SaaS privacy policy template

This page lists what two laws ask a SaaS privacy policy to say and gives a free excerpt of template wording.

What GDPR Article 13 asks for

Source: Regulation (EU) 2016/679 (GDPR), Article 13, on EUR-Lex, read 2026-10-12 through a search-result summary of the text. The direct fetch returned no text, so verify this list against the official article.

Give the information at the time the data is collected from the person.
Controller identity and contact details; data protection officer contact details where there is one.
Purposes and legal basis of processing; legitimate interests if relied on.
Recipients; international transfers and safeguards.
Retention period or the criteria for it.
Rights: access, rectification, erasure, restriction, objection, portability, withdrawal of consent, complaint to an authority.
Whether providing the data is required and the consequences of not providing it; automated decision-making.
Concise, transparent, intelligible, plain language (Article 12).

What the California CCPA asks for

Source: California Attorney General, California Consumer Privacy Act page, read 2026-10-12. The page noted some rules as pending, so check for updates.

It applies to for-profit businesses doing business in California that meet a threshold (revenue over 25 million USD, personal information of 100,000 or more residents or households, or 50 percent or more of revenue from selling personal information). Check whether it applies to you.
Notice at collection, at or before collection: categories of personal information and purposes, a "Do Not Sell or Share" link if applicable, and a link to the privacy policy.
Privacy policy: practices, rights (know, delete, opt out, correct, limit, non-discrimination) and how to use them.
Respond to know, delete and correct requests within 45 calendar days.

Free excerpt from the template

Four complete clauses, copyable as plain text. Replace every [[FIELD]].

1. Data we collect

[[DATA_COLLECTED_LIST]]

2. Why we use it and on what basis

Purposes: [[PURPOSES_LIST]]

We do not sell your personal data.

3. Who receives it

We share data with these service providers and other recipients: [[THIRD_PARTIES_LIST]]

We may also disclose data when the law requires it or to protect our rights, and in a merger or sale of the business.

4. Your rights

Depending on where you live, you can ask to access, correct, delete, restrict or export your data, object to processing, withdraw consent and complain to your data protection authority. To use these rights, [[DELETION_METHOD]] We answer within the time the law sets (for example one month under the GDPR and 45 calendar days under California law).

Only keep "We do not sell your personal data" if it is true for your service.

Fill-in checklist

Name the controller, an address and a contact for privacy requests.
List each data type, its purpose and, for users in the EEA or UK, its legal basis.
List every service provider that receives data, including analytics, email and payments.
If data leaves the user's region, name the transfer safeguard you rely on.
Set a retention period for each data type.
Describe how a person asks for access or deletion, and make sure you can answer in time.

The full editable pack (7 templates in Markdown, PDF and HTML) is being prepared.