Privacy Policy Template for Small Business Websites
Everything GDPR Article 13 expects — purposes with lawful bases, retention, recipients, rights — in one page you adapt in 20 minutes. Free, no signup.
Download the privacy policy template (.md)
Plain Markdown — paste into your CMS, Notion, Google Docs or Word.
Want it generated to match exactly what you do? Use the free privacy notice generator.
How to adapt it — honestly
- Replace every [bracketed] field.
- Edit the purposes table so it lists what your site actually does. A policy describing processing you don't do is a violation waiting to be found.
- Name your real processors (hosting, email, analytics) — each needs an Art. 28 data processing agreement.
- Set concrete retention periods, not "as long as necessary".
- Publish with a visible link in your footer and a "last updated" date.
When a template is not enough
- You process special-category data (health, biometrics) — get proper advice.
- You monitor behaviour at scale or are a public body — a DPIA may be mandatory.
- You transfer data outside the EU/EEA without an adequacy decision — SCCs need real attention.
Related free tools
- Privacy notice generator — build the notice from your actual purposes
- RoPA template — the Article 30 register behind every good policy
- Free cookie & tracker check — see what your site really loads
- GDPR website compliance checklist
The template says what you process. Only a scan of the live site can say whether that is still true.
The download is free and complete — every field Article 13 expects, in plain Markdown you paste into your CMS. Nothing is held back for a licence.
A policy is a claim about a site, and the usual way to make that claim wrong is not forgetting to edit the document — it is the site drifting away from it. A tracker added by a marketing tool, a consent banner lost in a redesign, a privacy link that only survives on one page: the document still says everything is in order. The free scanner already runs the 15 automated checks against a real URL. EUComply Pro adds the 18 server-side checks on top, so it becomes 33 checks in all: whether a privacy link exists at all, whether a page that really loads tracking is missing a consent banner, and whether the response carries HSTS and content security. The report can be sent on as a PDF, which is what an auditor asks for. $79/year per website.