Data privacy policy
- Disclosures the policy owes
- 15
- Computed on this page from the inputs below
- Category-by-purpose statements to be able to defend
- 35
- Computed on this page from the inputs below
- Recipients a reader can ask you to name
- 11
- Computed on this page from the inputs below
- Do-not-sell rows the policy has to carry
- 3
- Computed on this page from the inputs below
The response deadlines come from the statutes themselves: California Civil Code § 1798.130(a)(2) and Regulation (EU) 2016/679, Article 12(3), both read on 2026-09-06. Everything else in the builders is your own count and the arithmetic shown beside each figure.
Email me this result
We will send you these figures and a link back to them. One email, nothing else unless you tick the box.
15. Worked figures from a sample request, not yours: change every one of them.
Download the Data privacy policy worked example (CSV)
A privacy policy goes wrong in one specific way: it is written as prose and then quietly stops matching what the business does. This builder counts the document instead of drafting it. Put in the categories of personal data you collect, the purposes you use them for, the third-party tools that receive any of it and the regimes your customers put you in scope for, and it prints the disclosures the policy owes and the category-by-purpose statements you would have to defend if somebody asked. The sample firm reaches 15 disclosures and 35 statements from seven categories, five purposes and three regimes. Change every figure: the defaults are a worked example, not yours.
Subject access requests: what people ask
Why count processors separately from purposes?
Because a reader can ask you to name them and a purpose does not tell you how many there are. Most small sites undercount badly: analytics, email, payments, CRM, hosting, chat, maps and the video embed are eight before you have thought about it, and each is a recipient the policy is describing whether or not it names them.
What counts as selling or sharing?
Under California law the definitions in Civil Code § 1798.140 reach further than money changing hands: ad tech that builds a profile across sites generally counts. The builder asks how many of your tools fall in that group because each one is a row the do-not-sell disclosure has to carry.
Does a longer policy protect me better?
The opposite, usually. Every statement is something a reader can check, so a policy of 35 defensible statements is a stronger position than one of 90 statements nobody has verified. The checklist builder on this site counts that second number.
Where the constants in this tool come from
California Civil Code § 1798.130.
California Civil Code § 1798.140, definitions of sell and share.