Free Privacy Policy Generator — GDPR, CCPA & UK GDPR Compliant

Applies to any organisation processing personal data of EU residents, regardless of where the organisation is based. Privacy notice required under Articles 13–14. Cumulative GDPR fines exceeded €5.88 billion through January 2025 (CMS Enforcement Tracker).

Max fine:

Up to €20M or 4% of global annual turnover

Enforced by:

National data-protection authorities (DPC, CNIL, ICO, Garante, BfDI, etc.)

Post-Brexit equivalent of EU GDPR; in force since 1 January 2021. EU adequacy decision currently allows free data flow EU↔UK (subject to review).

Max fine:

Up to £17.5M or 4% of global turnover

Enforced by:

ICO (Information Commissioner's Office)

Applies to for-profit businesses that meet one of: $25M+ annual revenue; data on 100,000+ consumers/households; or 50%+ of revenue from selling personal information. Must honour Global Privacy Control (GPC) signals and provide a 'Do Not Sell or Share My Personal Information' link.

Max fine:

$2,500 per unintentional / $7,500 per intentional violation

Enforced by:

California Privacy Protection Agency (CPPA), California AG

Applies to any commercial website that collects PII from California residents — regardless of business size. Requires conspicuous privacy policy and Do-Not-Track disclosure.

Verifiable parental consent required before collecting personal information from under-13s. FTC has issued fines exceeding US$170M against YouTube/Google (2019).

Enforced by:

FTC

Quebec Law 25 in full effect since September 2023: Privacy Impact Assessments, privacy officer appointment, 72-hour breach notification to CAI.

Enforcement since August 2021. Applies to any processing of personal data of individuals located in Brazil.

Max fine:

Up to 2% of Brazil revenue, capped at R$50M per infraction

Enforced by:

ANPD

Full enforcement since 1 July 2021. Eight conditions for lawful processing including accountability, purpose specification and security safeguards.

Enforced by:

Information Regulator

Applies to organisations with annual turnover >AU$3M plus smaller orgs in specified sectors. 2024 amendments add a direct right of action and significantly higher penalties.

Max fine:

Up to AU$50M or 30% of adjusted turnover for serious breaches

Enforced by:

OAIC

Core disclosures (GDPR Art. 13)

• Identity and contact details of the data controller
• Contact details of the Data Protection Officer (where required)
• Categories of personal data collected (identifiers, behavioural, sensitive)
• Purposes of processing and the legal basis for each (Art. 6 + Art. 9 for special categories)
• Recipients or categories of recipients of personal data
• International transfers, safeguards and adequacy decisions (SCCs, BCRs)
• Retention period for each data category

Data subject rights

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure / 'right to be forgotten' (Art. 17)
• Right to restrict processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object and rights related to automated decision-making (Art. 21–22)
• Right to lodge a complaint with a supervisory authority

CCPA / CPRA disclosures (California)

• Categories of personal information collected, sold or shared in the last 12 months
• Sources of personal information
• Business or commercial purposes for collection
• Right to know, delete, correct, opt out of sale/share, and limit use of sensitive PI
• Honouring of Global Privacy Control (GPC) signals
• Conspicuous 'Do Not Sell or Share My Personal Information' link in the website footer

Cookies, tracking & analytics

• Disclosure of all cookies, pixels and SDKs in use
• Linkage to a separate Cookie Policy where applicable
• Disclosure of Google Analytics (consent required for EU users)
• Advertising and remarketing pixels (Meta, TikTok, LinkedIn, Google Ads)

Children & sensitive categories

• COPPA-specific disclosures for under-13s in the US
• GDPR Art. 8 digital consent age (13–16 by member state)
• Special-category data: biometric, health, sexual orientation, political views (GDPR Art. 9)

Security & breach

• Description of technical and organisational security measures
• Breach notification commitments and contact channel
• Data retention schedule and deletion practices