Free Online Privacy Policy Clause Checklist
Check which common privacy policy clauses your site needs.
Answer a few questions
Select everything your website or app actually does. The checklist then marks the clauses you should include in your privacy policy.
This checklist is an informational template, not legal advice. It does not know your jurisdiction, data flows, or business model. Have a qualified privacy professional review the final policy.
About the Privacy Policy Clause Checklist
A privacy policy is not a single document that can be copied from a template and forgotten. The clauses it needs depend on what a site actually does. A brochure site that only logs server requests needs a very different policy from a subscription service that takes payments, runs analytics, sends newsletters, and stores account profiles. This checklist asks about eight common activities and combines the answers with a set of core clauses that nearly every privacy notice should contain. The result is a practical outline you can hand to a writer, a developer, or a lawyer.
Each item has a status. Required items are either universal foundations, such as who you are, what data you collect, why you collect it, how long you keep it, and how people can exercise their rights, or feature clauses triggered by one of your answers. Optional items are shown for context but are not marked as needed for your current setup. The coverage count updates as you tick boxes, so you can see how the policy grows when you add payments, accounts, or advertising. Export the checklist as Markdown to keep it beside the policy draft.
What the core clauses cover
- Identity and scope: the legal entity responsible for the data and the products the policy applies to.
- Data categories: what you collect directly, what is generated automatically, and what comes from third parties.
- Purposes and lawful bases: why each category is processed and which legal ground applies where relevant.
- Retention: how long each category is kept, or the criteria used to decide.
- Rights and contact: access, correction, deletion, objection, portability, how to complain, and a working contact route.
- Security and changes: a plain description of safeguards and how updates are communicated.
Feature clauses worth planning for
Cookies deserve their own section or a linked cookie notice, especially where consent is required. Analytics clauses should say what is measured and whether data is aggregated or shared. Advertising and profiling need clearer language about tracking, partners, and opt-outs. Payments should identify the processor and explain that card details are handled by that provider. Newsletters need consent language, unsubscribe information, and a lawful basis for marketing. Accounts should cover credentials, profile data, and deletion. Children's privacy may require age gates and parental consent depending on the jurisdiction. International transfers should name the safeguards used, such as standard contractual clauses or an adequacy decision.
The checklist deliberately avoids saying that a clause makes you compliant. Compliance also depends on the accuracy of the policy, whether it matches real practice, how consent is collected, and how requests are handled. Use this page to structure the work, then verify the final text against the laws that apply to you. Nothing here is legal advice.
Frequently asked questions
Does a complete checklist mean my policy is legally compliant?
No. The checklist covers common topics, but compliance depends on accurate facts, applicable law, consent design, vendor contracts, and operational practice. It is an informational template, not legal advice.
What if I select nothing?
The core clauses still remain required. A site that only processes basic server logs still needs to explain its identity, data handling, retention, rights, contact route, security, and change process.
Why are some clauses marked optional?
They correspond to activities you did not select. Keeping them visible helps you plan ahead: if you add a newsletter or payments later, the relevant clause is already on the list.