Data and Privacy Policies

A privacy policy, or privacy notice, is the document that tells people what you do with their personal data. Every business needs one, and most of the ones we see could be doing their job better.

If your business collects personal data, and almost every business does, whether through a website, an app or just the ordinary course of trading, the law says you have to be open about it. A privacy notice is how you do that. It usually sits on your website where people can find it easily, and it sets out:

• what personal data you collect
• what you use it for
• how long you keep it
• who you share it with, including any third-party suppliers
• whether any of it goes outside the UK, and how it’s protected if it does
• the rights people have over their data

A good privacy notice does more than keep you on the right side of the law. It builds trust, because people are more willing to deal with a business that’s straightforward about what it does with their information, and it lowers your risk, because it forces you to know what data you hold and why.

Here’s where it tends to go wrong. Most businesses treat the privacy notice as something to hand off, often to whoever built the website, who drops in a template. Templates read fine, but they’re written for no business in particular, so they rarely match what you actually do with data. That mismatch is the compliance gap, and it’s a common one. AI tools tend to make it worse, advising businesses to keep the notice short and simple when the whole point is that it should reflect your business.

We regularly review these, and we can draft one from scratch. Either way we start by understanding your business, the data you hold and how it moves, so the notice you end up with is accurate and does what it’s supposed to.

A template privacy notice looks like compliance, but often it’s anything but.