Business Privacy Policy Template

Privacy laws that require Privacy Policies apply to businesses of all sizes. As a small business, you are just as responsible for any breaches or mishandling of data as a billion dollar multinational corporation would be, and are responsible for having a Privacy Policy if you collect, use or share any protected personal information.

This guide explains why your small business needs a Privacy Policy and how to create and display one for your small business. We've also put together a Sample Small Business Privacy Policy Template that you can use to help write your own.

Why You Need a Privacy Policy for Your Small Business

There are two reasons even small businesses require a Privacy Policy. First, Privacy Policies are legally required. Secondly, they protect you from liability.

Let's look at each of these more.

A Privacy Policy is Required by law

If purchasing your product or service requires customers to give you personally identifiable information, you are required by law to post a Privacy Policy on your website or make one available at your office or storefront.

Personally identifiable information is the universal description of any information that can be used to identify, contact or locate an individual. It includes but isn't limited to the following:

• Full names
• Dates of birth
• Physical addresses
• Any type of national identification number
• IP addresses (if tracked)
• Telephone number
• Screen names or handles
• Email address
• Credit card numbers

The requirement for a Privacy Policy can be found worldwide. Just a few of the current laws requiring a Privacy Policy include:

• California Online Privacy Protection Act (CalOPPA): Requires a Privacy Policy that's posted in a conspicuous place and that describes how you collect information, what data you request, and how customers can change inaccurate data.
• Personal Information Protection and Electronic Documents Act (PIPEDA): The Canadian privacy law requires Canadian businesses to secure consent before collecting personal information. These processes must be outlined in your Privacy Policy in plain language.
• Australia Privacy Act: This act addresses information privacy with 11 principles. They address issues like the collection of information, requesting it, and access to records. There are also limited allowable uses for the information and if your Privacy Policy is open and transparent, you will likely meet the standards in this act.
• General Data Protection Regulation (GDPR): The EU's comprehensive, far-reaching and robust law for privacy protection promotes consumer privacy rights and the requirement of a Privacy Policy.

Even if you do not believe a country's law applies to you, it is still a good idea to create a Privacy Policy. Informing customers of the type of information you collect and how you use it protects you from liability if a customer claims you handled their data incorrectly.

Protection from Liability Through a Privacy Policy

Small businesses have the most to lose from poor data practices. You can handle data in a way that's consistent with local laws and your internal policies, but if a customer interprets that as mishandling, you may face liability or at least an expensive and time-consuming legal battle to fight the claim.

A Privacy Policy explains your policies for handling information and distinguishes prohibited actions from allowed ones.

Also, if a customer authorizes your procedures by agreeing/consenting to your Privacy Policy, they will be less likely to have a cause of action against you.

How to Create a Privacy Policy for Your Small Business

When creating a Privacy Policy, including the following basic clauses will help you comply with current privacy laws. In addition to writing a compliant Privacy Policy, you also have to make it available to your customers and assure they accept the terms of the policy.

Required Clauses in a Privacy Policy

Start with these important clauses when drafting your complete Privacy Policy.

What Information You Collect

Almost all Privacy Policies start with a description of the data collected. Here is where you'll tell customers exactly what information you will collect, such as names, addresses, email address, and payment information.

It is better to be overly specific in this section rather than vague. You can make this into a list format for readability.

ABC Fitness lists the information it collects and offers specific examples:

Notice the use of plain language. When it comes to explaining to customers what type of data you require and request, keeping things simple is the best course of action.

How Data is Collected

The information regarding how you collect information may be included in your clause with the types of information you collect, or in can be in its own clause.

ABC Fitness makes it clear that it obtains some data in the course of processing payment in the following clause excerpt:

This clause will vary depending on the nature of your business. Just make sure you let users know how you end up obtaining their data, whether it's from them, from a third party, or via cookies.

Information You Share or Disclose

Most companies share or disclose some sort of information under some types of circumstances, such as when required by law, when consent is obtained to share the information, or if the business is sold. Make it clear to your users when and under what circumstances their data will be shared.

Here's how ABC Fitness does this, and lets users know that information may be shared with clients, debt collection agencies, service providers and third-party vendors:

How Customers Can Update Their Information

Being able to access and update personal data is an important right granted to consumers under current privacy laws. In your Privacy Policy, you must not only communicate this right but also tell customers how they can view and correct the personal information you keep on file.

This is as simple as stating that you allow access to information by consumers and giving them contact information to make corrections. ABC Fitness addresses this briefly in its Privacy Policy:

Data Protection and Security Measures

Telling consumers how you protect data is required in laws like the UK's Data Protection Act. It is also reassurance for your users that their data will likely stay safe with you.

While you don't have to go into specifics about your security practices, you should at least note the general steps you take.

ABC Fitness states that it uses SSL, firewalls, encryption, and also limits the numbers of employees that have physical access to the data center amongst its steps to secure date:

Make sure that whatever you say you're doing, you're actually doing to keep data secured.

Opt-out Procedures

Many countries have laws restricting unsolicited email or spam. You are required to give customers the chance to opt out of these communications and failure to do so could result in civil liability and fines.

It is also simply a nice thing to do. If a customer made one purchase and no longer wants promotions from you, offering a procedure to make this request helps your goodwill. While you may consider the promotions a money-making effort, being respectful towards customers also helps you gain in your market.

The opt-out procedures for reducing spam or refusing promotions should be in your Privacy Policy. Offer a telephone number or email address where customers can contact you to opt out of these communications.

Here's how ABC Fitness does this:

Updates to the Policy and Notifications of Updates

It is very likely you will update your Privacy Policy as laws and your privacy practices change. In order to avoid catching customers off-guard, articulate this right in your Privacy Policy.

ABC Fitness mentions its Privacy Policy can change its policy at any time, and any changes will be announced on its website:

Notice requirements for changes are helpful. You can do this through email, banner ads or announcement text on the top of your Privacy Policy.

Here's how Twitter let users know that its Privacy Policy was being updated and changed.

Making Your Privacy Policy Accessible

Your Privacy Policy must be accessible at all times. A common way of doing this is by providing a link to your Privacy Policy at least in the footer of your website.

Other places to provide a link to your Policy include on sign-up pages, online checkout pages, email subscription forms and other places where personal information is collected.

Summary of What to Include in a Small Business Privacy Policy

Small businesses have more to lose if data breaches or customer misunderstandings arise. A well-drafted Privacy Policy is a good start to handling your customer's personal data well and will help you enact better information protection practices.

When you create your Privacy Policy, keep these four tips in mind:

• Never ask for more information than is necessary. If you do not require a customer's date of birth to provide services, do not ask for it. The less personal data you collect the less work you need to perform to keep it safe and track it.
• Write in plain language. Consumers are becoming more savvy about the data they share and how companies use it. Writing a vague or unnecessarily complex Privacy Policy puts them on alert and they will be less likely to do business with you. Use plain language and consider experimenting with other structures, like a FAQ or adding a table of contents.
• Customize to your business. A fitness studio collects different data than an accounting firm. You can start with a template or a borrowed Privacy Policy, but make it relevant to your business and the information you collect.
• Implement good information practices. Privacy by design helps small businesses, too. A Privacy Policy gives you a good foundation and strengthens relationships with your customers, but that will mean nothing if you fail to instill the right security and virus protection for your systems.

Download Sample Small Business Privacy Policy Template

Generate a Privacy Policy in just a few minutes

Our Sample Small Business Privacy Policy is available for download, for free. The template includes these sections:

• Definitions
• Collecting and Using Personal Information
• Usage Data
• Use of Personal Information
• Transfer of Personal Information
• Disclosure of Personal Information
• Security of Personal Information
• Links to Other Websites
• Changes to Privacy Policy
• Contact Information

Sample Small Business Privacy Policy Template (HTML Text Download)

You can download the Sample Small Business Privacy Policy Template as HTML code below. Copy it from the box field below (right-click > Select All and then Copy-paste) and then paste it on your website pages.

Sample Small Business Privacy Policy Template (PDF Download)

Download the Sample Small Business Privacy Policy Template as a PDF file

Sample Small Business Privacy Policy Template (Word DOCX Download)

Download the Sample Small Business Privacy Policy Template as a Word DOCX file

Sample Small Business Privacy Policy Template (Google Docs)

Download the Sample Small Business Privacy Policy Template as a Google Docs document

More Privacy Policy Templates

More specific Privacy Templates are available on our blog.