GDPR Privacy Policy Generator
Answer questions about your website and data collection. Get a complete GDPR-compliant privacy policy you can copy or download instantly — no sign-up required.
All Security ToolsHow this generator assembles a privacy policy section by section, not paragraph by paragraph
This is a template engine, and it is worth being upfront about that. It does not write original legal prose or reason about your specific business. It walks you through a five step form, then stitches together prewritten clauses based on exactly what you selected, numbering the sections dynamically so the document reads correctly whether you picked three data categories or twelve. Everything happens in your browser with string concatenation. Nothing you enter in the form is transmitted anywhere, and the finished policy is generated, copied and downloaded entirely client side.
The assembly logic behind each section
The tool does not use a fixed template with blanks. It builds the document as a sequence of conditional blocks, and the section numbers shift depending on which optional sections actually get included.
The fill-in variables that shape the document
| Input | Where it lands |
|---|---|
| Site name, URL, company, email | Title, controller identification, contact line, and every mailto link in the document |
| Data Protection Officer | Optional extra line under Who We Are, omitted entirely if left blank |
| Legal basis dropdown | Section 4, either a single named basis or, if multiple bases is selected, an added paragraph covering consent, contract, legal obligation and legitimate interest together |
| Retention period text | Inserted directly into the Data Retention sentence, free text you supply |
| Cookie usage setting | Switches between a full three-tier cookie explanation, essential-only wording, or omitting the section entirely |
| International transfer flag | Adds a Standard Contractual Clauses paragraph to the Third-Party Services section when set to yes |
Two structural details worth knowing
Rights section reflects Articles 15 to 21
The eight selectable rights map to specific GDPR articles: access is Article 15, rectification Article 16, erasure Article 17, restriction Article 18, portability Article 20, objection Article 21, and the right to complain to a supervisory authority derives from Article 77. Consent withdrawal reflects Article 7(3).
Children’s privacy threshold set at 16
All three Children’s Privacy variants reference age 16, which is the GDPR default under Article 8(1), though it notes member states can lower it to as young as 13. If your actual jurisdiction sets a different digital consent age, that number needs editing by hand.
- GDPR Article 13 lists the mandatory disclosures for data collected directly from the person, the backbone of Sections 1 and 2 here.
- GDPR Article 6 defines the six lawful bases for processing that populate the Legal Basis dropdown.
- GDPR Article 8 sets the conditions for a child’s consent to information society services.
- UK ICO guidance is a good practical companion if your traffic includes UK visitors, since UK GDPR diverges slightly from the EU version.
Where a policy is legally required
Solo founders launching a landing page who need a reasonable privacy policy before collecting their first email signup, agencies producing a first draft for a client to hand to their lawyer, developers testing what a compliant-shaped policy structure looks like before building one into a CMS template, and small SaaS products documenting exactly which of a dozen common third party tools they actually use.
Common Questions
FAQ: GDPR Privacy Policy Generator
A generator creates a solid template that covers the required disclosure elements under GDPR. Whether it is fully compliant depends on your specific processing activities, jurisdiction, and industry. For most small websites and blogs using standard analytics and contact forms, the generated policy is a reasonable starting point. For ecommerce, healthcare, financial services, or sites with large EU user bases, legal review is strongly recommended.
A privacy policy covers all personal data processing across your entire site — how you collect, use, store, and protect data. A cookie policy specifically covers the cookies and tracking technologies you deploy, what they do, and how users can manage them. GDPR requires both. Many sites combine them into a single document, which is acceptable. This generator includes a cookie section within the privacy policy output.
Yes. Google Analytics collects IP addresses and sets persistent cookies, which constitute personal data under GDPR. You need a privacy policy disclosing this, and in many EU countries you also need a consent banner before loading analytics scripts. Several EU data protection authorities (France’s CNIL, Italy’s Garante, Austria’s DSB) have ruled standard Google Analytics setups non-compliant without proper configuration and consent mechanisms.
GDPR provides for fines of up to €10 million or 2% of global annual turnover for less severe infringements, and up to €20 million or 4% of global annual turnover for more serious breaches. In practice, fines for small websites tend to be lower, but regulatory complaints and reputational damage are real risks. Having a policy is far cheaper than the enforcement process even if no fine is ultimately issued.
Your privacy policy should be accessible from every page of your site — typically linked in the footer. It should also be linked prominently at any point where you collect data: contact forms, sign-up flows, checkout pages, and cookie consent banners. The URL should be stable. GDPR requires that the policy be written in clear, plain language that an average person can understand.
Update your privacy policy whenever you change how you collect or use data — adding a new analytics tool, integrating a payment processor, starting an email marketing list, or launching a new feature. Also review it when relevant laws change. At minimum, review it annually. Always update the “Last updated” date and, if changes are significant, notify existing users via email or a visible banner.
From the blog
Security writing without the scare tactics
Practical explanations of hashing, headers, certificates and consent, aimed at people who have to ship something this week.
