Privacy Policy Requirements: The 12-Point GDPR Checklist

What must a privacy policy include? The 12 GDPR Article 13 disclosures

Each row below is one required disclosure, what satisfies it, and the phrasing that quietly fails. The right-hand column is what an auditor crosses out first.

Worked example — clause by clause

Two versions of the two clauses regulators ask for first. Same subject, different outcomes:

Retention — the failure

"We retain your personal data for as long as necessary to provide our services and for a reasonable period thereafter."

This says nothing a reader, an auditor or a deletion request can act on. "Reasonable period" is not a period.

Retention — the fix

"We keep your account data until you close your account. Payment records are kept for 7 years after closure, as required by tax law. Support tickets are deleted 24 months after resolution. After those periods we delete the data or anonymise it irreversibly."

Three categories, three periods, three triggers — and a statement of what happens at the end. That is a retention clause an auditor can tick.

Lawful basis — the failure

"We use your data in accordance with applicable data protection law."

Article 6 requires a basis per purpose. One blanket sentence covers zero purposes.

Lawful basis — the fix

"Account creation and login: performance of a contract (Art. 6(1)(b)). Billing records: legal obligation (Art. 6(1)(c)). Marketing emails: your consent (Art. 6(1)(a)), withdrawable at any time. Security logs: our legitimate interest in preventing abuse (Art. 6(1)(f))."

Four purposes, four bases, each traceable to an article. This single restructure moves most policies up 15–20 points in a completeness check.

What CCPA/CPRA adds

If you serve California residents, nine more checks apply on top of the GDPR set. Three of them — the right to correct, the non-discrimination promise, and the 12-month lookback — are the ones GDPR-shaped policies routinely lack:

• Categories of personal information collected — the CPRA-enumerated categories, not free text
• Business or commercial purpose per category
• Categories sold or shared — or an explicit "we do not sell or share"
• Right to know — categories, sources, purposes, on request
• Right to delete — with the request channel named
• Right to correct — CPRA addition
• Opt-out of sale or share — a visible "Do Not Sell or Share My Personal Information" link
• Non-discrimination — exercising rights does not change price or service
• 12-month lookback on categories disclosed

The four failures that show up in almost every policy

Across the checklist, four gaps recur — and they are the four the checker in the Privacy Policy & Cookie Analyzer marks as critical:

1. No retention period. The single most-cited gap. Fined under the "storage limitation" principle of Article 5(1)(e).
2. No named recipients. "Partners" and "affiliates" are categories nobody can verify.
3. No transfer safeguards. A US cloud provider with no SCC reference is an Article 46 gap.
4. No supervisory authority. The right to complain (Art. 13(2)(d)) must name a real regulator with a real contact point.

Reading ease is a requirement too

Transparency is the stated purpose of the whole regulation, and a policy nobody can read is not transparent. Legal boilerplate typically lands between 30 and 50 on the Flesch reading ease scale — harder than most academic text. Anything above 60 is plain-English standard; the analyzer reports your score beside the compliance score, because they fail independently: a complete policy can still be unreadable, and a readable one can still be missing four clauses.

Related reading

• What Must a Cookie Policy Include? — the six required fields per cookie and the pre-consent rule.
• Privacy Policy Audit Checklist — the full 27-check audit, severity-ranked.
• How to Use the Privacy Policy Analyzer — three walkthroughs, field by field.