MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
The biggest pitfalls of privacy statements are borrowed text that does not align with your practice, an incorrectly chosen legal basis, vague retention periods, and confusing the statement with a data processing agreement or cookie declaration. A privacy statement is mandatory under the GDPR (Art. 13/14), but a statement that does not correspond to what you actually do offers no protection and, in the event of enforcement, actually works against you. Below are the most common mistakes.
The short answer
- Borrowed text that does not match your own processing.
- Wrong legal basis, usually “consent” where not permitted.
- Vague retention periods such as “no longer than necessary”.
- Processors not named and no processor agreements concluded.
- Statement confused with the cookie declaration or data processing agreement.
- Outdated: never updated after new processes.
Privacy statement pitfalls start with the borrowed text
The most common mistake: copying a statement from another website and replacing the name. The result describes processing activities you do not perform and misses those you do. The GDPR requires the statement to describe your actual practices. A text that promises not to send newsletters when you do, or that names a processor you do not use, does not comply. This will be immediately apparent during a complaint or audit.
The wrong basis
Many entrepreneurs use “consent” as the legal basis everywhere, assuming that this is the safest option. That is a misconception. Consent must be freely given, specific, and revocable. If you base consent on processing that is necessary for the contract (delivering an order), a problem arises as soon as someone withdraws that consent: you must then stop processing while you need the data. The correct legal basis in that case is “performance of the contract”. Choose consciously and correctly for each purpose.
Vague or missing retention periods
“We do not retain your data longer than necessary” is the most frequently quoted empty phrase in privacy statements. It says nothing. The GDPR requires a concrete time limit or a concrete criterion: invoices seven years (for tax purposes), application data four weeks after rejection, camera footage four weeks. Moreover, missing time limits indicate that you do not know how long you are retaining what — precisely what the law aims to prevent. Make it concrete.
Processors forgotten and agreements missing
A statement that does not mention the processors is incomplete. But the bigger mistake lies behind it: many entrepreneurs do mention that they work with suppliers, but do not enter into a data processing agreement (Art. 28 GDPR) with those parties. The statement and the data processing agreement are two separate obligations. Your accounting software, hosting provider, and email tool process personal data on your behalf; a data processing agreement is required with each of them. The statement names them, the agreement binds them.
Confusing the statement with other documents
A recurring pitfall is confusing three documents with different functions:
- Privacy statement: informs the data subject, publicly, unilaterally.
- Processor Agreement: binds your suppliers, a contract pursuant to Art. 28 GDPR.
- Cookie statement: describes the tracking technology on your website, linked to the cookie banner.
Anyone who thinks they can cover everything with a single document is missing obligations. A cookie banner without a cookie declaration, or a statement that says they will “just include” the cookies without the banner and the option to refuse, is incomplete.
Practical example
A webshop copies a competitor's statement. It states that no marketing cookies are placed, while the webshop itself uses an advertising pixel. Furthermore, the statement mentions a fictitious retention period and the data processing agreement with the email marketing tool is missing. All of this comes to light after a complaint from a customer. The error was not the absence of a statement, but a statement that did not match reality — a false sense of security.
Honest recommendation
You can avoid most pitfalls without a lawyer: document your own processing activities instead of copying them, select the correct legal basis for each purpose, make retention periods concrete, and conclude data processing agreements. For a simple business, due care and a good template suffice. Engage a lawyer as soon as the choice of legal basis makes you uncertain, you process special categories of personal data, profile, or share data outside the EU. It is precisely in these situations that errors are most expensive and enforcement is strictest.
Read more: what is a privacy statement , how to draft one , or have a privacy statement drafted .
Frequently Asked Questions
A borrowed text that does not align with your own processing activities. The GDPR requires the statement to describe your actual practice. A copied statement that mentions processing activities you do not perform, or vice versa, is non-compliant and will not be valid in the event of a complaint or audit against you.
Consent must be freely given and revocable. If you classify it as processing that is necessary for the contract, you must cease processing as soon as someone withdraws their consent, while you still need the data. The correct legal basis is then “performance of the contract”.
It is too vague. The GDPR requires a specific retention period or a concrete criterion, such as invoices for seven years, application data for four weeks after rejection, and camera footage for four weeks. A vague sentence indicates that you do not know how long you are retaining what.
A data processing agreement (Art. 28 GDPR) is required with every party that processes personal data on your behalf, such as accounting software, hosting, and an email tool. The statement names them; the agreement binds them. Both are separate obligations that you must not skip.
No. The cookie declaration specifically describes the tracking technology on your website and accompanies the cookie banner with an opt-out option. Simply “including” the cookies in the statement without a banner and opt-out option is incomplete.
Yes. A common mistake is a statement that has never been updated following new processing activities, different suppliers, or changed retention periods. An outdated statement that no longer aligns with your practice does not meet the transparency requirement of the GDPR.
You can avoid most pitfalls yourself through carefulness. Engage a lawyer as soon as the choice of legal basis makes you uncertain, you process special categories of personal data, profile, or share data outside the EU. That is where errors are most expensive and enforcement is strictest.
