Digital services
Website GDPR Privacy Policy
Start with the data your website handles
Review forms, analytics, embedded tools, mailing lists and connected services. Identify what is collected, why it is used and who receives it before drafting a notice.
Publish a notice people can understand
The notice should reflect your organisation’s actual practices, including the relevant purposes, lawful bases, retention arrangements and individual rights. Your data protection lead or qualified adviser should approve the legal content.
The ICO’s guidance on the right to be informed is a useful starting point: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-to-be-informed/.
Connect the notice to the website
Make privacy information easy to find, including where data is collected. Cookie information and consent controls require their own assessment; simply publishing a privacy notice does not resolve every compliance issue.
Keep it accurate as the site changes
Review the notice when adding forms, suppliers or tracking tools. Assign an owner and retain approval records so that website changes do not leave published information behind.
Keep exploring
Related services and work.
Let’s discuss your next step
Tell us what you need to achieve and what is getting in the way. We can discuss a practical starting point.