Get started
FreeTOS›GDPR Privacy Policy Generator

GDPR Privacy Policy Generator

Generate a fully EU GDPR-compliant privacy policy for your website or app. Covers all 8 data subject rights, lawful basis, DPA requirements, and cross-border transfers.

AI-Generated
AI-Generated Content
Instant Download
EU GDPR Compliant

Why Use FreeTOS for Your GDPR Policy?

Just instant, professional legal documents.

All 8 Rights Covered

Our GDPR policy automatically includes all eight data subject rights: access, erasure, portability, objection, rectification, restriction, automated decisions, and the right to be informed.

Cross-Border Transfer Clauses

If you use US-based tools (AWS, Google, Stripe), we include Standard Contractual Clauses (SCCs) and adequacy decision language to cover international data transfers.

Lawful Basis Disclosure

Select your processing basis (consent, contract, or legitimate interest) and we generate the correct legal language required by GDPR Article 13/14.

Frequently Asked Questions

Everything you need to know about GDPR Privacy Policies

GDPR (General Data Protection Regulation) is EU law that governs how organizations collect, process, and store personal data of EU residents. It came into force on May 25, 2018 and applies to any business worldwide that handles EU data.
Any organization (regardless of location) that processes personal data of EU/EEA residents must comply with GDPR. This includes websites based in the US, Canada, or elsewhere that use cookies, analytics, or contact forms accessible to EU users.
The eight rights are: (1) right to be informed, (2) right of access, (3) right to rectification, (4) right to erasure ("right to be forgotten"), (5) right to restrict processing, (6) right to data portability, (7) right to object, and (8) rights related to automated decision-making and profiling.
A DPO is required for public authorities, organizations doing large-scale systematic monitoring, or those processing special category data at scale. They oversee GDPR compliance and serve as a contact point for supervisory authorities and data subjects.
GDPR fines come in two tiers: up to €10 million or 2% of global turnover for less severe violations (e.g., inadequate records), and up to €20 million or 4% of global annual turnover for the most serious breaches, whichever amount is higher.

Further Reading

Go deeper on this topic with our guide.

Blog Post
What is GDPR? A Plain-English Explanation for Website Owners
GDPR explained without the legal jargon. Who it applies to, what it requires, what the fines actually are, and exactly what you need to do.

Other Free Legal Generators

Privacy Policy Generator
General privacy policy for any website
CCPA Privacy Policy
California consumer rights compliance
Data Processing Agreement
GDPR DPA for controllers & processors
Cookie Policy Generator
GDPR cookie consent banner + policy

Why GDPR Compliance Actually Matters

It applies to your website even if you've never set foot in Europe.

GDPR (the General Data Protection Regulation) came into force in May 2018 and immediately became the most consequential privacy law on the planet. Not because it only applies in Europe. Because it applies to anyone who has European users. That means a solo founder running a SaaS from Austin, Texas, is subject to GDPR the moment a user in Frankfurt signs up.

Real fines. Real companies.

British Airways was fined £183 million after a breach exposed 500,000 customers' data. Marriott International got a £99 million fine. Google was fined €50 million by French regulators for lack of transparent consent. H&M was hit with €35 million for monitoring employee personal lives. These aren't edge cases. GDPR enforcement has accelerated every year since 2018.

Here's the part that surprises a lot of people: GDPR doesn't just care about data breaches. It cares about transparency. If you collect an email address and don't tell people why you're keeping it, that's a violation. If you use Google Analytics without documenting a legal basis for processing, that's a violation. Austria's data protection authority actually ruled in 2022 that using Google Analytics violates GDPR because data gets sent to US servers. Several other EU countries followed.

And the UK? Post-Brexit, the UK has its own version called UK GDPR, which is nearly identical to EU GDPR and enforced by the ICO (Information Commissioner's Office). The ICO is active. They fined Marriott £18.4 million and British Airways £20 million on UK GDPR grounds alone. So "we left the EU" is not a compliance exit strategy.

A proper GDPR privacy policy demonstrates that you've thought about your legal basis for processing, that you respect user rights, and that you're not hiding anything. It's not a magic shield against every fine. But having nothing, or copying a template that doesn't match your actual practices, is significantly worse than having a properly tailored document that reflects what you actually do.

Who Is Affected

Any website, app, or service that processes personal data of people in the EU or UK, regardless of where the business is based. No exceptions for small companies.

Without Compliance

Fines up to €20M or 4% of global turnover, supervisory authority investigations, mandatory processing bans, and reputational damage that is very hard to recover from.

With a Good Policy

Clear user trust, documented compliance posture, easier to pass enterprise vendor security reviews, and a framework for handling subject access requests confidently.

What's Included in Your Generated GDPR Policy

Every mandatory GDPR disclosure, covered in plain language.

Data Controller Identity

Your full business name, address, and contact details. GDPR Article 13 requires you to identify yourself clearly as the entity responsible for processing.

DPO Contact Details

If you have a Data Protection Officer, their contact information must be disclosed. Our policy includes a placeholder section for this where required.

All 6 Legal Bases Explained

Consent, contract performance, legal obligation, vital interests, public task, and legitimate interests. Each processing activity maps to the correct basis.

All 8 Data Subject Rights

Access, rectification, erasure, restriction, portability, objection, and rights around automated decisions. With instructions on how users can exercise each one.

Retention Periods

Specific time periods or criteria for how long each category of data is retained. GDPR prohibits keeping data longer than necessary for its stated purpose.

Supervisory Authority Info

Users have the right to lodge a complaint with their national data protection authority. Your policy must tell them this and ideally point them to how.

Cross-Border Transfer Safeguards

If you transfer data outside the EU or EEA, you must explain what safeguards apply, such as Standard Contractual Clauses, adequacy decisions, or binding corporate rules.

Automated Decision-Making

If you use any automated profiling or decision-making that produces legal effects, this must be disclosed. Includes basic logic like automated email segmentation.

Legitimate Interests Explanation

When you rely on legitimate interests as your legal basis, you must explain what those interests are and confirm they don't override user rights. Our policy includes this assessment.

More GDPR Questions

The ones that actually keep compliance officers up at night

Yes. This is the part that surprises most non-European business owners. GDPR has "extraterritorial scope" under Article 3. If you're offering goods or services to EU residents (even free services), or monitoring the behavior of EU residents (which includes using Google Analytics), you must comply. A US company with EU website traffic must comply. A Canadian SaaS with European subscribers must comply. Location of the business is irrelevant.
No, and this is a common misconception. Consent is just one of six legal bases under GDPR. You can also process data to perform a contract with the user, to comply with a legal obligation, to protect vital interests, to perform a public task, or based on legitimate interests. Many businesses over-rely on consent when legitimate interests or contract performance would be more appropriate and easier to maintain. Consent must be freely given, specific, and withdrawable, which makes it actually quite demanding as a legal basis.
Legitimate interest is a legal basis that lets you process data without consent if you have a genuine business reason and that reason doesn't override the user's rights and freedoms. Examples include fraud prevention, direct marketing to existing customers, network security monitoring, and certain analytics. You need to do a "legitimate interests assessment" to document that you've balanced the interests and the user's rights aren't disproportionately impacted. Our generated policy includes the appropriate language for this.
72 hours. Under GDPR Article 33, if you experience a personal data breach, you must notify your supervisory authority (the data protection regulator in your lead EU member state) within 72 hours of becoming aware of it. If the breach is likely to result in high risk to individuals' rights, you also need to notify those individuals directly. The 72-hour clock starts when you become aware, not when the breach happened. This is why many organizations have incident response plans. It's a tight window.
If your organization is based outside the EU but subject to GDPR, you generally need to appoint an EU representative under Article 27. This is a person or company in the EU who acts as a local point of contact for supervisory authorities and data subjects. It's different from a DPO. Some businesses skip this, but it's technically required if you systematically process EU data or process special category data at scale. Services like VeraSafe or DataRep offer representative services for around a few hundred dollars a year.
Yes. The UK has UK GDPR, which is essentially the EU regulation retained and slightly adapted into UK law. The ICO (Information Commissioner's Office) enforces it. The rules, rights, and obligations are nearly identical to EU GDPR. So if you have UK users, you need to comply with UK GDPR as well, which in practice means the same privacy policy structure covers both. The UK and EU have an adequacy decision in place, meaning data can flow between them without additional safeguards for now.
Quite a lot, actually. Personal data is any information that can identify a living person, directly or indirectly. This includes names, email addresses, phone numbers, IP addresses, cookie identifiers, location data, device IDs, and even behavioral data if it can be linked back to an individual. It's broader than most people assume. A cookie ID is personal data under GDPR, which is why cookie consent rules are so strict in the EU.

FreeTOS vs Paid GDPR Tools

You shouldn't need a subscription to comply with a regulation you didn't choose to be subject to.

Feature FreeTOS Termly iubenda
Price $19 a month $14/mo $27/yr+
GDPR Article 13 Coverage Full Full Full
UK GDPR Coverage Yes Yes Yes
PDF Download Included Paid plan Paid plan
AI-Tailored Output Yes Template Template
All 6 Legal Bases Covered Yes Yes Yes

How to Add Your GDPR Policy to Your Website

Where to put it, how to link it, and what to do on forms.

WordPress

  1. Generate your GDPR policy on FreeTOS
  2. Go to Pages, then Add New in WordPress Admin
  3. Title it "Privacy Policy" or "GDPR Privacy Notice"
  4. Switch to the HTML editor and paste the copied HTML
  5. Publish and copy the URL
  6. Go to Settings, then Privacy, and link to this page
  7. Add a footer menu link under Appearance, then Menus
  8. Add the link near any signup or contact forms

Shopify

  1. Go to Shopify Admin, then Settings, then Legal
  2. Find the Privacy Policy section and paste your policy
  3. Also check the "Refund policy" and "Terms of service" sections nearby
  4. Shopify will auto-link these pages in the checkout flow
  5. For EU compliance, consider adding a cookie consent app
  6. Add a "GDPR Privacy Policy" link in your footer navigation

GDPR-Specific Requirements

  1. Link your policy anywhere you collect data (forms, signups, checkout)
  2. Your cookie consent banner must link to it
  3. If you email people, include a link in your email footer
  4. For subscription services, show the link at signup
  5. Keep a version history so you can show regulators what your policy said at any given time
  6. When you update the policy, notify existing users if the change is material
GDPR placement tip: Under GDPR, you must provide your privacy information at the time you collect personal data. A footer link alone is not enough for forms. Add a line near every submit button like "By signing up, you confirm you've read our Privacy Policy" with a direct link. This is called a "layered notice" approach and it's the approach regulators prefer.

Further Reading

GDPR
What is GDPR? A Plain-English Explanation for Website Owners
GDPR sounds terrifying if you read the official text. It doesn't have to be. Here's what it actually requires from a typical website owner, what the real fines look like, and what you need to do about it.