The digital age has made it clear: data privacy and protection considerations are crucial for today’s businesses. Whenever you collect, store, or process data in the United States, Europe, or China, you’re probably subject to certain privacy laws. If you run afoul of these obligations, you may find yourself paying significant fines. One of the fundamental requirements of these laws is to provide a privacy policy to inform people about the personal data you handle. So what is a privacy policy?
Privacy policies are key legal disclosures about how your company protects an individual’s data. If you collect data from consumers, you should read this privacy overview.
What is the purpose of a privacy policy?
Generally, a privacy policy tells your users what kind of information you collect from them, where you get their data from, how you use it, and who you share it with. It also describes the rights people have, like deleting their data or limiting how you can use it.
While the United States does not currently have a federal, comprehensive data privacy law, several states do. Furthermore, if you collect personal information from countries in the EU or from China, you are probably subject to those laws. It’s best to ensure that you have a policy which strictly adheres to those regulations. Otherwise, you could be liable for significant fines.
The definition of “personal data” varies somewhat between territories. Generally speaking, this is any data that allows businesses to identify an individual. For instance, if your company collects names, emails, and addresses, it will need a privacy policy.
Furthermore, some kinds of personal data—such as financial details, biometric data and information about minors—are considered especially sensitive. Your company should determine whether they collect this information, and then highlight it in a privacy policy.
So why is all of this necessary? Privacy policies give consumers more control over how their personal information is used. This helps website owners and users to set expectations and ensure transparency. The key is to find a balance between businesses getting information they need to provide their services, as well as for marketing and other commercial purposes, and individuals being able to control which data they share.
What is included in a privacy policy?
Although laws vary by territory, there are a few key points to include within your policy:
- Website owner
- Type of data collected
- How the data is collected
- The legal basis for collection (e.g., necessary to provide the service, consent, and more)
- The purpose of data collection (e.g., marketing and analytics)
- Types of information collected
- Whether third parties will have access to the information
- Whether third parties may collect data through widgets, including social media buttons
- Cross-border and overseas data collection information
- Rights of users to view, edit, and delete their own data and how to do it
- Description of the process the company uses to notify users of privacy policy changes
- The effective date
Do businesses need a privacy policy?
If your business collects, stores, or processes personal data, it likely needs a privacy policy. Even if you only collect cookie data for analytical purposes, or collect customer emails for email lists, you should create a policy. As global legislation catches up with modern technology’s reach, it’s better to be proactive than caught unaware.
What states require a privacy policy?
Currently, five states require companies and websites to include detailed privacy policies: California, Colorado, Connecticut, Utah, and Virgina. All of these laws include provisions to access and delete personal information, and opt out of the sale of their personal information.
Some states are more restrictive than others, and their penalties may vary. For example, California includes special protections for minors whose data is collected.
The FTC also requires companies to comply with the promises they make in their privacy policies, regardless of what states they operate in.
How to create a privacy policy with SixFifty
Creating a compliant privacy policy can be overwhelming, especially if you expect to do business in multiple states or internationally. Having a customized policy ensures that you don’t run afoul of any regulations, no matter where you’re doing business.
Unfortunately, doing the research and drafting your own privacy policy can be costly and time-consuming—to say nothing of staying updated on changes to privacy laws. That’s where SixFifty comes in. Our proprietary software is powered by real legal expertise. All you have to do is answer some questions about your business and how you use personal data, then download the automatically generated document. Once your lawyer reviews and approves it, you can use your custom privacy policy on your website.
The time it takes to go from wondering “what is a privacy policy?” to creating your own legally compliant version will demonstrate why SixFifty’s software tools are so popular. Learn more about our product by scheduling a free demo, or sign up to create your own custom privacy documents today!
