Contact
Back to the blog
GDPR

How to Prepare GDPR-Compliant Privacy and Cookie Policies

Learn what privacy and cookie policies should contain, how to keep them aligned with your processing, and what to do when your purposes change.

AI
Łukasz Bojarski Senior Associate
6 min

If your company processes personal data, as almost all companies do, you need two documents: a privacy policy and a cookie policy. Missing either carries a risk of a fine from UODO and a loss of user trust. Below, you will find specific requirements, elements to implement and an action checklist.

The two documents serve different purposes, but together they form a foundation for compliance with the GDPR and the ePrivacy Directive.

  • Transparency about data processing: the privacy policy explains to users how their data is collected, stored, used and shared. The cookie policy explains which cookies operate on the website and for what purposes.
  • GDPR and ePrivacy compliance: the privacy policy must specify the purposes of processing, legal bases, data categories, retention periods and users’ rights. The cookie policy must address how consent to the use of cookies is collected, as required by the ePrivacy Directive.
  • Protecting users’ rights: both policies inform users of rights such as access to data, rectification, erasure and objection to processing.
  • Managing compliance: these are documents you can present in the event of a UODO inspection or audit.

What should a privacy policy contain?

A privacy policy informs the people whose data you process about the rules governing that processing. Under the GDPR, it must contain:

  1. The identity of the data controller: the organization’s name and the controller’s contact details and, if required, details of the Data Protection Officer (DPO).
  2. The purposes of data processing: specify why you collect data, for example, to provide services, perform a contract, conduct marketing or carry out market research.
  3. The types of data collected: identify the data you process, such as first and last name, email address, login details and IP address.
  4. The legal bases for processing: state the basis, such as the user’s consent, performance of a contract or a legal obligation.
  5. Data recipients: list who may receive the data, including partners, processors acting on your behalf and public authorities.
  6. Data retention period: specify how long data is kept or state that it will be processed until the purpose has been fulfilled.
  7. Users’ rights: the right of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent.
  8. Transfers of data outside the EEA: if you transfer data to countries outside the European Economic Area, identify the safeguards in place.
  9. Profiling and automated decision-making: if applicable, explain whether and how data is used in these processes.

A cookie policy describes how your website uses cookies and similar technologies to collect information about users.

Explain what cookies are

Briefly explain that cookies are small text files stored on a user’s device.

Types of cookies used

  • Necessary cookies: ensure the website’s basic functions work.
  • Functional cookies: enable additional features, such as remembering user preferences.
  • Analytics cookies: collect statistical data, for example, through Google Analytics.
  • Marketing cookies: enable ad personalization.

Purposes for using cookies

Identify specific purposes, such as analyzing website traffic, personalizing content or operating a shopping cart.

How users can manage cookies

Explain how users can disable or restrict cookies in their browser settings.

Consent to cookies

State that user consent is required before certain types of cookies, such as marketing or analytics cookies, are stored, in accordance with the GDPR and the ePrivacy Directive.

  1. Publish both documents on your website: place them somewhere visible, such as the website footer. Users must be able to find them easily.
  2. Update the documents whenever anything changes: changes to data-processing methods or the use of cookies require updates to the policies.
  3. Obtain consent correctly: the cookie policy requires user consent to store marketing and analytics cookies. Implement a cookie banner with a choice option.
  4. Tell users about changes: policy information builds transparency and trust. Notify users of every change.
  5. Document compliance: keep evidence that the policies are current and available. This will be useful in the event of a UODO inspection.

Why missing policies are a real risk

  • Risk of a financial penalty: missing privacy or cookie policies may result in sanctions from UODO.
  • Risk of losing trust: users expect information about what happens to their data. A lack of transparency reduces trust and conversion.
  • Risk of lacking a legal basis: without a proper policy, it is difficult to demonstrate that data processing complies with the GDPR.

Artificial intelligence can support your organization in three areas:

  • Automatically updating policies: AI detects changes in processing operations or in the technologies used for cookies and updates documents to maintain compliance with the rules.
  • Personalizing notices: AI algorithms can create data-protection notices tailored to different user groups and processing activities.
  • Monitoring GDPR compliance: AI analyzes whether the cookies in use meet the consent requirement and whether the policies reflect the organization’s actual processes.

Summary: what to do now

Your organization needs privacy and cookie policies to operate in compliance with the GDPR. Properly preparing and making these policies available protects users’ rights and helps protect the company from sanctions.

If your organization needs help preparing a privacy policy and cookie policy, get in touch with us. We can help develop documents that comply with the GDPR and are tailored to your data-processing activities.

Which documents are required when personal data is processed?

Every organization that processes personal data must have a privacy policy and a cookie policy. Both documents inform the people whose data is concerned about how their data is processed.

What are the main elements of a privacy policy?

A privacy policy must include the identity of the data controller, the purpose of processing, the legal bases, data categories, data recipients and the rights of the people whose data is concerned.

What should an organization do if it changes the purpose of data processing?

Update the privacy policy and notify the people whose data is concerned of the new purpose of processing. Do this before you start processing data for the new purpose.

Senior Associate

  • Precise
  • Technology-focused
  • Pragmatic

Łukasz Bojarski

Since 2017, I have been working in the field of personal data protection and privacy, helping companies design processes that comply with the GDPR, sector-specific regulations, and business requirements.

I work primarily with organizations in the IT, game development, e-commerce, finance, manufacturing, and healthcare sectors. I help clarify legal roles, data flows, data processing agreements, DPIA, data transfers, and internal documentation. I’m particularly interested in technology projects where data protection must function not only on paper but also within the product, the system, and day-to-day processes.

I focus on practical solutions: ones that are feasible, understandable to teams, and proportionate to the actual risk.
After work, you'll most often find me at a Muay Thai training session, listening to metal music, or at MMA events.

Senior Associate

Schedule an introductory call Meet me

RECOMMENDED

You may also be interested in

Selected examples of projects in which we supported businesses on legal matters, from regulatory and compliance advice to technology projects, transactions and day-to-day business support.

Read all articles