Privacy Policy Builder (for Startups & Beyond)

A privacy policy is often the first compliance document investors, partners and clients review. This step-by-step guide helps startups build a GDPR-ready privacy policy that is transparent, legally sound and built to grow with your business.

Every company that processes personal data needs a privacy policy. Under the GDPR, this is not optional; it is a legal obligation rooted in the transparency principle of Article 5(1)(a) and the information requirements of Articles 13 and 14. But beyond legal compliance, a well-written privacy policy is one of the most practical tools a startup has: it tells users what you do with their data, sets expectations you can actually meet, and signals to investors and enterprise clients that you take data protection seriously.

The problem is that most startup privacy policies are either copied from a generic template with no connection to the actual business, or written by a lawyer in language no user will ever read. Neither approach works well. This guide gives you a practical, step-by-step approach to building a privacy policy that is accurate, transparent and GDPR-compliant, without unnecessary legal complexity.

Step 1: Identify Your Company and Who Is Responsible for Data

Your privacy policy must make clear who is the data controller, the legal entity responsible for deciding how and why personal data is processed. Under Article 13(1), the first thing any privacy policy must include is the identity and contact details of the controller: your legal entity name, registered address, and a dedicated privacy contact.

If you use a third-party data processor, this is where you distinguish yourself as the controller from those processors. Your users do not need a full list here (that comes in the third-party sharing section), but they need to know who is accountable for their data.

Step 2: Describe the Personal Data You Collect

Transparency under the GDPR requires you to tell users specifically what categories of personal data you collect, not a vague catch-all. Common categories for SaaS and startup businesses include identity and contact data, account and authentication data, billing data, usage and behavioural data, device and technical data, communications data, and marketing preferences. You should also explain how you collect this data: directly, automatically, or from third parties.

Step 3: Explain Why You Collect Personal Data (Purposes)

The purpose limitation principle under Article 5(1)(b) requires you to collect personal data only for specified, explicit and legitimate purposes. For most startups, the core purposes are: service delivery, billing and payments, customer support, security and fraud prevention, product improvement, marketing communications, and legal compliance. A practical tip: structure this section so each category of data maps to at least one purpose.

Step 4: State Your Legal Basis for Each Processing Activity

Under Article 13(1)(c), you must state the legal basis for each processing activity. For most startups, four bases are relevant: Contract (core service delivery, billing), Consent (marketing emails, non-essential cookies), Legitimate interests (basic analytics, fraud prevention, product improvement), and Legal obligation (tax records, regulatory reporting).

Step 5: Explain Data Sharing and Third Parties

Users have a right to know who else receives their personal data. Vague language like "we may share with trusted partners" does not satisfy this requirement. Be specific: name cloud hosting providers, payment processors, CRM and marketing tools, analytics platforms and customer support software. If you share data with other controllers (not just processors acting on your behalf), that must be made explicit.

Step 6: International Data Transfers

If any personal data is transferred outside the EU/EEA, the GDPR requires you to explain what safeguards are in place: adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, or certification under the EU-US Data Privacy Framework. If you use US-based tools like Google Workspace, AWS, Stripe or Salesforce, check whether those providers are DPF-certified or use updated SCCs, and reflect this in your policy.

Step 7: Retention Periods

The storage limitation principle requires that personal data is kept no longer than necessary. Define clear rules per category: account data, contract and billing records, support communications, marketing consent records, usage/analytics data, and security logs. Vague language like "as long as necessary" does not satisfy this requirement.

Step 8: Data Subject Rights

Articles 15 to 22 set out rights individuals have over their personal data: access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making. Your policy must explain how to exercise these rights and note the right to lodge a complaint with a supervisory authority such as the AEPD in Spain.

Step 9: Security Measures

Article 32 requires appropriate technical and organisational measures. Describe encryption, access controls, incident response, and vendor security at a high level, without disclosing so much detail that you create a security risk. Avoid absolute claims like "100% secure," honest, measured language is both more credible and more legally prudent.

Step 10: Policy Updates

Privacy policies need to evolve as your business evolves. State the date last updated, explain how users will be notified of material changes, and give users a reasonable period to review significant changes before they take effect.

Common Mistakes Startups Make With Privacy Policies

Copying a generic template without adapting it. A policy that lists activities your business does not perform, or omits ones that it does, creates a direct compliance gap that investors and enterprise reviewers spot quickly.

Using vague legal bases. Saying "we process your data as required by law" without specifying which law does not satisfy the GDPR's transparency requirements.

Not updating the policy as the business changes. A policy written at incorporation often bears no resemblance to actual processing 18 months later.

No information about international transfers. The vast majority of startups use US-based tools and say nothing about how those transfers are safeguarded, a persistent finding in GDPR audits.

How CB Partners Can Help

The legal basis analysis, the international transfer review, the retention period decisions and the third-party mapping all require time, legal knowledge and an understanding of how your product actually works. We help startups and scale-ups draft or review privacy policies, build Records of Processing Activities, advise on legal bases and cookie consent, assess international transfer mechanisms and prepare for investor due diligence or enterprise security questionnaires. We also offer External DPO services for companies that need ongoing GDPR oversight without a full-time specialist.

Frequently Asked Questions