Privacy policy checklist
Hold your privacy policy against what GDPR Articles 13 and 14, California’s CCPA and its regulation § 7011, and Virginia’s § 59.1-578 ask it to say. Pick the laws that reach you, note where each line sits in your policy, and get the gaps as a list of what to add under which heading, with a dated record to print. It runs in your browser and never reads your policy.
Map your policy
Pre-filled with a realistic example: a 30-person online shop with EU and California customers and a policy last edited in March 2024. Open your own policy beside this, then type the heading where each line lives or mark it as not there. Reset clears everything.
01Which rule texts apply
Switch on each one that reaches the business. Not sure? Run our law finder first.
02What the business does
Each tick adds the lines that only reach a business that does it.
Disclosures located in the policy
19 of 30
10 not in the policy and 1 not checked yet.
| Rule text | Located | Missing |
|---|---|---|
| GDPR Art. 13 | 6 of 13 | 6 |
| CCPA § 1798.130 + regs § 7011 | 15 of 20 | 4 |
03Find each line in your policy
Who we are
- located
- missing
- located
What we collect and where from
- located
California: the categories collected in the preceding 12 months, named with the statute's own terms (see the reference page).
- located
- missing
Why we use it
- located
California asks for the specific business or commercial purpose, described so a reader understands why.
- missing
- missing
- missing
Who we share it with
- located
The statute says a business that has not sold or shared must disclose that fact prominently (§ 1798.130(a)(5)(C)(i)).
- located
- located
- located
- located
How long we keep it
- missing
California asks for this in the notice at collection (regs § 7012(e)(4)), which many firms place in or beside the policy.
Your rights
- located
- located
- missing
- missing
Older policies often list only know and delete; look for correct and the no-retaliation line too.
How to make a request
- located
California: two or more methods; a business that operates only online with a direct relationship may offer just an email address.
- located
- missing
- missing
About this policy
- located
- located
- located
- open
The GDPR asks for a concise, intelligible, easily accessible form in clear and plain language; the phone and disability points are California's.
What to add, by heading
The 10 missing lines, filed where a reader will look for them.
Who we are
- The EU representative's identity and contact details GDPR Art. 13(1)(a)
What we collect and where from
- Whether giving the data is a legal or contractual requirement, and what happens if someone does not GDPR Art. 13(2)(e)
Why we use it
- The legal basis for each purpose GDPR Art. 13(1)(c)
- The legitimate interests relied on, named GDPR Art. 13(1)(d)
- A statement whether sensitive personal information is used or disclosed beyond the § 7027(m) purposes CA regs § 7011(e)(1)(J)
How long we keep it
- How long the data is kept, or the criteria that set the period GDPR Art. 13(2)(a)
Your rights
- The right to complain to a supervisory authority GDPR Art. 13(2)(d)
- The rights to know, delete and correct, and not to be retaliated against CA regs § 7011(e)(2)(A)–(C), (H)
How to make a request
- How an opt-out preference signal is processed (device, browser, account, offline) and how to use one CA regs § 7011(e)(3)(F)–(G)
- How an authorized agent can make a request for someone CA regs § 7011(e)(3)(H)
The rules behind the lines
- GDPR notice, data from the person
- at the time the data is obtained, Art. 13
- GDPR notice, data from elsewhere
- within a reasonable period, at the latest within one month, Art. 14(3)
- CCPA policy refresh
- at least once every 12 months, § 1798.130(a)(5)
- Last-updated date
- required, regs § 7011(e)(4)
- Virginia notice
- five items, appeal included, § 59.1-578(C)
- California's category names
- identifiers; § 1798.80(e) records; protected classifications; commercial; biometric; internet activity; geolocation; audio and visual; employment; education; inferences; sensitive
Rule texts read 22 Oct 2026.
What it works out
A privacy policy is the one document every privacy law reads. The GDPR asks for it as a notice (Arts 13 and 14), California as a policy (Civil Code § 1798.130(a)(5) and regulation § 7011), Virginia as a privacy notice (§ 59.1-578). Each list is written differently, but they overlap. This tool merges the 3 lists into 39 plain lines, files each under the heading a reader would look in, and keeps only the lines that reach your business.
You do the reading; the tool does the bookkeeping. For each line, type the heading where your policy covers it, or mark it as not there. It counts what you located against each rule text, checks the policy’s age against California’s 12-month rule, and turns the gaps into a list of what to add, heading by heading. It is a checker, not a generator: if you would rather start again, our privacy policy generators comparison measures the generators against these same lists.
It never opens or reads your policy. Everything you type stays in this tab: nothing is sent to us or stored, and closing the tab clears it. Information, not legal advice.
How to use this checklist
- Open your live policy in another window, the version visitors see, not the draft in your documents folder.
- Switch on each rule text that reaches the business, then tick what the business does. Each tick adds the lines only that practice brings.
- Work down the lines. Where the policy covers one, type its heading or number. Where it does not, press “Not in the policy”. A line said only half-way counts as not there.
- Enter the “last updated” date printed on the policy, not the date you last opened it.
- Print or copy the result and file it with your other privacy records. The print keeps every line, where you found it and the rule it comes from.
Worked example: the shop in the pre-filled answers
The tool opens on a 30-person homeware shop based in Texas that sells online to the US and the EU. It has no office in the EU, so it is reached by the GDPR’s targeting rule and needs an EU representative (our guide on whether the GDPR applies to US companies covers both). Its advertising pixel shares visitor data, which is how a shop this size can cross the CCPA’s 100,000-consumer test; the CCPA threshold calculator runs that test.
Its generator-built policy covers 19 of 30 lines. The 10 gaps, and a plain way to close each:
| Missing line | What to add |
|---|---|
| The EU representative's identity and contact details | Name the EU representative and an address to reach them under “Who we are”. |
| Whether giving the data is a legal or contractual requirement, and what happens if someone does not | Say which checkout fields an order needs, and that the order cannot go through without them. |
| The legal basis for each purpose | Pair each purpose with its basis: orders under contract, tax records under legal obligation, the newsletter under consent. |
| The legitimate interests relied on, named | Name the interests: preventing payment fraud and emailing past buyers. Recital 47 names both as possible legitimate interests. |
| A statement whether sensitive personal information is used or disclosed beyond the § 7027(m) purposes | Add one sentence saying whether sensitive personal information is used beyond the § 7027(m) purposes. |
| How long the data is kept, or the criteria that set the period | Give a period or the rule for each kind of record: orders, support emails, the marketing list. |
| The right to complain to a supervisory authority | Add the right to complain to a supervisory authority, in particular where the person lives or works (Art. 77). |
| The rights to know, delete and correct, and not to be retaliated against | List the rights to correct and not to be retaliated against beside know and delete. |
| How an opt-out preference signal is processed (device, browser, account, offline) and how to use one | Explain what a Global Privacy Control signal switches off, and whether it reaches a logged-in account. |
| How an authorized agent can make a request for someone | Say how an authorized agent sends a request on someone's behalf. |
Example answers as pre-filled. Rule texts read 22 Oct 2026. Information, not legal advice. | |
The policy is also more than 12 months old, so the California information is overdue for its yearly update in any case. Two of the gaps are about signals and agents: our Global Privacy Control checker shows what a browser sends, which is worth knowing before you describe how you handle it.
The lines one paragraph can answer for several laws
Of the 39 lines, 6 are asked for by more than one law. These are the paragraphs to write first and write once: a single “What we collect” section can meet the GDPR, the CCPA and Virginia together if it uses California’s category names. The rest are specific to one law and are usually easiest to add as a short section of their own.
| Line | GDPR | California | Virginia |
|---|---|---|---|
| The categories of personal data collected | Art. 14(1)(d) | regs § 7011(e)(1)(A) | § 59.1-578(C)(1) |
| Where the data comes from, including any publicly accessible sources | Art. 14(2)(f) | regs § 7011(e)(1)(B) | not asked |
| The purposes the data is used for | Art. 13(1)(c), Art. 14(1)(c) | regs § 7011(e)(1)(C) | § 59.1-578(C)(2) |
| Who receives the data: recipients or categories of recipients, or the categories of third parties | Art. 13(1)(e), Art. 14(1)(e) | § 1798.130(a)(5)(B)(iv) | § 59.1-578(C)(5) |
| The ways to send a request, and instructions (with any form or portal link) | not asked | regs § 7011(e)(3)(A)–(B) | § 59.1-578(E) |
| Plain language, readable on a phone, and accessible to people with disabilities | Art. 12(1) | regs §§ 7003(a)–(b), 7011(b) | not asked |
One difference the table hides: the GDPR notice is due when the data is collected, while the California policy describes the last 12 months of practice. California’s point-of-collection duty is a separate notice, built with our notice at collection template. For the rest of the two systems side by side, see GDPR vs CCPA.
Jurisdiction notes
EU and EEA
The GDPR applies directly in every member state, though national law may restrict Arts 12 to 22 in set cases (Art. 23). Art. 13 governs data you collect from the person; Art. 14 data you receive from elsewhere, with its own exceptions, such as when informing people would prove impossible or involve a disproportionate effort (Art. 14(5)(b)). A notice is not needed where and insofar as the person already has the information.
California
The statute sets the core list and the 12-month refresh; regulation § 7011 spells out the policy in full, down to how the link is labelled. If you keep a separate California privacy rights page, the policy has to be included in it (§ 7011(d)).
Virginia, and the other states
Virginia asks for five items and adds two duties: disclose sale and targeted advertising clearly with the way to opt out (§ 59.1-578(D)), and describe at least one secure and reliable way to send a request, without making anyone open a new account (§ 59.1-578(E)). Our Virginia guide covers the rest of the act. This tool does not check the other state laws’ notice sections; the US state privacy laws table shows which apply to you.
Questions
Is a privacy policy the same as a GDPR privacy notice?
Arts 13 and 14 do not ask for a “policy”; they list information you must give people. Most firms meet that duty through the privacy policy on their site, which is why this tool treats them as one document. California and Virginia name the document outright: a privacy policy and a privacy notice.
Do I need a separate California section?
Not necessarily. Regulation § 7011 lists what the policy must contain, not where. Many firms add a California section so the 12-month lists sit together; if you keep a separate California rights page, the regulation requires the policy to be included in it.
How often does the policy have to be updated?
California: the policy’s information at least once every 12 months, with the date it was last updated shown on it. The GDPR text sets no cycle but asks you to tell people before you use their data for a new purpose. Virginia’s notice section sets no cycle.
Does this tool read or score my policy text?
No. It never opens your policy and runs entirely in your browser: you tell it where each line is, it does the counting. Nothing you type is sent to us or kept after you close the tab.
A line asks for a statement that we do not do something. Do we need it?
Yes, for the lines that say so. California asks for a statement even when the answer is no: whether you sell or share (with no sales, say so; the statute wants that prominent), whether you know you sell data of under-16s, and whether you use sensitive personal information beyond the allowed purposes.