top, it states who the controller is: your company name, address, Chamber of Commerce registration number, and a contact address for privacy questions. If you have a Data Protection Officer, you must also list them. This is followed by the processing activities, retention periods, sharing with third parties, and rights. This order makes the text understandable for the data subject, which is explicitly required by the GDPR.

Example: describe the operations

The heart of every statement is the list of processing operations. For each processing operation, you state the purpose, data, and legal basis. For example:

• Customer administration — name, address, email — to process and deliver your order — basis: performance of the contract.
• Invoicing — invoice data — to comply with the tax retention obligation — basis: statutory obligation.
• Newsletter — email address — to keep you informed — legal basis: consent.
• Website analysis — IP and usage data — to improve the site — basis: legitimate interest or consent.

You repeat this pattern for every process. It is the core that you cannot skip or keep vague.

Example: retention periods and sharing with third parties

Regarding retention periods, an example only becomes useful if it is concrete: invoices seven years, application data four weeks after rejection, personnel files typically two years after termination of employment. When sharing with third parties, you must specify the categories: “we share data with our hosting provider, accounting software, and payment service provider, who act as processors on our behalf.” If you share outside the EU, you must state the safeguards. Vague formulations such as “we may share data with partners” are insufficient.

The rights of the data subject

Each statement lists the rights granted by the GDPR: access, rectification, erasure, restriction, objection, and data portability. In addition, the right to withdraw consent and the right to lodge a complaint with the Dutch Data Protection Authority. Important: indicate how these rights are exercised — via which email address — and within what timeframe you will respond (in principle, one month). An example that merely lists the rights without a practical helpdesk is incomplete.

Where the example ends: other documents

A privacy statement example does not cover everything. Two things do not belong in it but are often confused. The data processing agreement (Art. 28 GDPR) is a separate contract with your suppliers and is not included in the statement — you only mention there that you work with processors. The cookie declaration specifically describes the tracking technology on your website; this can be a separate section or a separate page, linked to your cookie banner. An example refers at most to that cookie declaration, but does not replace it.

Practical example

A physiotherapy practice uses an example as a basis but gets stuck: it processes health data, a special category with stricter requirements and a separate legal basis (healthcare exception). A standard example for a webshop does not fit here. This illustrates the limitations of examples: useful for structuring, but insufficient as soon as your situation deviates from the average.

Honest recommendation

An example is an excellent starting point. For a standard company without special categories of data and with all suppliers within the EU, you can manage on your own with a good example — you do not need a lawyer for this, provided you carefully fill in the processing activities, legal bases, and retention periods. However, do have it checked as soon as you process special categories of personal data (health, biometrics), profile data, or share it outside the EU. In that case, a generic example falls short, and a tailored assessment is well worth the money.

Read more: drafting a privacy statement, the costs and the process, or have a privacy statement drafted.

Frequently Asked Questions