Privacy is a key issue online. Directly or indirectly, most websites gather some information about their users. Sometimes this is anonymous data, but in many cases (particularly under the UK GDPR) it will be classed as personal data. Privacy and data protection are thus key issues for both users and website owners.
Transparency is important where privacy and data protection are concerned. Users must know what data you collect, what you do with it, and why. It is also essential that users are aware of their own rights as “data subjects”.
The documents in this subfolder have been designed to assist in complying with privacy and data protection legislation, particularly the UK GDPR.
Website Privacy Policies is part of Business . Just £38.50 + VAT provides unlimited downloads from Business for 1 year.
Frequently Asked Questions
Which website privacy policy should I choose for my site? +
Pick the policy that matches what your site actually does. If you collect only limited data and set no cookies, a basic privacy policy is enough. If you set your own first party cookies, use first and third party cookies or run analytics, choose the version that names those activities. Simply-Docs grades its privacy policies from basic through to first and third party cookies with analytics, so the document reflects your set-up rather than over or under disclosing.
What must a website privacy policy tell users? +
It must give the privacy information the UK GDPR requires: who you are and how to contact you, what data you collect and why, your lawful basis, who you share it with, how long you keep it, any transfers abroad and the person's rights. It should also explain how to complain, which since 19 June 2026 means telling people they can complain to you first and then to the ICO. A good template prompts you for each of these.
Do I legally have to publish a privacy policy? +
You do not have to call it a privacy policy, but you do have to give people the required privacy information in a concise, transparent and accessible form, and a published policy is the normal way to do that online. If you collect any personal data through your site you cannot skip this. Transparency sits at the heart of the UK GDPR, so the information has to be genuinely available to users, not buried.
Is personal data just names and addresses, or more than that? +
It is broader than most people expect. Personal data is any information relating to an identified or identifiable living person, which includes online identifiers such as IP addresses, device IDs and cookie identifiers, not only names and contact details. That is why even so called anonymous analytics can involve personal data, and why your privacy policy needs to reflect it. The test is identifiability, not whether an obvious name is attached.
Can I just copy another company's privacy policy? +
It is risky. A privacy policy has to describe your own data practices accurately, so a copied policy that names the wrong data, purposes or cookies can itself breach the transparency rules and mislead users. Start from a template built for the UK GDPR, then tailor it to what your site really collects and does. Simply-Docs designs these policies to be adapted to your set-up rather than used unchanged.
