A privacy notice template that explains each of the rights in plain English and lets you keep the record of processing as a separate register or as an appendix to the notice.
This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Policy number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates
developed over 25 years through practical use in the real world.
Further guidance on privacy notices and data protection:
Download this policy template with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This policy is also included in the GDPR / Data Protection Toolkit and the ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22301 and ISO 22458 toolkits, including the integrated toolkits that combine them, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help preparing your privacy notice and the personal data register behind it, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Privacy Policy Template
A privacy policy template for the privacy notice you give to the people whose personal data you hold - customers, employees, job applicants, suppliers and other contacts. It explains what personal data is collected, how it is used and why, who it is shared with, how it is stored and protected, how AI is used, and what rights people have over their data.
The notice is written for the reader rather than the lawyer. Each right is explained in terms of what it actually means for the person, and a full section on making a request covers how to ask, the identity check, the timescales and what happens if more time is needed.
What the Privacy Policy Covers
- Applicability and scope - who the notice applies to and which activities it covers
- Information we may collect and process - the categories of personal data, with a prompt to delete what you do not collect
- Special category and criminal offence data - what is held, why, and how it is protected
- How we use this information and why - purposes and lawful basis, with pointers to the personal data register
- What we do with this information - sharing, suppliers, processors and transfers
- How we store and protect this information - security and retention
- How we use AI - a section to describe the AI tools in use and what they do with personal data
- Your rights and Making a request - each right explained, and the request process from start to finish
- Data breaches, Complaints and Review and update of this notice
Record of Processing - Separate or Combined
Some organisations prefer the privacy notice and the record of processing activities (RoPA) as separate documents, others prefer a single document. This template offers both. By default the notice points to your F-IMS24 Personal Data Register as the record of processing. If you would rather keep one document, the notice includes Appendix i - Personal Data Overview / Record of Processing Activities (RoPA), laid out with the same columns as F-IMS24 so rows can be moved between the two.
Who Needs a Privacy Policy?
Any organisation that collects personal data needs to tell people what happens to it. Smaller organisations with little processing may find a single privacy notice is all they need; larger ones may use this notice for most activities and a separate notice, such as the P-84 Website Privacy Policy, for specific groups.
Included in the GDPR / Data Protection Toolkit
This policy is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download, and is also included in the ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22301 and ISO 22458 toolkits.
Works with the Personal Data Register
Complete the register before writing the notice, so the notice describes what the register records. The F-IMS24 Personal Data Register is the usual starting point, with the ER21 Personal Data Register in Excel as the alternative where special category data is processed.
Keeping the Notice Accurate
A privacy notice should be reviewed whenever a new activity, supplier or tool is added, so that it describes what actually happens to personal data. The notice includes a review section to record this.
Would you rather we prepared it for you?
Our Personal Data Register and Privacy Notice Preparation service works through the personal data your organisation holds with you, including the AI tools in use, and prepares the register and privacy notice so they describe what actually happens to that data.
Personal Data Register and Privacy Notice Preparation