Writing a Privacy Notice That Matches What Your Business Actually Does
A privacy notice should describe your real data practices, not a template’s. Here is how small businesses can map their data and explain it clearly to customers.
Many small business websites have a privacy notice copied from a template or another company’s site. That is risky. A privacy notice is a public statement about how you handle personal information, and if it does not match your actual practices, it can mislead customers and create legal exposure. A clear, accurate notice also builds trust. This is general information. Privacy laws vary by state, country and industry, so have an attorney review your notice, especially if you handle sensitive data or serve customers in multiple jurisdictions.
Map your data first
Before writing a word, figure out what you actually do. Walk through each way customers interact with your business and note:
- What personal information you collect, such as names, emails, addresses, payment information and browsing activity.
- How you collect it: forms, purchases, cookies, phone calls, in person.
- Why you collect it.
- Where it is stored and how long you keep it.
- Who you share it with, including vendors like email marketing platforms, payment processors, analytics providers and advertising networks.
Pay special attention to tools on your website. Analytics, advertising pixels, chat widgets and embedded content can collect information about visitors, sometimes in ways the site owner has not fully considered.
What a notice typically covers
Requirements differ by law, but clear notices commonly address:
- The categories of information collected and the sources.
- The purposes for using the information.
- The categories of third parties that receive it.
- Whether information is sold or used for targeted advertising.
- How long information is kept.
- How it is protected.
- Choices and rights customers have, such as opting out of marketing or requesting access or deletion where laws provide those rights.
- How to contact the business with questions.
- The date the notice was last updated.
Write for people, not lawyers
Use plain language and short sections with clear headings. Explain things the way you would to a customer standing in front of you. Avoid vague phrases like “we may share your information with partners” if you can be more specific. A layered approach, with a short summary at the top followed by details, helps readers find what they need.
Keep it accurate over time
A privacy notice is not a one-time document. Review it whenever you add a new marketing tool, change vendors, start collecting a new type of information or expand into new markets, and at least once a year regardless. Make sure your team knows what the notice promises, so practices like honoring unsubscribe requests or deletion requests actually happen. Keep a dated copy of each version so you can show what the notice said at any point in time.
The Federal Trade Commission publishes guidance for businesses on privacy and data security at ftc.gov. Massachusetts businesses can also review state data security requirements on mass.gov.
