Privacy policy

If your website collects personal data, you have a duty to say so. That covers contact forms, newsletter sign-ups, online stores and tools that track visitors. The privacy policy is where all of this is gathered, usually on its own page linked from the footer of the site.

What it has to say

Datatilsynet, the Norwegian Data Protection Authority, lists (in Norwegian) what you must inform people about. The essentials for an ordinary website:

• who you are, and how people contact you
• what information you collect, and the purpose of each piece
• the legal basis, meaning what gives you the right to process it
• who you share it with, such as your accountant, your newsletter tool or Meta
• how long you keep it
• the right to access, correction and deletion, and the right to complain to Datatilsynet

Datatilsynet also states (in Norwegian) that the language must be clear and simple. A copy of another business's policy rarely fits, because it describes their tools, not yours.

Hold it up against what the site does

Open your privacy policy next to your website. Go through every form and every tool you know about, such as Google Analytics or a tracking pixel, and check that each one is mentioned. Write down what is missing. Fix it yourself if you have access, otherwise send the list to whoever runs your website.