Privacy Policy Generator

Create a free, UK GDPR-compliant privacy policy for your website or business in minutes.

Business Information
Leave blank if not registered with the ICO.
Optional. Required for certain organisations.
Data Collection

Select all types of data your website or business collects:

Data Retention
Under UK GDPR, you should only keep personal data for as long as necessary for the purposes for which it was collected. Tax records must be kept for at least 6 years.
Additional Options
How to Use This Tool
  1. Enter your business details - Provide your company name, website URL, and contact information.
  2. Select data collection types - Choose what types of personal data your website collects from visitors.
  3. Set retention period - Specify how long you keep personal data.
  4. Generate your policy - Click the generate button to create your customised privacy policy.
  5. Download or copy - Export your policy in HTML, TXT, or DOCX format, or copy it to your clipboard.
  6. Review with a legal professional - Have your policy reviewed before publishing to ensure full compliance.
Frequently Asked Questions

Yes, if you collect any personal data from UK or EU visitors (including through cookies, contact forms, or analytics), you are legally required to have a privacy policy under the UK GDPR and Data Protection Act 2018. This applies to all websites, regardless of size.

UK GDPR is the United Kingdom's version of the General Data Protection Regulation, which was retained in UK law after Brexit. It works alongside the Data Protection Act 2018 to regulate how organisations collect, store, and use personal data of UK residents.

A privacy policy must include: your identity and contact details, what personal data you collect, why you collect it (lawful basis), how long you keep it, who you share it with, individuals' rights regarding their data, and how to contact the ICO to make a complaint.

The Information Commissioner's Office (ICO) is the UK's independent authority set up to uphold information rights. They regulate data protection and can investigate complaints, issue fines, and provide guidance on complying with data protection laws.

Under PECR (Privacy and Electronic Communications Regulations), you need to obtain consent before placing non-essential cookies on users' devices. Essential cookies (those strictly necessary for the website to function) do not require consent, but you must still inform users about them.

This tool generates a template based on common requirements. While it covers standard UK GDPR provisions, every business is different. We strongly recommend having your privacy policy reviewed by a legal professional to ensure it meets your specific needs and is fully compliant.
UK Data Protection
Key Legislation
  • UK GDPR - General Data Protection Regulation (UK version)
  • Data Protection Act 2018 - UK's main data protection law
  • PECR - Privacy and Electronic Communications Regulations
Your Obligations
  • Be transparent about data collection
  • Only collect necessary data
  • Keep data secure
  • Respect individuals' rights
  • Report data breaches within 72 hours
Information Commissioner's Office

The ICO is the UK's independent body set up to uphold information rights.

Contact:

  • Website: ico.org.uk
  • Helpline: 0303 123 1113
  • Address: Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Related Tools