Legal & Compliance

GDPR Privacy Notice Requirements for Websites

A privacy-policy link is not enough by itself. GDPR transparency concerns whether the person can understand the actual processing at the time their data is collected.

Article 13 information

Depending on the facts, a notice should explain the controller and contact details, data-protection officer, purposes and legal bases, legitimate interests, recipients, international transfers and safeguards, retention periods, data-subject rights, consent withdrawal, supervisory-authority complaints, whether data is required, and automated decision-making.

Article 12 requires this information to be concise, transparent, intelligible, easily accessible, and in clear and plain language. That is why AllyProof searches semantically across languages rather than requiring a link literally named “Privacy Policy” or “Datenschutzerklärung.”

What AllyProof checks

The scan looks for a reachable privacy notice, reads visible text, checks for selected Article 13 field groups, and compares named providers with third-party requests observed in the browser. A missing provider name is useful evidence of a possible notice/runtime mismatch, but a domain may belong to a processor described under another brand or category and therefore needs review.

How to improve the notice

Build the notice from a current data inventory, not a template alone. Map each form, cookie, SDK, embed, payment flow, and server log to its purpose, legal basis, recipients, retention, and transfer mechanism. Use layered headings, concrete names, and the language your audience can reasonably understand. Recheck the notice whenever tags or vendors change.

Official sources

• GDPR, Articles 12 and 13
• EDPB transparency guidelines under Regulation 2016/679

Common questions

Must an EU privacy notice be in English?

No universal GDPR rule requires English. Information must be concise, transparent, intelligible, easily accessible, and written in clear language for the people addressed. The appropriate language follows the actual audience and context.

Does naming Google Analytics make a privacy notice complete?

No. A notice must describe the relevant processing, purposes, legal bases, recipients, retention, transfers, and rights as applicable. Naming a tool is only one part of transparency.