Privacy policy checklist
- Statements nobody has checked this year
- 13
- Share of the policy you could evidence, percent
- 40.9
- Checks the review implies, one per statement per regime
- 66
- Collection points to walk through
- 6
The response deadlines come from the statutes themselves: California Civil Code § 1798.130(a)(2) and Regulation (EU) 2016/679, Article 12(3), both read on 2026-09-06. Everything else in the builders is your own count and the arithmetic shown beside each figure.
13. These are worked figures on a sample firm, not yours: change every one of them.
Download the Privacy policy checklist worked example (CSV)
A privacy policy review usually means reading the document and deciding it still looks fine. This builder makes it countable. Put in the places you collect personal data, the number of statements your current policy makes, how many of those you have actually verified this year, and the regimes in scope, and it prints how many statements nobody has checked and how many checks a full review implies. The sample firm has 13 unverified statements out of 22, 66 checks across three regimes, and 21 working days to answer a request in. Change every figure: the defaults are a worked example, not yours.
About the Privacy policy checklist
What counts as a statement?
A sentence that asserts something a reader could check: that you keep something for a period, that you share it with a named kind of recipient, that you honour a request in a stated time. Headings and reassurance do not count. Twenty-two is a typical number for a short policy.
Why count collection points separately?
Because a notice has to appear at each one, and the ones people forget are the offline ones: the phone call, the event sign-up sheet, the support inbox. The count is the walk-through, not the document review.
How does the response clock get into a review?
Because a review that finds you cannot search a system inside the deadline has found the most important thing in it. California's 45 days is about 32 working days and the EU's month is about 21, which is less time than it sounds when the data is in four places.