General Data Protection Regulation (EU)
GDPR Privacy Policy Requirements, in Plain English
What the EU's privacy law actually demands from your privacy policy — without the legalese.
Not legal advice. This guide is a plain-English summary for developers, not a substitute for advice from a qualified lawyer. For high-risk or regulated processing, get a professional review.
What GDPR requires of your privacy policy
The GDPR (General Data Protection Regulation) is the EU's privacy law, in force since May 2018, and the single most influential privacy regulation in the world. Here is the part developers most often get wrong: it applies based on where your users are, not where you are. If your app is publicly available and someone in the EU can sign up, GDPR applies to you — whether you're in Austin, Bangalore, or Berlin.
"Personal data" under GDPR is broad: names and emails, obviously, but also IP addresses, device identifiers, location data, and analytics cookies. If your app has accounts, server logs, or an analytics SDK, you are processing personal data.
Your privacy policy is how you satisfy GDPR's transparency obligations (Articles 12–14). The regulation is unusually specific about what the policy must contain: who you are and how to contact you; every purpose you process data for and the legal basis for each (consent, contract, legitimate interests, or legal obligation); who you share data with — including processors like your hosting provider, analytics tool, and payment processor; whether data leaves the EU and under what safeguards; how long you keep each category of data; and the full list of user rights — access, rectification, erasure ("right to be forgotten"), restriction, portability, objection, and the right to withdraw consent and to complain to a supervisory authority.
Article 12 also regulates how you write it: "concise, transparent, intelligible and easily accessible, using clear and plain language." A wall of copy-pasted legalese that doesn't match your actual practices fails both the letter and the spirit. Enforcement is real — fines reach €20 million or 4% of global annual revenue, whichever is higher, and regulators have fined small businesses, not just Big Tech.
The practical upshot for a developer: list what you actually collect, name the services you actually use, pick honest legal bases, state real retention periods, and explain how users exercise their rights. That is exactly the structure a good generator builds for you.
GDPR privacy policy checklist
- Your identity and contact details (and EU representative or DPO, if you have one)
- Every category of personal data you collect — including IPs, device IDs, and analytics data
- The purpose of each processing activity, each tied to a legal basis (Art. 6)
- If you rely on legitimate interests: what those interests are
- Third parties and processors who receive data (hosting, analytics, payments, AI APIs)
- International data transfers and the safeguards used (e.g. Standard Contractual Clauses)
- Retention periods — or the criteria used to determine them — per data category
- User rights: access, rectification, erasure, restriction, portability, objection
- The right to withdraw consent at any time, and how
- The right to lodge a complaint with a supervisory authority
- Whether automated decision-making or profiling occurs, with meaningful logic explained
- Written in clear, plain language and reachable from every page (footer link)
How PrivacyPage covers GDPR
Legal bases mapped for you
The wizard asks what you collect and why, then assigns appropriate legal bases per purpose — the part of GDPR drafting developers find hardest.
Your real processors, disclosed
Tell it you use Supabase, Stripe, Google Analytics, or OpenAI, and the generated policy names them with the correct disclosure language.
All eight user rights, spelled out
Access, rectification, erasure, restriction, portability, objection, consent withdrawal, and complaint rights — with instructions users can actually follow.
Retention and transfer sections included
Generated policies state retention approaches and international transfer safeguards, the two sections most template policies silently omit.
Generate a GDPR-ready privacy policy
Answer ~10 questions about your app. Preview the full document free — pay $9.99 once only to unlock it.
Generate Now →FAQ
Does GDPR apply to my app if I'm not in the EU?
Yes, if you offer your app to people in the EU or monitor their behavior (which analytics does). A publicly available app that EU users can sign up for is generally in scope regardless of where you're based.
Do I need a Data Protection Officer (DPO)?
Most indie apps don't. A DPO is required only for public authorities or where core activities involve large-scale systematic monitoring or large-scale processing of sensitive data. If that's you, get specialist advice.
Is a generated privacy policy GDPR compliant on its own?
A policy satisfies GDPR's transparency requirement — but only if it accurately reflects your practices, which is why the generator asks about your real stack. Full GDPR compliance also involves behavior: honoring deletion requests, securing data, and only collecting what you need. For high-risk processing, have a lawyer review.
What is the fine for not having a compliant policy?
Transparency violations fall under GDPR's upper fine tier: up to €20 million or 4% of global annual turnover, whichever is higher. In practice, first actions against small businesses are usually orders to fix plus smaller fines — but "usually" is not a strategy.