GDPR and privacy compliance, in plain words
What a website or app needs to publish, what each document has to say, and what you have to be able to prove. Every document below has a template you can fill in and publish here.
The documents
| Document | You need it | Law | |
|---|---|---|---|
| Privacy policy | Always, as soon as you collect any personal data (even an email or an IP address in logs). | GDPR Art. 13/14, UK GDPR, CCPA, CalOPPA, PIPEDA, LGPD | Template |
| Terms of service | Whenever people sign up, buy, or post content. | Contract law, consumer law | Template |
| Cookie policy and consent | When you use cookies or tags that are not strictly necessary (analytics, ads, embeds that track). | ePrivacy Directive Art. 5(3), UK PECR, GDPR consent rules | Template |
| California notice | When you meet a CCPA threshold (for example over USD 26.6M revenue, or 100,000+ California consumers' data a year). | CCPA/CPRA and its regulations (in force since Jan 2026) | Template |
| Privacy rights page | Always helpful; it makes access, deletion and export requests easy and shows the deadlines. | GDPR Art. 12-22, CCPA | Template |
| Data processing agreement | When you process personal data for business customers (any B2B SaaS). | GDPR Art. 28 | Template |
| Sub-processors list | Together with the DPA; customers must be told before a new one is added. | GDPR Art. 28(2), 28(4) | Template |
| Data retention policy | Good practice for everyone; regulators ask how long you keep each kind of data. | GDPR Art. 5(1)(e), CCPA | Template |
| Refund policy | When you sell anything; EU and UK buyers have a 14-day withdrawal right unless they waive it for digital content. | EU Consumer Rights Directive, UK CCRs | Template |
| Acceptable use policy | When users can post content or send messages through you. | EU Digital Services Act (notice and action) | Template |
| Accessibility statement | Consumer e-commerce, banking, e-books and similar services sold in the EU (not micro-enterprises). | European Accessibility Act (since June 2025), WCAG 2.2 | Template |
| Security and disclosure policy | Good practice; required for products with digital elements under the EU Cyber Resilience Act as it phases in. | GDPR Art. 32, Cyber Resilience Act | Template |
GDPR checklist for your policy and product
1.Say who you are
Company name, address and a privacy contact; an EU or UK representative if you are outside them and serve people there (Art. 27).
2.Name a legal basis for each purpose
Contract, legal obligation, legitimate interests or consent (Art. 6). Consent is not the default; use it where nothing else fits, and for marketing and non-essential cookies.
3.Make consent real
Freely given, specific, informed, unambiguous, and as easy to withdraw as to give (Art. 7). No pre-ticked boxes; a reject button as visible as accept.
4.Keep proof of consent
Who agreed, to which version of the text, when and how (Art. 7(1)). policies.biz59.net records each accept and withdraw with the exact version.
5.List who gets the data
Processors and other recipients, and international transfers with their safeguard (adequacy, the EU-US Data Privacy Framework, or Standard Contractual Clauses).
6.Say how long you keep it
A period or the rule that decides it, per kind of data (Art. 13(2)(a)).
7.Explain the rights and answer in time
Access, correction, deletion, restriction, portability, objection; one month under GDPR, 45 days in California.
8.Honour opt-out signals
California treats Global Privacy Control as a valid opt-out of sale and sharing, and the 2026 regulations ask you to show that it was processed.
9.Secure it and plan for breaches
Appropriate security (Art. 32); tell the authority within 72 hours of a breach that risks people's rights (Art. 33).
10.Keep the policy current
Date every version, tell people about material changes before they apply, and ask for consent again where consent was the basis.
Other laws you may meet
EU
GDPR + ePrivacy Directive
Applies to anyone offering goods or services to, or monitoring, people in the EU, wherever the company is.
UK
UK GDPR + Data Protection Act 2018 + PECR
Same model as the EU; the ICO enforces. The Data (Use and Access) Act 2025 eases some cookie rules for analytics.
California
CCPA as amended by CPRA
Notice at collection, right to know, delete, correct, opt out of sale and sharing; new rules on risk assessments and automated decisions phase in from 2026.
Other US states
Virginia, Colorado, Connecticut, Texas, Oregon and more
Similar rights with different thresholds; a CCPA-ready policy covers most of the content they ask for.
Canada
PIPEDA (and Quebec Law 25)
Meaningful consent, a privacy officer, breach records.
Brazil
LGPD
GDPR-like rights and legal bases; a data protection officer (encarregado) contact.
Coming changes to watch
- EU Digital Omnibus(proposed November 2025): would move cookie rules into the GDPR, require a one-click reject and a pause before asking again, and exempt a site's own audience measurement. Still being negotiated; the ePrivacy rules apply until it is adopted.
- CCPA regulations in force since January 1, 2026: risk assessments for high-risk processing (due by end of 2027 for existing processing), notices and opt-outs for automated decision-making from 2027, cybersecurity audits from 2028.
- EU Data Act (applies since September 2025) for connected products and data sharing with users.
How policies.biz59.net helps
Templates for each law
Privacy policy, cookie policy, DPA, sub-processors, California notice, rights page and more.
Versions kept
Every published version stays readable at its own link (?v=1.0), so you can show what people agreed to.
Consent records
Accept and withdraw events per person and version, with a consent key per project; CSV export.
Re-consent on change
Editing text people already accepted creates a new version, and the page asks them to accept again.
Your own data rights
Export everything in your account as JSON, or delete it all, from the account page or the API.
No tracking cookies
This site sets only sign-in cookies; page views are counted without cookies or stored IP addresses.
This guide is general information, not legal advice. Sources: Regulation (EU) 2016/679 (GDPR, eur-lex.europa.eu); EDPB Guidelines 05/2020 on consent; UK ICO guidance (ico.org.uk); California Privacy Protection Agency regulations (cppa.ca.gov); European Accessibility Act, Directive (EU) 2019/882.