Quick Answer
Under the GDPR, a public privacy notice (sometimes called a privacy policy or privacy statement) informs data subjects how their personal data is processed and is legally required under Articles 12–14. An internal data protection policy guides employees in handling personal data compliantly and is required under Article 24(2) where proportionate to processing activities. Both documents are mandatory for most organisations processing EU personal data, but they serve different audiences, have different content, and carry different consequences if neglected.
Introduction: Why Mixing These Up Costs You
Mixing up your public privacy notice with your internal data protection policy is one of the most common GDPR compliance mistakes we see — and it cuts both ways. Too much internal detail in your public privacy statement, and you’ve made it unreadable and possibly exposed sensitive operational information. Too little policy guidance internally, and your staff are improvising with personal data, which is exactly what supervisory authorities investigate after a breach.
The General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR“) demands both documents, but they exist for very different reasons and very different audiences. Get the split right, and you protect both your users and your organisation. Get it wrong, and you risk fines of up to 4% of global annual turnover.
At Kiroptera Consulting, we help businesses across the digital economy — e-commerce sellers, SaaS providers, Web3 projects, and AI ventures — craft clear public privacy notices and robust internal data protection policies that work together without overlap. In this guide, we’ll walk you through the legal differences, what each document must contain, who must implement them, and the practical mistakes to avoid.
Public Privacy Notice: Transparency for Data Subjects
What exactly falls under the EU Consumer Rights Directive? This framework casts a wide net to cover common shopping situations, but it smartly avoids overlap with other laws. At its core, the directive applies to sales contracts for tangible goods—like a new smartphone or pair of shoes—and service contracts for things like home repairs or gym memberships. As defined in Article 2(5) of the Directive sales contract means any contract under which the trader transfers or undertakes to transfer ownership of goods to the consumer, including any contract having as its object both goods and services.
It focuses on transactions between consumers (private individuals buying for personal use) and traders (professional sellers). This includes online shopping (distance contracts) and sales away from a store (off-premises contracts), such as at your doorstep or a pop-up event. Even utilities like electricity or gas qualify if supplied via contract.
However, the directive skips certain areas to prevent redundancy. Big exclusions include real estate purchases, financial services like loans, gambling, healthcare, and social services. Passenger transport gets partial coverage, mainly on information and fees. Why these carve-outs? They align with specialized EU laws, ensuring focused protections elsewhere. For instance, package holidays fall under Directive (EU) 2015/2302.
In essence, if you’re an everyday buyer dealing with a business for non-work items, the Directive 2011/83/EU overview shows these rules likely apply, fostering a safer marketplace. Member states can exempt minor off-premises deals under €50, adding flexibility. This scope promotes full harmonisation, as per Article 4, where EU-wide standards minimize confusion for cross-border shoppers.
A public privacy notice (often informally called a “privacy policy” or “privacy statement”) is the external-facing document that informs individuals — referred to in the GDPR as “data subjects” (Article 4(1)) — how an organisation collects, uses, shares, retains, and protects their personal data.
Its legal foundation sits in Articles 12, 13, and 14 GDPR, which together establish the transparency principle and define the specific information that must be communicated to data subjects — whether the data is collected directly from them (Article 13) or obtained indirectly (Article 14). Article 12 then dictates how that information must be delivered: in a “concise, transparent, intelligible and easily accessible form, using clear and plain language.”
What Must a GDPR Privacy Notice Contain?
A GDPR-compliant public privacy notice must disclose, at minimum:
- The identity and contact details of the controller (and, where applicable, the controller’s EU representative under Article 27);
- The contact details of the Data Protection Officer (DPO), where one has been appointed under Article 37;
- The purposes of processing and the legal basis under Article 6 (and, for special category data, Article 9);
- Where the legal basis is legitimate interests, the legitimate interests pursued by the controller or a third party;
- The recipients or categories of recipients of the personal data;
- Details of any international data transfers outside the EEA and the safeguards relied upon (Articles 44–49);
- The retention period or the criteria used to determine it;
- The data subject rights under Articles 15–22 (access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making);
- The right to withdraw consent at any time under Article 7(3) (where consent is the legal basis);
- The right to lodge a complaint with a supervisory authority under Article 77 (in Slovenia, the Information Commissioner – Informacijski pooblaščenec);
- Whether the provision of data is a statutory or contractual requirement and the consequences of failure to provide it;
- The existence of any automated decision-making, including profiling, and meaningful information about the logic involved.
Purpose: Empowering Users and Building Trust
The public privacy notice exists to empower data subjects and build trust. It transforms abstract legal obligations into something users can actually read, understand, and act on. It is also the first thing regulators inspect during any complaint or investigation — making it both a legal requirement and a critical trust signal.
Practical Drafting Tips for a GDPR Privacy Statement
- Keep it concise: use clear headings, short paragraphs, and bullet points.
- Make it prominently accessible from every page of your website (typically via a footer link).
- Use plain language — avoid legalese wherever possible.
- Update it whenever your processing practices change, and date each version.
- Consider layered notices (a short summary linking to a fuller version), which the European Data Protection Board (EDPB) expressly endorses in its transparency guidelines (WP260 rev.01).
- Use just-in-time notices at the point of collection for context-specific processing (e.g., when a user submits a form).
Internal Data Protection Policy: Guidance for Your Team
An internal data protection policy is a very different document. It’s an organisational rulebook, intended for employees, contractors, and anyone processing personal data on the organisation’s behalf. It tells your team how to handle personal data compliantly in day-to-day operations.
Its legal foundation lies in Article 24 GDPR, which requires controllers to “implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation.” Crucially, Article 24(2) specifies that “where proportionate in relation to processing activities, those measures shall include the implementation of appropriate data protection policies by the controller.”
Internal data protection policies also operationalise the accountability principle in Article 5(2) — the obligation not just to comply, but to demonstrate compliance — and connect directly to the records of processing activities required under Article 30.
What Should an Internal GDPR Policy Cover?
While there is no statutory checklist (unlike Articles 13/14 for public notices), a well-drafted internal data protection policy typically addresses:
- Roles and responsibilities — including the DPO (where appointed), department heads, IT, HR, and individual staff;
- Lawful basis assessment procedures — how staff determine and document the Article 6/9 legal basis before any processing begins;
- Data minimisation and purpose limitation practices in operational terms;
- Security measures under Article 32 — encryption, access controls, password policies, device management, MFA;
- Personal data breach handling, including internal escalation paths and the 72-hour notification timeline to the supervisory authority under Article 33;
- Data subject rights request procedures — how to log, verify, and respond within the one-month deadline under Article 12(3);
- Vendor and processor management, including Article 28 data processing agreements;
- Records of processing activities under Article 30 and how they are maintained;
- Data Protection Impact Assessment (DPIA) procedures for high-risk processing under Article 35;
- International transfer protocols, including SCC implementation and Transfer Impact Assessments;
- Training requirements and frequency;
- Disciplinary consequences for non-compliance.
Purpose: Preventing Mistakes and Proving Compliance
The internal data protection policy prevents operational mistakes, gives staff a clear rulebook, and — importantly — provides documentary evidence to supervisory authorities that the organisation has taken its accountability obligations seriously. In an investigation or audit, this document is almost always one of the first things regulators ask to see.
Best Practices for Internal Policies
- Run regular, documented staff training sessions;
- Define clear responsibilities for each role that touches personal data;
- Integrate the policy with HR onboarding, IT acceptable-use policies, and incident response plans;
- Build in periodic review cycles (at least annually, or whenever processing activities change materially).
Key Differences Between a Public Privacy Notice and an Internal Data Protection Policy
So, what really distinguishes these two documents under the GDPR? Three dimensions matter most:
1. Audience
The public privacy notice speaks to data subjects — customers, website visitors, job applicants, and anyone else whose data you process. The internal data protection policy speaks to your own staff, contractors, and processors.
2. Objective
The public privacy notice aims to inform and empower data subjects, fulfilling the transparency principle and enabling individuals to exercise their rights under Articles 15–22. The internal data protection policy aims to enforce compliance internally and manage operational risk.
3. Content Depth and Format
The public privacy notice provides plain-language summaries of your data practices — what, why, how long, with whom shared, and what rights apply. The internal data protection policy provides detailed procedural instructions — workflows, escalation paths, technical safeguards, vendor lists, and disciplinary measures.
Why Keep Them Separate?
Two practical reasons:
First, internal procedures are often confidential. Security protocols, vendor lists, escalation chains, and audit logs are not something you want publicly indexed. Disclosing internal controls can actually increase security risk by giving threat actors a roadmap.
Second, combining them would breach the transparency principle. A sixty-page hybrid document mixing user-facing information with operational protocols would violate Article 12’s “concise, transparent, intelligible and easily accessible” standard. Data subjects need a clean, readable notice — not your operations manual.
Who Needs Each Document? Territorial Scope and Applicability
Under Article 3 GDPR (territorial scope), both documents are required by any organisation that:
- Is established in the EU and processes personal data (regardless of where the processing physically occurs); or
- Offers goods or services to data subjects in the EU (paid or free); or
- Monitors the behaviour of data subjects in the EU (including via cookies, analytics, or tracking pixels).
This captures the vast majority of digital businesses worldwide — including non-EU e-commerce sellers shipping to Europe, SaaS providers with EU users, and Web3 projects whose tokens or services reach EU residents.
Both controllers (Article 4(7)) and processors (Article 4(8)) have obligations here, though the scope differs. Controllers bear the primary burden under Article 24, while processors have parallel obligations under Articles 28 and 32 and must maintain their own internal policies and records.
Consequences of Non-Compliance: GDPR Fines Explained
The GDPR’s enforcement regime is, frankly, severe — and supervisory authorities across the EU have become increasingly assertive in 2024 and 2025.
Higher tier fines (Article 83(5)) — up to €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher — apply to violations including:
- The basic principles for processing (Article 5), including transparency;
- The lawfulness of processing and conditions for consent (Articles 6, 7, 9);
- Data subjects’ rights (Articles 12–22) — which captures most public privacy notice failures;
- International transfer rules (Articles 44–49).
Lower tier fines (Article 83(4)) — up to €10 million or 2% of worldwide annual turnover, whichever is higher — apply to violations including:
- Records of processing under Article 30;
- Breach notification obligations under Article 33;
- DPIA obligations under Article 35;
- DPO-related obligations under Articles 37–39;
- Processor obligations under Article 28.
Failures to implement appropriate technical and organisational measures (Article 24) are often prosecuted via the accountability principle (Article 5(2)), placing them in the higher tier — so don’t assume internal policy failures attract only minor fines.
Beyond the financial penalties, organisations face reputational damage, remediation costs, regulatory investigation disruption, and — increasingly — civil claims from affected data subjects under Article 82.
Common GDPR Privacy Policy Mistakes We See in Practice
In our consulting work, certain mistakes appear again and again. Avoid these:
1. Treating cookie consent as covering all data processing. Cookie banners satisfy the ePrivacy Directive (and the upcoming ePrivacy Regulation), not the entirety of GDPR. You still need a full public privacy notice.
2. Using generic templates without legal basis assessment. A privacy notice that says “we process your data based on consent and legitimate interests” without specifying which processing operation relies on which basis is non-compliant under Article 13(1)(c).
3. Missing retention periods. Saying “we keep your data for as long as necessary” without further specificity fails Article 13(2)(a). You must state the period, or the criteria used to determine it.
4. Omitting the right to lodge a complaint. This is one of the most commonly missed requirements (Article 13(2)(d)).
5. Failing to update after material changes. A privacy notice from 2019 referencing pre-Schrems II transfer mechanisms is a red flag for any auditor.
6. Confusing controller and processor roles. This affects both your notice and your internal policy. If you’re a controller, say so. If you’re a processor for some activities and a controller for others, document it clearly.
7. Having an internal policy that no one has read. Article 24 compliance requires not just having a policy, but implementing it. Untrained staff means an unimplemented policy.
8. No documented DPIA for high-risk processing. Especially common in AI, profiling, and large-scale data scraping scenarios.
Sector-Specific Considerations
GDPR applies universally, but certain sectors face heightened scrutiny:
E-commerce and international sales of goods — Marketplaces like Amazon impose additional contractual privacy requirements beyond GDPR baseline. Dropshipping operations often involve complex controller/processor chains that must be reflected in both public notices and internal policies.
SaaS and AI ventures — The interaction between GDPR and the EU AI Act (Regulation (EU) 2024/1689) creates additional obligations, particularly around automated decision-making transparency (Article 22 GDPR + AI Act transparency requirements). Internal policies should now address AI governance specifically.
Crypto and Web3 (including Solana ecosystem projects) — The intersection of GDPR with public blockchain immutability remains legally contested. Privacy notices for Web3 projects must address on-chain data realistically, while MiCA (Regulation (EU) 2023/1114) now adds an additional compliance layer for crypto-asset service providers.
Conclusion: Two Documents, One Compliance Foundation
The GDPR’s split between public privacy notices and internal data protection policies isn’t bureaucratic duplication — it’s a deliberate design balancing external transparency to data subjects with internal accountability to regulators. One without the other leaves you exposed, either to users who don’t trust you or to regulators who can’t see that you’ve operationalised compliance.
In a digital economy where personal data is increasingly treated as currency, getting this balance right isn’t just legal hygiene. It’s a competitive advantage, a trust signal, and an ethical commitment to the people whose information you’ve been entrusted with.
If you’re unsure whether your current GDPR documentation hits the mark — or you’d like a second pair of eyes from a team that handles this every day — feel free to book a free 30-minute consultation at cal.com/kiroptera/30min. We’re happy to help.
Frequently Asked Questions
Is a privacy policy the same as a privacy notice under GDPR?
In common usage, the terms are often used interchangeably. The GDPR itself doesn’t use the phrase “privacy policy” — Articles 13 and 14 refer to providing “information” to data subjects. Strictly speaking, a “privacy notice” is the document that informs data subjects (what GDPR requires), while a “privacy policy” can refer either to the same external document or to an internal policy. Clarity in your own usage matters more than the label.
Do small businesses need an internal data protection policy under GDPR?
Article 24(2) requires data protection policies “where proportionate in relation to processing activities.” A small business processing minimal personal data may need only a lightweight policy, but the obligation to implement appropriate measures under Article 24(1) applies regardless of size. The accountability principle (Article 5(2)) means even small businesses must be able to demonstrate compliance — and a written policy is the simplest way to do that.
What happens if my GDPR privacy notice is not compliant?
Non-compliant public privacy notices fall under Article 83(5) — the higher fine tier — with potential penalties of up to €20 million or 4% of global annual turnover, whichever is higher. Beyond fines, supervisory authorities can issue corrective orders, temporary or definitive processing bans, and require you to notify affected data subjects.
Does a GDPR privacy notice need to be on every page of my website?
GDPR doesn’t mandate placement on every page, but Article 12(1) requires the information to be “easily accessible.” The widely accepted standard — endorsed by EDPB guidelines and supervisory authority decisions — is a clearly visible link in the website footer accessible from every page, plus just-in-time notices at points of data collection.
Who must appoint a Data Protection Officer under GDPR?
Under Article 37(1), DPO appointment is mandatory for: (a) public authorities; (b) controllers or processors whose core activities consist of regular and systematic monitoring of data subjects on a large scale; or (c) controllers or processors whose core activities consist of large-scale processing of special category data (Article 9) or criminal conviction data (Article 10). Many organisations also appoint DPOs voluntarily for the credibility and structure it provides.
Can I use a privacy notice template I found online?
Templates can be a starting point, but generic templates frequently miss organisation-specific requirements — particularly around legal basis specification, retention periods, processor relationships, and international transfers. We strongly recommend legal review before publishing any template-based privacy notice.
