GDPR Privacy Policy: What You Must Include in 2026

The GDPR (General Data Protection Regulation) has been in effect since May 2018, but many websites still get their Privacy Policies wrong — risking fines of up to €20 million or 4% of annual global turnover.

This guide covers exactly what your Privacy Policy must include to comply with the GDPR in 2026.

Who Does GDPR Apply To?

GDPR applies to you if:

• You are based in the EU or EEA, or
• You offer goods or services to people in the EU, or
• You monitor the behavior of people in the EU (e.g. via analytics cookies)

This means most websites worldwide need a GDPR-compliant Privacy Policy.

The 10 Things Your GDPR Privacy Policy Must Cover

1. Identity of the Data Controller

You must clearly state who is responsible for the data — your business name, address, and contact details. If you have a Data Protection Officer (DPO), include their contact too.

2. What Data You Collect

List every category of personal data you collect. This includes:

• Name and email address
• IP addresses
• Browser cookies
• Payment information
• Behavioural data from analytics

3. Why You Collect It (Legal Basis)

GDPR requires you to have a legal basis for each type of processing. The six lawful bases are:

• Consent
• Contractual necessity
• Legal obligation
• Vital interests
• Public task
• Legitimate interests

4. How Long You Keep Data (Retention)

Clearly state how long you hold each type of data. You cannot keep personal data “forever” — there must be a defined retention period or criteria.

5. Who You Share Data With

If you share data with third parties (analytics providers, payment processors, marketing tools), you must name them or describe the categories of recipients.

6. International Data Transfers

If data leaves the EU/EEA, you must explain what safeguards apply — such as Standard Contractual Clauses (SCCs).

7. User Rights

Your policy must inform users of their rights:

• Right of access
• Right to rectification
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object

8. Right to Withdraw Consent

If you rely on consent as a legal basis, users must be able to withdraw it at any time — and you must tell them how.

9. Right to Lodge a Complaint

Users must be informed they have the right to lodge a complaint with a supervisory authority (their national data protection authority).

10. Automated Decision-Making

If you use automated decision-making or profiling, you must disclose this and explain the logic involved.

Cookies Need Separate Coverage

While GDPR covers cookies as personal data, many businesses also need a separate Cookie Policy that details exactly which cookies are set, their purpose, and how users can control them.

Generate a GDPR-Compliant Privacy Policy

Writing all of this from scratch is time-consuming. Our Privacy Policy Generator covers every GDPR requirement automatically — just answer a few questions about your business and we’ll handle the rest.

Generate your GDPR Privacy Policy now →