Who it's for
- Small businesses, sole traders and charities with a website, contact form, mailing list or online shop
- Businesses replacing a generic or out-of-date privacy notice
- Organisations processing special category data at scale should take specialist advice
What's included
- About this template — why a privacy notice is required and the ICO data protection fee tiers
- Part A — Data controller details: name, address, ICO registration number, DPO, contact
- Part B — The policy (10 sections): who we are; data we collect (table); how we use it with lawful basis (table); cookies and analytics; who we share with (table); international transfers; retention (table); your rights (table); security; changes
Key points covered
- Written for UK GDPR Articles 13 and 14 and the Data Protection Act 2018
- Lawful basis stated for each purpose (contract, legitimate interests, consent, legal obligation)
- Rights table includes the right to complain, with acknowledgement of complaints within 30 days
- Retention periods table, including six years for transaction records
- International transfers covered by UK IDTAs or adequacy decisions
- Cross-refers to a separate cookie policy for cookie details
DocPilot templates are drafted from current legislation and official guidance (GOV.UK, legislation.gov.uk and the relevant regulators), checked against those sources and fully re-reviewed every six months. They are not legal advice. How we make our documents →
Read the guide
Related documents
Non-Disclosure Agreement (NDA)£12.99 · See what's included →Cookie Policy — UK GDPR + PECR£9.99 · Buy now →Data Processing Agreement (Article 28)£14.99 · Buy now →
Questions
Do I need a privacy policy if I only have a contact form?
Yes. If you collect personal data from people — even just names and emails — UK GDPR requires you to tell them how you use it.
Does it cover cookies?
It includes a cookies and analytics section and points to a full cookie policy. The separate Cookie Policy template covers PECR consent in detail.
Do I also need to pay the ICO fee?
Most organisations processing personal data must pay the ICO data protection fee unless exempt. The template summarises the tiers and links to the ICO self-assessment.
Can I just paste it in unchanged?
No. Complete the highlighted parts so they match what your business actually does with personal data.
Privacy Policy (UK GDPR)
£12.99 · Word + PDF · instant download
Buy — £12.99 →Bought the wrong document by genuine mistake? Our Swap or Refund Promise lets you swap it or get a refund within 14 days.