Data Protection Law and Websites

For online businesses, such as e-commerce websites, a Privacy Policy and Cookies Policy enables businesses to comply with the information and transparency requirements of the UK GDPR by setting out in clear, plain English details of that businesses' data processing activities enabling data subjects to understand the scope and nature of how their personal data is used. 

If a website processes personal data, it will need a Privacy Policy and a Cookies Policy (if cookies are used).

When drafting a Privacy Policy, website operators should consider the following:

• What personal data is collected from data subjects, why it is collected, how it is used, and how long it is stored for;
• What legal basis (set out within the UK GDPR and the Data Protection Act 2018) the business relies upon for the processing of that personal data;
• Whether any of the personal data constitutes a special category personal data, i.e., medical history or criminal convictions, and what exemption under the UK GDPR and the Data Protection Act 2018 the business relies upon for the processing of such special category personal data;
• Whether the personal data is shared with any third parties, such as credit reference agencies or payment gateway providers;
• Whether the website is targeted (or is likely to be accessed by) children or adults who require assistance in understanding the information presented to them; 
• Whether the personal data is intended to be used for marketing purposes; and
• Whether any automated decision-making (or profiling) using the personal data will take place. 

If a business processes the personal data of children or certain special categories of personal data (sensitive personal data such as health or data relating to criminal convictions), then the UK GDPR and Data Protection Act 2018 set out additional prescriptive requirements, which must be complied with. 

Such additional requirements include satisfying the limited grounds for exemption when processing special category personal data (which should be referenced within a Privacy Policy) or ensuring that Privacy Policy is drafted in a way which is easily understandable to a child (where a child's personal data is being processed). 

Businesses should conduct a data mapping exercise to identify the personal data processed by that business, including what personal data is collected via its website, what it is used for, the legal basis for such processing, and how long the data shall be stored.

A Privacy Policy and Cookies Policy should then be drafted on an individual basis to reflect the data processing activities of that business to ensure compliance with the information and transparency requirements of the UK GDPR. 

By copying another website's policies, a business may breach its requirements under data protection law in its failure to be transparent in its data processing activities. The data processing activities of one business will not necessarily apply to another business, so a Privacy Policy must be drafted to accurately reflect a business's own data processing activities.  

Also, policies and documents set out on another business' website are protected by copyright; therefore, copying another business' policies will constitute an infringement of third party intellectual property rights.