Data privacy policy
- Disclosures the policy owes
- 15
- Category-by-purpose statements to be able to defend
- 35
- Recipients a reader can ask you to name
- 11
- Do-not-sell rows the policy has to carry
- 3
The response deadlines come from the statutes themselves: California Civil Code § 1798.130(a)(2) and Regulation (EU) 2016/679, Article 12(3), both read on 2026-09-06. Everything else in the builders is your own count and the arithmetic shown beside each figure.
15. These are worked figures on a sample firm, not yours: change every one of them.
Download the Data privacy policy worked example (CSV)
A privacy policy goes wrong in one specific way: it is written as prose and then quietly stops matching what the business does. This builder counts the document instead of drafting it. Put in the categories of personal data you collect, the purposes you use them for, the third-party tools that receive any of it and the regimes your customers put you in scope for, and it prints the disclosures the policy owes and the category-by-purpose statements you would have to defend if somebody asked. The sample firm reaches 15 disclosures and 35 statements from seven categories, five purposes and three regimes. Change every figure: the defaults are a worked example, not yours.
About the Data privacy policy
Why count processors separately from purposes?
Because a reader can ask you to name them and a purpose does not tell you how many there are. Most small sites undercount badly: analytics, email, payments, CRM, hosting, chat, maps and the video embed are eight before you have thought about it, and each is a recipient the policy is describing whether or not it names them.
What counts as selling or sharing?
Under California law the definitions in Civil Code § 1798.140 reach further than money changing hands: ad tech that builds a profile across sites generally counts. The builder asks how many of your tools fall in that group because each one is a row the do-not-sell disclosure has to carry.
Does a longer policy protect me better?
The opposite, usually. Every statement is something a reader can check, so a policy of 35 defensible statements is a stronger position than one of 90 statements nobody has verified. The checklist builder on this site counts that second number.
Where the constants in this tool come from
California Civil Code § 1798.130.
California Civil Code § 1798.140, definitions of sell and share.