Drafting a Privacy Policy

Drafting

In today’s data-driven world, transparency is essential. A well-drafted privacy policy is more than a legal requirement; it’s a cornerstone of responsible business conduct and compliance. It shows customers, employees, and partners that you handle personal data with care and in accordance with the EU and local data protection legislation.

Every organisation that collects, stores, or processes personal data, whether it concerns client lists, employee records, or other personal data, must have a clear and accessible privacy policy, or separate policies tailored to specific target groups.

A. Legal framework in Belgium and the EU

Privacy policies are primarily governed by (i) the GDPR; (ii) the Belgian Data Protection Act of 30 July 2018, and related guidance from the European Data Protection Board (EDPB) and the Belgian data protection authority (DPA).

Individuals must be clearly informed about who processes their data, why, and for how long. Policies should be written in understandable language.

B. Key elements

1. Identity and contact details of the controller – Identify who is responsible for processing the data and how they can be contacted. This typically includes the company name, address, and email address of the Data Protection Officer (DPO) or privacy contact. If the organisation is part of a group, indicate which entity acts as data controller or whether any other companies act as joint controllers.

2. Categories of personal data – Describe what types of data are collected and processed (e.g. identification, contact, HR, financial, etc.). As a law firm, we can suggest relevant categories and good drafting practices based on our experience, but it is essential that each organisation develops a clear and practical understanding of its own data flows: who collects what, from whom, for which purpose, and where it is stored. This data mapping exercise forms the cornerstone of any compliance program: a privacy policy can only be accurate and effective if it reflects the organisation’s real-life data processing activities. Without this insight, even a well-written policy risks being legally insufficient or misleading.

3. Purposes and legal bases – Explain why personal data is processed and on what legal grounds. Common bases include consent, contractual necessity, legal obligation, legitimate interest, or (for sensitive data) explicit consent or substantial public interest.

4. Data sharing and transfers – Indicate whether personal data is shared with third parties (such as IT providers, accountants, or marketing platforms), affiliates, or external processors, and for what purpose. If personal data is transferred outside the European Economic Area (EEA), specify the safeguards in place (e.g. Standard Contractual Clauses, adequacy decisions, or other mechanisms). Clear disclosure of recipients and safeguards demonstrates compliance and builds user trust.

5. Retention periods – Indicate how long each category of data is retained or describe the criteria used to determine this. Retention must always be limited to what is necessary for the purpose. As an organisations, you can also choose to refer to internal retention policies.

6. Rights of data subjects – Outline the data subjects have, including access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. Describe how these rights can be exercised and provide contact details for submitting a request. Also mention the right to lodge a complaint with the Belgian DPA.

7. Security measures – Summarise the technical and organisational measures in place to protect personal data from loss, misuse, or unauthorised access. Although it is not mandatory to include full details in the privacy policy, it is best practice to have a separate internal document describing these measures, both to demonstrate compliance upon request and to ensure the organisation actually adheres to them.

8. Cookies – If cookies or similar technologies are used, link to or include a separate cookie policy that details their types, purpose, duration, and consent mechanism. Remember that under the ePrivacy Directive, consent is required for non-essential cookies (analytics, advertising, social media, etc.). The Belgian DPA has made cookie compliance a key enforcement focus, particularly since 2022, when it issued several sanctions and detailed guidance on the use of cookie banners, transparency, and consent withdrawal.

9. Updates and version control – Mention how the policy may be updated and how data subjects will be informed of changes.

10. Language and accessibility – Ensure the policy is available in the languages relevant to your users (Dutch, French, English) and easily accessible online and internally. It should be easily accessible on your website, intranet, and/or onboarding materials.

As with many compliance documents, a privacy policy is not a one-off document but a living tool that evolves with your business. Reviewing it regularly ensures compliance and builds trust with clients, employees, and partners. At act legal Belgium, we help companies draft, review, and update privacy policies that meet GDPR requirements while remaining practical and tailored to your operations.

Drafting a privacy policy