🔒 Security Free Forever

GDPR Privacy Policy Generator

Answer questions about your website and data collection. Get a GDPR-ready privacy policy draft with a legal basis for each purpose, then copy it or download it as text or HTML. No sign-up required.

All Security Tools
Legal disclaimer: This tool generates a privacy policy template based on your answers. It is not legal advice. Review the generated policy with a qualified legal professional before publishing, especially if you operate in regulated industries or collect sensitive personal data.
Step 1: About Your Website
Basic information used throughout your privacy policy.
Step 1 of 5
Your Privacy Policy
About This Tool

How this generator assembles a privacy policy section by section, not paragraph by paragraph

This is a template engine, and it is worth being upfront about that. It does not write original legal prose or reason about your specific business. It walks you through a five step form, then stitches together prewritten clauses based on exactly what you selected, numbering the sections dynamically so the document reads correctly whether you picked three data categories or twelve. Everything happens in your browser. Nothing you enter in the form is transmitted anywhere, and the finished policy is generated, copied and downloaded entirely client side, as plain text or as a ready-to-publish HTML page.

The assembly logic behind each section

The tool does not use a fixed template with blanks. It builds the document as a sequence of conditional blocks, and the section numbers shift depending on which optional sections actually get included.

Step 1 Fixed opening sections The controller section, with your company, postal address, email and optional DPO, and What Personal Data We Collect always appear. The data list is built from twelve checkboxes covering name, email, phone, address, payment info, IP and device data, cookies, location, date of birth, health data, user content and social login data. Server log data is always listed, because every web server records it.
Step 2 Purposes, legal bases and recipients Each data type and service you tick adds a purpose with its own legal basis: consent for analytics, advertising and YouTube cookies, contract for orders, legal obligation for invoices, legitimate interests for server logs. The eleven listed services, from Google Analytics to HubSpot, are named as recipients with a link to their privacy policies, alongside your hosting provider.
Step 3 Jurisdiction-specific wording The jurisdiction changes the law cited, the supervisory authority, response deadlines, the cookie law (PECR in the UK, TDDDG in Germany), the transfer safeguards, the age for children, and adds a California notice for the US. Sections are numbered from a running counter, so optional sections never leave gaps.
Step 4 Rights and Children's Privacy branch For GDPR jurisdictions all eight rights are always listed, because people have them whether or not you tick them. For other jurisdictions the policy lists the rights you tick plus the ones that law requires. Children’s Privacy renders one of three paragraphs depending on your answer, using the age that applies in your jurisdiction.
// purposes with their own legal basis, from the tool source if (analytics) purposes.push(['Measuring how the Website is used', A.consent + cookieBasis]); if (ads) purposes.push(['Showing and measuring advertising', A.consent + cookieBasis]); if (orders) purposes.push(['Keeping invoices and accounting records', A.legal]); function h2(t){ sec++; return '<h2>' + sec + '. ' + t + '</h2>'; }

The fill-in variables that shape the document

InputWhere it lands
Site name, URL, company, postal address, emailTitle, controller identification, contact line, and every mailto link in the document
Data Protection OfficerOptional extra line under the controller details, omitted if left blank
Legal basis dropdownThe basis for any processing not already covered by the purpose table
Retention periodThe general retention sentence, plus legal retention for invoices
Cookie usage settingEssential-only wording or the full cookie categories with consent and withdrawal. Analytics, advertising or YouTube services always add the cookie section
International transfer answerAdds an International Transfers section with the right safeguards. US-based services add it even if you answer no, and you are warned about the mismatch
This is a starting draft, not a compliance guarantee. The generator itself says so in its final line, and it is worth repeating here. It does not know your actual data flows, whether you are a joint controller with a partner, whether you need a Data Protection Impact Assessment, or whether GDPR even applies to you versus a different regime like the UK GDPR or a US state law. Article 13 and 14 of the GDPR set out what an information notice must legally contain, and a template can get you close but a qualified reviewer should check the finished document against your real practices before you publish it.

Two structural details worth knowing

Rights section reflects Articles 15 to 21

The eight rights map to specific GDPR articles: access is Article 15, rectification Article 16, erasure Article 17, restriction Article 18, portability Article 20, objection Article 21, and the right to complain to a supervisory authority derives from Article 77. Consent withdrawal reflects Article 7(3).

Children’s privacy age follows the jurisdiction

EU and Germany use 16, the GDPR default under Article 8(1), and the EU text notes that member states can lower it to 13. The UK, US and Canada use 13, India uses 18 under the DPDP Act. If your country sets a different age, edit that number.

GDPR Articles 13 and 14, information duties Article 6, legal basis Article 8, children's consent age Template output, human review required
  • GDPR Article 13 lists the mandatory disclosures for data collected directly from the person, the backbone of Sections 1 and 2 here.
  • GDPR Article 6 defines the six lawful bases for processing that populate the Legal Basis dropdown.
  • GDPR Article 8 sets the conditions for a child's consent to information society services.
  • UK ICO guidance is a good practical companion if your traffic includes UK visitors, since UK GDPR diverges slightly from the EU version.

Where a policy is legally required

Solo founders launching a landing page who need a reasonable privacy policy before collecting their first email signup, agencies producing a first draft for a client to hand to their lawyer, developers testing what a compliant-shaped policy structure looks like before building one into a CMS template, and small SaaS products documenting exactly which of a dozen common third party tools they actually use.

Common Questions

FAQ: GDPR Privacy Policy Generator

A generator creates a solid template that covers the required disclosure elements under GDPR. Whether it is fully compliant depends on your specific processing activities, jurisdiction, and industry. For most small websites and blogs using standard analytics and contact forms, the generated policy is a reasonable starting point. For ecommerce, healthcare, financial services, or sites with large EU user bases, legal review is strongly recommended.

A privacy policy covers all personal data processing across your entire site — how you collect, use, store, and protect data. A cookie policy specifically covers the cookies and tracking technologies you deploy, what they do, and how users can manage them. The law requires the cookie information, not a separate document, so many sites combine them into a single document. This generator includes a cookie section within the privacy policy output.

Yes. Google Analytics collects IP addresses and sets persistent cookies, which constitute personal data under GDPR. You need a privacy policy disclosing this, and in many EU countries you also need a consent banner before loading analytics scripts. Several EU data protection authorities (France's CNIL, Italy's Garante, Austria's DSB) have ruled standard Google Analytics setups non-compliant without proper configuration and consent mechanisms.

GDPR provides for fines of up to €10 million or 2% of global annual turnover for less severe infringements, and up to €20 million or 4% of global annual turnover for more serious breaches. In practice, fines for small websites tend to be lower, but regulatory complaints and reputational damage are real risks. Having a policy is far cheaper than the enforcement process even if no fine is ultimately issued.

Your privacy policy should be accessible from every page of your site — typically linked in the footer. It should also be linked prominently at any point where you collect data: contact forms, sign-up flows, checkout pages, and cookie consent banners. The URL should be stable. GDPR requires that the policy be written in clear, plain language that an average person can understand.

Update your privacy policy whenever you change how you collect or use data — adding a new analytics tool, integrating a payment processor, starting an email marketing list, or launching a new feature. Also review it when relevant laws change. At minimum, review it annually. Always update the "Last updated" date and, if changes are significant, notify existing users via email or a visible banner.

From the blog

Security writing without the scare tactics

Practical explanations of hashing, headers, certificates and consent, aimed at people who have to ship something this week.