The Short Answer — Yes, and Here Is Exactly Why
Under the General Data Protection Regulation (EU Regulation 2016/679), any organisation that collects or processes personal data from EU residents must inform those individuals about the processing at the point of collection. That obligation to inform is Article 13 GDPR. A privacy policy is the primary mechanism for discharging it.
The threshold is extremely low. "Personal data" under Article 4(1) GDPR includes names, email addresses, IP addresses, cookie identifiers, device fingerprints, and any other information that can directly or indirectly identify a living individual. If your website does any of the following, it is collecting personal data:
- Uses Google Analytics, Plausible, or any analytics tool
- Has a contact form, enquiry form, or quote request form
- Allows newsletter signups
- Places any non-essential cookies (advertising, tracking, social media embeds)
- Enables user accounts or checkout flows
- Embeds YouTube videos, Google Maps, or social media widgets
- Uses a live chat widget or support tool like Intercom or Zendesk
The Belgian startup fined €50,000 was not running a data-heavy operation. It had a contact form and Google Analytics — the same combination used by hundreds of thousands of websites across Europe. The absence of a privacy policy was, on its own, the violation. No breach occurred. No data was sold. The fine was purely for the failure to inform users that their data was being processed.
One more point that surprises many website owners: the GDPR does not just cover data you store in a database. The moment a visitor's IP address hits your server logs, or the moment a tracking script fires, processing has occurred. Compliance obligations attach at that instant — before you have even read a single enquiry email.
Decision Table: Do You Need a Privacy Policy?
| Scenario | Privacy policy required? |
|---|---|
| You have a contact form | Yes |
| You use Google Analytics | Yes |
| You have a newsletter signup | Yes |
| You sell products or services online | Yes |
| You embed YouTube videos or Google Maps | Yes |
| You use Facebook Pixel, Hotjar, or any tracking script | Yes |
| You are based outside the EU but have EU visitors | Yes |
| You have a static HTML brochure with no forms, no analytics, and no cookies | Probably not |
The last row is the only meaningful exception. A genuinely static site — no JavaScript, no third-party embeds, no contact form, no cookies beyond session management — may fall below the threshold. In practice, virtually no business website meets that description.
What GDPR Says — Article 13 and 14 Obligations in Plain English
Article 13 applies when you collect personal data directly from an individual — a contact form, a signup box, a checkout. Article 14 applies when you obtain data about an individual indirectly — purchasing a list, receiving referrals, or tracking someone's behaviour across sites.
Both articles require that individuals are informed of specific facts about how their data is processed. The information must be provided at the time the data is collected (Article 13) or within a reasonable period after it is obtained indirectly, and no later than first contact with the individual (Article 14).
The GDPR is explicit that this information must be provided "in a concise, transparent, intelligible and easily accessible form, using clear and plain language." Legalese-heavy policies buried three clicks deep from your homepage do not satisfy this standard.
For the full technical breakdown of every Article 13 element, see GDPR Privacy Policy Website Requirements.
What Your Privacy Policy Must Include — 10 Mandatory Items
This is not a "nice to have" checklist. Every item below is mandatory under Articles 13 and 14 GDPR. Missing any one of them is a compliance gap:
- Identity of the data controller — your full legal name or business name, registered address, and contact email
- Contact details of the Data Protection Officer — if you are required to appoint one (most small businesses are not)
- Purposes of processing — for each type of data you collect, state specifically why you collect it
- Legal basis for each processing activity — consent (Art. 6(1)(a)), contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), or legitimate interests (Art. 6(1)(f))
- Legitimate interests — if you rely on Art. 6(1)(f), you must state what those interests are in concrete terms
- Third-party recipients — list every service that receives personal data: hosting provider, analytics platform, email provider, payment processor
- International transfers — if any data leaves the EU/EEA (e.g. US-based services), name the safeguard in place, typically Standard Contractual Clauses
- Retention periods — how long each category of data is kept, in specific timeframes, not vague language like "as long as necessary"
- Data subject rights — right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and right to object (Art. 21)
- Right to lodge a complaint — users must be told they can complain to their national Data Protection Authority
Where Your Privacy Policy Must Appear on Your Site
GDPR requires that the privacy policy is "easily accessible." Supervisory authority guidance across the EU has established clear expectations for placement. Getting the content right but placing the policy poorly is still a compliance failure.
Footer — mandatory. Every page of your website must link to the privacy policy in the footer. A link labelled "Privacy Policy" or "Privacy Notice" is expected. Burying it under "Legal" with no visible label is inadequate.
Contact forms — mandatory. Any form that collects personal data must link to the privacy policy at the point of submission, with a clear statement that the data will be processed as described. A checkbox or notice directly adjacent to the submit button is the standard implementation.
Newsletter signups — mandatory. The signup form must link to the policy and explain that the email address will be used to send the newsletter. Pre-ticked consent boxes are invalid.
Checkout and account registration — mandatory. Before completing a purchase or creating an account, users must be able to access the privacy policy and confirm they have read it. A linked "by placing this order you agree to our Privacy Policy" statement satisfies this requirement.
Cookie consent banner — required at first visit. The cookie banner must link to the privacy policy and the cookie policy before any non-essential cookies are set.
The Consequences of Not Having One
Regulators across the EU are not waiting for data breaches to act. The absence of a privacy policy is an independently enforceable violation under Article 83(5) GDPR, which covers failures of the transparency obligations in Articles 13 and 14.
| Violation tier | Maximum penalty |
|---|---|
| Transparency violations (Arts. 13–14) | €20 million or 4% of global annual turnover |
| Administrative failures (Art. 83(4)) | €10 million or 2% of global annual turnover |
In practice, regulators follow an escalating response for first offences: a formal warning, a correction order with a deadline, then fines if the deadline is not met. But the enforcement record shows that warnings are not always the first step — particularly where the violation is clear-cut, the business had been operating for some time, or the complaint came from a consumer organisation rather than an individual.
For documented cases of real fines levied against businesses of all sizes, including the Belgian startup case and several others affecting freelancers and micro-businesses, see GDPR Fines Examples.
Beyond regulatory risk, the reputational cost matters. A visitor who searches for your privacy policy and finds none is far more likely to abandon a purchase, flag your site to a consumer protection body, or leave a negative review than one who finds a clear, professional policy page.
How to Create a Compliant Privacy Policy Quickly
The barrier to compliance is not legal complexity — it is knowing which questions to ask about your own data processing. Most website owners have not thought through every analytics script, third-party plugin, and form on their site from a data flow perspective.
A structured generator forces you through those questions systematically. For each tool you use, you specify what data it collects, where that data goes, and what legal basis you rely on. The output reflects your actual processing activities rather than a generic description that could apply to any website.
The result is a document that satisfies the Article 13 specificity requirement — not because it uses legal language, but because it accurately describes what you do.
Use the GDPR Privacy Policy Generator to generate a policy tailored to your website in under five minutes. It covers all 10 mandatory Article 13 elements, handles international transfer disclosures for common US-based services, and produces a publication-ready document in plain English.
Sources: EU Regulation 2016/679 (GDPR); Belgian Data Protection Authority (APD/GBA) enforcement register; EDPB Guidelines 2/2022 on Article 60; national supervisory authority guidance on privacy policy placement.