GDPR privacy notice generator with a lawful-basis table

How to use the GDPR notice generator

1. Enter Business or legal name, Contact email, Postal address (optional) and the Effective date. The Website field is not used in this notice.
2. Add a Data Protection Officer email (optional) and an EU/UK representative (optional) if you have them.
3. In Processing (purpose | lawful basis | retention), write one purpose per line, for example Sending the newsletter | consent | Until you unsubscribe.
4. List Recipients (one per line), tick Transfers outside the EEA/UK or Automated decision-making if they apply, and choose whether to Include the compliance checklist.
5. Copy or download gdpr-privacy-notice.md. Remove the checklist before you publish it.

What it does and when to use it

Use it when you collect personal data from people in the EU or UK and want a privacy notice built around a clear purpose, basis and retention table. The notice has sections for who we are, what we process and why, who receives the data, optional transfers and automated decisions, and a list of rights. The rights list cites Articles 15–18 and 20–22, plus the right to complain to a supervisory authority (Article 77).

It does not cover everything Articles 13 and 14 ask for. For example, it has no section on the categories of data you hold, where you got data you did not collect from the person, or whether providing the data is a statutory or contractual requirement (Article 13(2)(e)). Add those yourself. For a broader website policy, try the privacy policy generator; cookies need the cookie policy generator.

How it works

Each processing line is split at the | signs. The tool reads the basis loosely: any text containing “consent”, “contract”, “legal”, “vital”, “public” or “legit” becomes the full label, such as “Legitimate interests — Article 6(1)(f)”. Anything else is copied as typed, and a missing basis or retention period becomes a placeholder. If any row uses legitimate interests or consent, the tool adds a sentence about the balancing test or about withdrawing consent. Everything runs in your browser.

Worked examples

Default four purposes. The table includes | Sending the newsletter | Consent — Article 6(1)(a) | Until you unsubscribe |, then a consent-withdrawal sentence and the line on standard contractual clauses for transfers.

Short entries. Purposes Analytics | legit | 14 months, Booking appointments | contract and Text reminders | sms. The first becomes Legitimate interests — Article 6(1)(f). The second becomes | Booking appointments | Contract — Article 6(1)(b) | [retention period] |. The third stays | Text reminders | sms | [retention period] |, because “sms” is not a lawful basis.

Limits and tips

• Check every row. An unrecognised basis is not flagged as an error; it is printed as typed.
• The checklist is internal. It covers records of processing (Article 30), processor contracts (Article 28), breach notice within 72 hours where required (Article 33) and more. It is headed “not for publication”.
• Data from other sources. The ICO says you must give privacy information within a reasonable period and no later than one month.
• Laws differ. Other countries have their own data protection laws; have the final notice reviewed.