Writing an accurate small business privacy notice

A privacy notice should describe what your business actually does with personal data, not what a template assumes.

Start with the data map

List forms, purchases, newsletter subscriptions, customer support, analytics, embedded videos and advertising. Record what data is collected, who receives it and why. Include operational logs and data held by processors.

Translate facts into clear explanations

For each activity, describe the purpose and applicable lawful basis. Where applicable, identify retention periods or criteria, recipients and international transfers with relevant safeguards. Provide identity and contact information.

Explain rights without exaggeration

Describe relevant access, correction, deletion and other rights, complaint routes, and how people contact the organization. Some rights have exceptions and differ between countries.

Review after every material change

When adding a CRM, payment service, analytics vendor or advertising script, update the notice. Save a version history and check the language against production behavior.

Further references

For European data rights, consult the European Commission guidance. For accessibility, consult W3C WAI evaluation guidance. For advertising consent, check your ad provider’s current publisher requirements.

• European Commission — data protection
• W3C WAI — accessibility evaluation
• Google AdSense — certified CMP requirements

Educational content, not legal advice. Last editorial review: 3 November 2026.