The short answer is: almost certainly yes. If your website collects any personal data — and almost every website does — you are legally required to have a privacy policy in most jurisdictions around the world.
What counts as collecting personal data
Personal data is any information that can identify a person, directly or indirectly. This is broader than most people expect. Your website likely collects personal data if it:
- Uses Google Analytics, Meta Pixel, or any analytics tool (these collect IP addresses and browsing behaviour)
- Has a contact form, newsletter sign-up, or any form that asks for a name or email
- Has a checkout or payment process
- Uses cookies or tracking pixels
- Has user accounts or a login system
- Runs a chatbot or live chat tool
Even a simple brochure site that only uses Google Analytics is collecting personal data and needs a privacy policy.
Where the legal requirement comes from
European Union (GDPR): Article 13 of the GDPR requires you to inform individuals about how you process their data at the point of collection. A privacy policy is the standard way to meet this obligation. Fines for non-compliance can reach €20 million or 4% of global annual turnover.
United Kingdom (UK GDPR): Mirrors the EU requirement. The ICO can issue fines up to £17.5 million or 4% of global turnover.
California (CCPA/CPRA): Businesses that meet certain thresholds must provide a privacy notice to California residents. Many businesses comply by providing a general privacy policy.
Canada (PIPEDA): Requires organisations to have a privacy policy that is "readily available."
Australia (Privacy Act): Businesses with over $3 million in annual turnover must have a privacy policy. Smaller businesses that handle health records or operate online are also covered.
What if I don't have one
Operating without a privacy policy when one is required exposes you to regulatory fines, complaints from users, and reputational damage. Regulators across the EU, UK, and USA have fined businesses of all sizes for failing to provide adequate privacy information — including very small companies.
Beyond regulation, many B2B customers and enterprise buyers now run vendor due diligence checks that include reviewing your privacy policy. Not having one can cost you contracts.
What your privacy policy must cover
At minimum, a compliant privacy policy should explain: what data you collect, why you collect it (the legal basis), who you share it with, how long you keep it, and how users can exercise their rights. See our article on what a privacy policy should include for a full breakdown.
Getting a privacy policy
Trust Center generates and maintains a jurisdiction-aware privacy policy for your business, served from your own subdomain via a single DNS record. It updates automatically when regulations change, so you don't need to monitor legal developments yourself.