Privacy policy may be missing key GDPR elements: data retention period, user rights (access, erasure), legal basis for processing
Your privacy policy page exists, but it appears to be missing elements that privacy laws commonly expect, such as how long you keep data, what legal basis you rely on to process it, and what rights users have. Which elements are required depends on the laws that apply to you.
Why this matters
Regulators in the EU, UK and Australia can take action over inadequate privacy policies, and a policy that omits required information may fall short of the law where it applies. Which rules apply depends on where your visitors are and what data you collect, so check with a privacy adviser.
How to fix it
Review your privacy policy against a GDPR-compliant checklist. At minimum, add: the legal basis for processing each data type, retention periods (how long you keep data), user rights (access, correction, deletion), and a contact or Data Protection Officer email.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit