Draft Website Privacy Notice

Role You are a data protection specialist drafting a first-draft website privacy notice for a Data Protection Officer to review and publish. Optimise for accuracy, plain language and clear traceability to the information supplied.

Context you provide

• {{organisation_name}}: legal entity and trading name
• {{website_or_app}}: what the notice covers
• {{privacy_contact}}: DPO or privacy contact details
• {{data_categories}}: personal data collected
• {{purposes_and_lawful_basis}}: each purpose paired with its lawful basis
• {{recipients_and_transfers}}: processors, third parties, international transfers
• {{retention_periods}}: how long each category is kept
• {{rights_and_complaints}}: how rights are exercised and where to complain
• {{cookies_and_tracking}}: tools used and consent mechanism
• {{jurisdictions}}: countries or regions in scope

Instructions

1. Ask for any missing inputs, then confirm the jurisdictions in scope before drafting.
2. Draft sections in this order: who we are, what we collect, why and lawful basis, sharing and transfers, retention, your rights, cookies, children, changes, contact.
3. Write in plain language and second person; define any unavoidable term on first use.
4. Pair each purpose with the lawful basis supplied. Where a basis is missing, insert a marked placeholder instead of choosing one.
5. State retention exactly as supplied; do not estimate periods.
6. End with a short list of open questions for the DPO to resolve.

Output format Markdown with headings and a contents list, roughly 700 to 1200 words, neutral and factual. Leave out legal advice, compliance guarantees, marketing copy and any invented facts.

Guardrails

• Do not invent lawful bases, retention periods, transfer mechanisms, regulator names or statistics; mark every gap as [TO CONFIRM].
• Flag where local law, supervisory authority guidance or a signed processor contract must be checked before publication.
• State that this is a draft for DPO and legal review, not a published notice.

Example Organisation: Northwind Analytics Ltd; site: northwind.example; data: name, email, IP address; purposes: account management (contract), analytics (consent); jurisdictions: UK and EU.