Privacy Policy Template 2026: Mandatory GDPR Requirements

Why is a privacy policy mandatory?

GDPR Article 13 requires every personal data controller to inform the data subject before collecting data. In practice, this means a published privacy policy.

Consequence of absence: A fine of up to €20M or 4% of annual turnover.

What must be included (Article 13)

1. Data Controller details - Company name, registration code, address - Email and phone number - DPO contact (if appointed)

2. Purposes of processing and legal basis Specify for each purpose separately: - Purpose: e.g. "responding to contact forms" - Basis: e.g. "legitimate interest (GDPR Art 6(1)(f))"

3. Legitimate interests (if used as a basis) Explain the specific interest clearly.

4. Data recipients - Third parties (hosting, email, analytics) - Links to their privacy policies

5. Data transfer to third countries If you use, for example, a US service ([Mailchimp](https://mailchimp.com/legal/privacy/), [Google](https://policies.google.com/privacy)), specify: - Where it is transferred - What safeguards are in place ([Data Privacy Framework](https://www.dataprivacyframework.gov/), SCC)

6. Retention period For each data category. E.g.: - Contact form: 6 months - Order data: 7 years (Accounting Act) - Newsletter contacts: until withdrawal of consent

7. Data subject rights - Right of access (Art 15) - Right to rectification (Art 16) - Right to erasure (Art 17) - Right to restriction of processing (Art 18) - Data portability (Art 20) - Right to object (Art 21) - Complaint to the DPA

8. Filing a complaint **Data Protection Inspectorate (AKI)** Tatari 39, 10134 Tallinn, Estonia [info@aki.ee](mailto:info@aki.ee) [www.aki.ee](https://www.aki.ee)

9. Obligation to provide data Whether it is required (to conclude a contract) or voluntary. What happens in case of non-provision.

10. Automated decision-making If used (e.g. credit decisions), this must be mentioned separately.

Template – copy and adapt

# Privacy Policy

Last updated: [date]

1. Data Controller

[Company name] (registration code [number]) Address: [address] Email: [email] Phone: [number]

2. What data we collect

2.1 Contact form - Data: name, email, message - Purpose: responding to inquiries - Legal basis: legitimate interest (GDPR Art 6(1)(f)) - Retention: 6 months

2.2 Newsletter - Data: email, name - Purpose: marketing communication - Legal basis: consent (Art 6(1)(a)) - Retention: until consent is withdrawn

2.3 Analytical cookies - Data: anonymous ID, page views, session duration - Purpose: website improvement - Legal basis: consent - Retention: 14 months

3. Third parties

• Google Analytics (Ireland/USA) – analytics, policy
• Mailchimp (USA, DPF) – newsletters, policy
• [Hosting provider] ([location]) – website hosting

4. Your rights

You have the right to: - Access your data - Request rectification or erasure - Restrict processing - Receive data in a portable format - Object to processing - File a complaint with the Data Protection Inspectorate (info@aki.ee)

To exercise your rights: [email address]

5. Cookies

See our separate Cookie Declaration.

6. Changes

We will notify you of changes to the privacy policy via email or on the website. `

Common mistakes

1. Simply copied from another site – illegal and plagiarism
2. Too general – "we use cookies" is not enough; a specific list is needed
3. Outdated – update at least once a year
4. English only for Estonian consumers – must also be available in Estonian
5. Missing data retention periods – the most frequent remark from the Data Protection Inspectorate

Generation tools

• Iubenda Privacy Policy Generator
• Termly
• Free Privacy Policy

Warning: generators do not replace legal consultation in complex cases.

Further reading

• Full GDPR Guide
• Cookies and GDPR
• Accessibility Statement

Need a privacy policy audit? Contact us.