eForms Logo

Privacy Policy Templates (9) & Generator

Create a high-quality document now!

Privacy Policy Templates (9) & Generator

Updated November 06, 2023

A privacy policy is a living document that discloses how a user’s data is collected, tracked, and used. In most countries, any personal information obtained must be shared with the user on a publicly available document on a website, mobile app, or software.

Cookie Policy – Included in a privacy policy and discloses the cookies used to track users when browsing a website.

Table of Contents

By Type (9)

Do I Need a Privacy Policy?

It depends on the privacy laws in the country where the users are located when accessing the website or app. For example, if a website is located in the United States, but has some users from Europe, it must be compliant with European Union law for those users.

United States (CCPA) Requirements

Even though CCPA is specific to California residents, a website usually cannot operate in the USA without its largest market (12% of the nationwide population).

A website is required to have a privacy policy for California users if it meets any of the following criteria:

  • Has annual revenues of more than $25 million;
  • Handles 50,000 or more annual consumers, households, or devices through the business’s commercial purpose; or
  • Derives 50% or more of its annual revenues from selling consumers’ personal information.

A privacy policy under CCPA must be updated on a 12-month basis and disclose how a website collects and uses personal information.

European Union (GDPR) Requirements

The European Union’s (EU) privacy laws, GDPR, are some of the strictest in the world. A website serving EU residents must have a privacy policy if it collects any type of personal data.

Canada (PIPEDA) Requirements

Canada’s privacy law, PIPEDA, a website is required to have a privacy policy if personal information collected crosses provincial or national borders. It does not apply to the provinces of Alberta, British Columbia, or Quebec that operate solely within their province.

What is Personal Information?

Personal information is any collected identifiable data connected to a user. Due to its broad meaning, personal data can range from something as generic as an IP address and as specific as an individual’s social security number.

Personal information does not include information that is widely available or in the public domain.

Frequently Asked Questions (5)

Where to add a Privacy Policy?

A privacy policy must be added to an area of a website or mobile app that is viewable by all users.

  • Websites – On the bottom (footer) area.
  • Mobile Apps – In the “Settings” or “Profile” area.

Is a Privacy Policy required by law?

A privacy policy is required by law if a website or mobile app has any trackable personal data or information that is collected.

Does a simple blog need a Privacy Policy?

Yes, if a blog simply wants to know its traffic data via Google Analytics or similar software, it must have a privacy policy.

Are Privacy Policies copyrighted?

Yes, any written works available on the internet are given the same protections as a book in the library.

Can I copy another website’s Privacy Policy?

Not legally. A privacy policy is protected under copyright law and cannot be used without permission.

Although, if a privacy policy is copied from another website, there is a very small chance of legal ramifications. First, the owner of the privacy policy has to request that it is removed before seeking any type of monetary damages.

Privacy Laws By Country

Country Data Protection Laws
Afghanistan N/A
Albania Law on the Protection of Personal Data No. 9887 of 10 March 2008
Algeria N/A
American Samoa Telecommunications Act (2005)
Andorra Act 29/2021 on Personal Data Protection (2021)
Angola Angola’s Law 22 on the Protection of Personal Data (2011)
Anguilla N/A
Antigua and Barbuda Data Protection Act (2013)
Argentina Personal Data Protection Act 25.326 (2000)
Armenia Law of the Republic of Armenia on the Protection of Personal Data (2015)
Aruba N/A
Australia Privacy Act (1988)
Austria Datenschutzgesetz (2000)
Azerbaijan The Law on Personal Data (2010)
Bahamas Data Protection (Privacy Of Personal Information) Act (2003)
Bahrain Law No. (30) (2018)
Bangladesh N/A
Barbados Data Protection Act (2019)
Belarus PDP Law (2021)
Belgium Data Protection Act (2017)
Belize Data Protection Bill (2021)
Benin Law (2009)
Bermuda Personal Information Act (2016)
Bhutan Bhutan Information, Communications, and Media Act (2018)
Bolivia Ley 167 (2011)
Bosnia and Herzegovina Law On the Protection OF Personal Data (2006)
Botswana Data Protection Act (2018)
Brazil Brazilian General Data Protection Law (2019)
Brunei and Darussalam N/A
Bulgaria Law for Protection Of Personal Data (2002)
Burkina Faso Loi 010 (2004)
Burundi N/A
Cambodia Article 32 of the Law on Electronic Commerce (2019)
Cameroon N/A
Canada Personal Information Protection and Electronic Documents Act (2000)
Cape Verde Data Protection Act (2001)
Cayman Islands Data Protection Act 2021
Central African Republic N/A
Chad Law 007 on The Protection of Personal Data (2015)
Chile Law 19628 (1999)
China National People’s Congress Standing Committee Decision concerning Strengthening Network Information Protection (2012)
Christmas Island N/A
Cocos (Keeling) Islands Privacy Act of 1988
Colombia Law 1581 (2012)
Comoros N/A
Democratic Republic of Congo (Kinshasa) N/A
Cook Islands N/A
Costa Rica Ley de protección de la persona frente al tratamiento de sus datos personales – Ley n.º 8968 (2011) 
Côte D’Ivoire Loi n° 2013-450 du 19 juin relative à la protection des données à caractère personnel (2013)
Croatia Act on Personal Data Protection
Cuba N/A
Cyprus The Processing of Personal Data (2018)
Czech Republic Act No. 110 on Processing of Personal Data (2019)
Denmark Act on Processing of Personal Data (2000)
Djibouti N/A
Dominica N/A
Dominic Republic Ley No.172 (2013)
East Timor Timor-Leste Constitution (2002)
Ecuador Protection of Privacy and Personal Data Bill (2019)
Egypt Personal Data Protection Law, Law No. 151 (2020)
El Salvador N/A
Equatorial Guinea Law No. 1 on the Protection of Personal Data (2016)
Eritrea N/A
Estonia Personal Data Protection Act (2007)
Ethiopia  N/A
Falkland Islands Data Protection Policy (2020)
Faroe Islands GDPR (2016)
Fiji N/A
Finland Personal Data Act (1999)
France Loi 78-17 (1978)
French Guiana N/A
French Polynesia N/A
French Southern Territories N/A
Gabon Loi n°001 relative à la protection des données à caractère personnel (2011)
The Gambia N/A
Georgia Law of Georgia on Personal Data Protection (2011)
Germany Federal Data Protection Act (2017)
Ghana Data Protection Act (Act No. 843) (2012)
Gibraltar Data Protection Act (2004)
Greece Law No. 4624 Hellenic Data Protection Authority (2019)
Greenland Personal Data Protection Act 2016
Grenada N/A
Guadeloupe N/A
Guam N/A
Guatemala Ley Número 4090 Ley De Protección De Datos Personales (2009)
Guinea Loi L/037 (2016)
Guinea-Bissau N/A
Guyana Draft Data Privacy Bill 2020
Haiti N/A
Holy See N/A
Honduras Ley de transparencia y acceso ala información pública DECRETO No. 170 (2006)
Hong Kong Personal Data (Privacy) Data (1995)
Hungary National Data Protection and Freedom of Information Authority
Iceland Data protection and the Processing of Personal Data Law No.90 (2018)
India Personal Data Protection, 2019
Indonesia Systems Regulation (2016)
Iran (the Islamic Republic of) N/A
Iraq Draft Legislation
Ireland Data Protection Act, 1988 (in English)
Israel Privacy Protection Act No.5741 (1981)
Italy Data Protection Code Decree No. 196 (2003)
Ivory Coast Loi n° 450 (2013)
Jamaica Data Protection Act 2020
Japan Act on Protection of Personal Information (2003)
Jordan Draft Legislation
Kazakhstan On Personal Data and Its Protection (2013)
Kenya The Data Protection Act (2019)
Kiribati N/A
Korea, Democratic People’s Republic (North Korea) N/A
Korea, Republic of (South Korea) Act on The Protection of Personal Information (2008)
Kosovo Law No.03/L – 172
Kuwait N/A
Kyrgyzstan Personal Data No.58 (2008)
Lao, People’s Democratic Republic Data Protection Law (2017)
Latvia Personal Data Processing Law (2018)
Lebanon Law No.81 (2012)
Lesotho Data Protection No.19 (2012)
Liberia N/A
Libya N/A
Liechtenstein Gesetz über die Abänderung des Datenschutzgesetzes (2002)
Lithuania Law on Legal Protection of Personal Data (1996)
Luxembourg Data Protection Law (2002)
Macau Personal Data Protection Act (2005)
Madagascar Law No.38 Protection of Personal Data (2014)
Malawi Draft Legislation
Malaysia Personal Data Protection Act (2010)
Maldives Draft Legislation
Mali Loi sur la protection des données à caractère personnel Loi n°015 (2013)
Malta Data Protection Act, Cap 586 (2018)
Marshall Islands N/A
Martinique N/A
Mauritania Loi 020 sur la protection des données à caractère personnel (2017)
Mauritius Data Protection Act No. 20 (2017)
Mayotte N/A
Mexico Ley General de Protección de Datos Personales en posesión de sujetos obligados (2017)
Micronesia, Federal States of N/A
Moldova, Republic of Law No. 133 on personal data Protection (2011)
Monaco Loi No. 1.165 (1996) Consolidée par la Loi No.1.462 (2018)
Mongolia Law on Information Transparency and Right to Information (2011)
Montenegro Law on Protection of Personal Data No. 79 (2009) 70 (2009) 44 (2012) 22 (2017)
Montserrat N/A
Morocco Law No. 09-08 (2009)
Mozambique N/A
Myanmar, Burma Draft Legislation
Namibia Draft Legislation
Nauru N/A
Nepal The Privacy Act (2018)
Netherlands Personal Data Protection Act (1998)
Netherlands Antilles Personal Data Protection Act BES (2015)
New Caledonia N/A
New Zealand Privacy Act (1993)
Nicaragua Ley No. 787 Ley de Protección de Datos Personales (2012)
Niger Loi n°28 (2017)
Nigeria Nigerian Data Protection Regulation (2019)
Niue N/A
North Macedonia Law on Personal Data Protection (2005)
Northern Mariana Islands N/A
Norway Personal Data Act 2018 —
Oman Royal Decree no. 69 (2008)
Pakistan Draft Legislation
Palau N/A
Palestinian Territories N/A
Panama Ley 81, Protección de Datos Personales (2013)
Papua New Guinea N/A
Paraguay Ley 1682 Reglamenta la Informacion de Caracter Privado (2001)
Peru Ley N° 29733 – Ley de Protección de Datos Personales (2011)
Philippines Data Privacy Act (2012)
Pitcairn Island N/A
Poland Act on the Protection of Personal Data (1997)
Portugal Lei No. 13,709 Protecao de Dados Pessoais (2018)
Puerto Rico N/A
Qatar Law No. 13 Concerning Privacy and Protection of Personal Data (2016)
Reunion Island N/A
Romania Supervisorz Authoritz for Personal Data Processing (2005)
Russian Federation Bill – Regarding Personal Data (2006)
Rwanda Bill – Personal Data Protection (2019)
Saint Kitts and Nevis Data Protection Act (2018)
Saint Lucia Data Protection Act (2011)
Saint Vincent and the Grenadines Draft Legislation
Samoa N/A
San Marino Law regulating the Computerized Collection of Personal Data (1983)
Sao Tome and Principe Data Protection Law 2016. Lei N° 3 (2016)
Saudi Arabia Draft Legislation
Senegal LOI n°12 (2008)
Serbia Data Protection Act (2018)
Seychelles Draft Legislation
Sierra Leone N/A
Singapore Personal Data Protection Act No. 26 (2012)
Slovakia (Slovak Republic) Act on the Protection of Personal Data (1992)
Slovenia Personal Data Protection Act (ZVOP-1) (2004)
Solomon Islands N/A
Somalia N/A
South Africa Protection of Personal Information Act 4 (2013)
South Sudan N/A
Spain Ley Orgánica 3 Protección de Datos Personales y garantía de los derechos digitales (2018)
Sri Lanka N/A
Sudan N/A
Suriname The Constitution of the Republic of Suriname, Article 17 (1987)
Swaziland (Eswatini) Draft Legislation
Sweden Data Protection Act (2018)
Switzerland Federal Act on Data Protection (1992)
Syria, Syrian Arab Republic N/A
Taiwan (Republic of China) Personal Data Protection Act (2015)
Tajikistan Law of the Republic of Tajikistan No 1537 about Personal Data Protection (2018)
Tanzania; officially the United Republic of Tanzania N/A
Thailand Personal Data Protection Act, B. E. 2562 (2019)
Tibet National People’s Congress Standing Committee Decision concerning Strengthening Network Information Protection (2012)
Timor-Leste (East Timor) N/A
Togo Loi No. 14 (2019)
Tokelau N/A
Tonga N/A
Trinidad and Tobago Data Protection Act (2011)
Tunisia Organic Act No. 63 (2004)
Turkey Law on the Protection of Personal Data No. 6698 (2016)
Turkmenistan Law on Information on Private Life and its Protection No. 519-V (2017)
Turks and Caicos Islands N/A
Tuvalu N/A
Uganda The Data Protection And Privacy Act (2019)
Ukraine Law on Personal Data Protection (2010)
United Arab Emirates Draft Legislation
United Kingdom Data Protection Act 2018
United States Privacy Act (1974)
Uruguay La Ley 18,331 Protección De Datos Personales (2008)
Uzbekistan Law No. ZRU-547, Personal Data (2019)
Vanuatu N/A
Vatican City State (Holy See) N/A
Venezuela N/A
Vietnam Law on Information Technology (2006)
Virgin Islands (British) The British Virgin Islands’ Data Protection Act (2021)
Virgin Islands (U.S.) N/A
Wallis and Futuna Islands N/A
Western Sahara N/A
Yemen Law of the Right of Access to Information 2012
Zambia Data Protection Act (2021)
Zimbabwe Data Protection Act (2021)