Simple GDPR Statement: How to Write One for Your Website

A simple GDPR statement tells your website visitors, in plain language, what personal data you collect and why. If your site serves anyone in the European Union or European Economic Area, you need one. This guide walks through what the statement must contain, how to write it without legal jargon, and where to place it on your site.

This article is educational content, not legal advice. Privacy requirements vary by jurisdiction, business model, and the type of data you process. Consult a qualified attorney for guidance specific to your situation.

What a Simple GDPR Statement Actually Is

A GDPR statement is a concise notice that satisfies the transparency requirements in Articles 13 and 14 of the General Data Protection Regulation. It does not replace your full privacy policy. Instead, it acts as a brief, accessible summary placed where visitors actually encounter data collection, such as contact forms, newsletter signups, and checkout pages.

The purpose is straightforward: give people enough information to understand what is happening with their data before they hand it over. Regulators expect this information to be presented in clear, plain language rather than buried in dense legal text.

Think of the GDPR statement as the front door and your full privacy policy as the building behind it. The statement gets people oriented quickly, and a link takes them to the complete details when they want them.

Why Your Website Needs a Simple GDPR Statement

The GDPR applies to any organization that processes personal data of individuals in the EU or EEA. Under Article 3, this includes businesses based outside Europe if they offer goods or services to European residents or monitor their online behavior.

Transparency is one of the seven core principles listed in Article 5(1)(a) of the GDPR. Supervisory authorities have consistently treated unclear or missing privacy notices as a violation of this principle. The consequences are not theoretical.

Here are three reasons to prioritize a clear statement:

• Legal obligation. Articles 13 and 14 list specific information you must provide at the point of data collection. Omitting it is a compliance gap.
• Enforcement risk. Fines under Article 83 can reach up to 20 million EUR or 4% of annual global turnover, whichever is higher. Multiple Data Protection Authorities have issued penalties specifically for transparency failures.
• User trust. Research from Cisco and the European Commission shows that clear privacy communication increases willingness to share data and complete transactions. Visitors who understand what you do with their information are more likely to convert.

Required Elements of a Simple GDPR Statement

Article 13 of the GDPR specifies the minimum information you must disclose when collecting personal data directly from individuals. A simple GDPR statement should cover all of these, even if briefly.

Identity and Contact Details

State who is responsible for the data. Include your organization name, a contact email, and your physical address. If you have appointed a Data Protection Officer (DPO), provide their contact details as well.

Purpose and Legal Basis

Explain why you collect each type of data and which legal basis from Article 6(1) applies. The six lawful bases are:

1. Consent (the individual has given clear, affirmative agreement)
2. Contract (processing is necessary to fulfill a contract)
3. Legal obligation (required by law)
4. Vital interests (protecting someone's life)
5. Public task (exercising official authority)
6. Legitimate interests (your business interest, balanced against the individual's rights)

Most website operators rely on consent for marketing cookies and analytics, contract for order processing, and legitimate interests for fraud prevention or basic site security.

Data Categories and Recipients

List the types of personal data you collect: names, email addresses, IP addresses, cookie identifiers, payment details, or anything else relevant. Then note the categories of third parties who receive this data, such as payment processors, email service providers, or analytics platforms.

Retention Periods

State how long you keep personal data or the criteria you use to determine retention. Be specific where possible. "We retain order data for seven years to comply with tax regulations" is better than "We keep data as long as necessary."

Individual Rights

Inform people of their rights under Chapter III of the GDPR:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (Article 17)
• Right to restrict processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Right to lodge a complaint with a supervisory authority

International Transfers

If you transfer personal data outside the EEA, state the destination countries and the safeguards in place, such as Standard Contractual Clauses (SCCs) or an adequacy decision from the European Commission.

How to Write a Simple GDPR Statement Step by Step

Writing the statement does not need to be complicated. Follow these five steps to produce a clear, compliant notice.

Step 1: Map Your Data Collection Points

Before writing anything, list every place on your website where you collect personal data. Common examples include:

• Contact forms
• Newsletter signup forms
• Account registration pages
• Checkout and payment pages
• Cookie banners and tracking scripts
• Live chat widgets
• File upload forms

For each collection point, note what data is gathered, why, and which legal basis applies. This map becomes the source material for your statement.

Step 2: Draft the Core Statement

Keep the language direct and avoid legalese. A good structure follows this pattern:

"We [organization name] collect [data types] when you [action] for the purpose of [reason]. We process this data based on [legal basis]. Your data is shared with [categories of recipients] and retained for [period]. You can exercise your rights by contacting [email/link]."

Three to five sentences can cover the essentials for a single collection point. Link to your full privacy policy for additional detail.

Step 3: Tailor for Each Collection Point

The statement on your newsletter signup form will differ from the one on your checkout page. The newsletter form might reference consent as the legal basis and mention your email marketing provider. The checkout page would reference contractual necessity and mention your payment processor.

You do not need entirely separate documents. A core template with swappable sections for purpose, legal basis, and recipients works well.

Step 4: Add a Link to Your Full Privacy Policy

Every simple GDPR statement should link to your complete privacy policy. The privacy policy generator can help you produce a full document that covers all GDPR requirements, including detailed sections on cookies, international transfers, and individual rights.

Step 5: Review and Test

Read the statement from a visitor's perspective. Can a non-expert understand it? Does it answer the basic questions: who, what, why, how long, and what can I do about it? Have someone outside your team read it and flag anything confusing.

Where to Place Your GDPR Statement on Your Site

Placement matters as much as content. Regulators expect transparency at the moment of collection, not hidden several clicks away.

• Forms. Place a short statement directly below or adjacent to every form that collects personal data. Include a checkbox for consent where consent is the legal basis.
• Cookie banners. Your cookie consent banner should summarize what cookies you use and why, with a link to your full cookie policy. Under the GDPR, non-essential cookies require prior consent.
• Footer. Link to your full privacy policy from every page footer. This is standard practice and expected by both users and regulators.
• Checkout pages. Repeat the statement near the payment step. Reference your terms of service as well, since contractual legal basis often applies here.
• Account creation. Include the statement in the registration flow before the user submits their details.

Common Mistakes to Avoid in a GDPR Statement

Even well-intentioned businesses make errors that undermine their compliance. Watch for these pitfalls.

Vague Language About Purpose

"We use your data to improve our services" is too broad. Specify what improvement means: personalizing content recommendations, analyzing site performance, or training internal models. Each purpose should be distinct and identifiable.

Missing Legal Basis

Stating the purpose without identifying the legal basis is incomplete. Every processing activity needs a lawful basis from Article 6(1). If you rely on legitimate interests, you must also describe what those interests are and how you balanced them against the individual's rights.

Bundled Consent

Do not force visitors to accept marketing emails as a condition of completing a purchase. Article 7(4) of the GDPR requires that consent be freely given, and bundling unrelated processing activities into a single consent mechanism violates this principle.

Outdated Information

Your GDPR statement should reflect your current data practices. If you switch analytics providers, add a new payment processor, or start using a live chat tool, update your statement accordingly. Tools like TermsBox can help by automatically scanning your site for trackers and cookies, then flagging when your published documents need updates.

No Contact Mechanism for Rights Requests

Tell people exactly how to exercise their rights. A dedicated email address (such as [email protected]) or a web form is sufficient. Simply saying "contact us" without providing a specific channel is inadequate.

Simple GDPR Statement Examples by Use Case

Newsletter Signup

"We collect your email address to send you our weekly newsletter. We process this data based on your consent, which you can withdraw at any time by clicking the unsubscribe link in any email. We use [email provider] to deliver newsletters. Your email is retained until you unsubscribe. Read our full privacy policy [link]."

Contact Form

"We collect your name, email address, and message to respond to your inquiry. We process this data based on our legitimate interest in handling customer communications. Your data is retained for 12 months after your last interaction. You have the right to request access, correction, or deletion of your data by emailing [email protected]. Read our full privacy policy [link]."

E-commerce Checkout

"We collect your name, shipping address, and payment details to process your order. This processing is necessary for the performance of our contract with you. We share payment data with [payment processor] to complete the transaction. Order records are retained for seven years to comply with tax obligations. Read our full privacy policy [link]."

These examples cover the core requirements: identity, data types, purpose, legal basis, recipients, retention, rights, and a link to the full policy.

How to Keep Your GDPR Statement Current

Writing the statement once is not enough. The GDPR requires that information provided to data subjects remains accurate and up to date. Here is a practical maintenance approach.

• Schedule quarterly reviews. Check whether your data collection practices, vendors, or purposes have changed since the last review.
• Monitor vendor changes. When you add or remove a third-party tool, update the recipients section of your statement and your full privacy policy.
• Track regulatory guidance. Data Protection Authorities issue updated guidance regularly. The European Data Protection Board (EDPB) publishes guidelines that can affect how you describe legal bases, transfers, or consent mechanisms.
• Use automated scanning. Compliance platforms like TermsBox scan your website for cookies and trackers, then alert you when your published documents no longer match your actual data practices. This catches gaps that manual reviews miss.
• Version your documents. Keep a record of previous versions with dates. If a supervisory authority asks when a change was made, you can demonstrate a clear history.

Frequently Asked Questions

What is a simple GDPR statement?

A simple GDPR statement is a short, plain-language notice that explains who collects personal data, why it is collected, what legal basis applies, and how individuals can exercise their rights under the General Data Protection Regulation.

Is a GDPR statement the same as a privacy policy?

Not exactly. A GDPR statement is typically a shorter summary placed near data collection points like forms or checkout pages. A privacy policy is the full legal document covering all processing activities. Both are required under Articles 13 and 14 of the GDPR.

Do I need a GDPR statement if my business is outside the EU?

Yes, if you offer goods or services to people in the EU or EEA, or if you monitor the behavior of individuals in those regions. Article 3 of the GDPR gives the regulation extraterritorial reach regardless of where your business is based.

What happens if I do not have a GDPR statement on my website?

Failing to provide transparent information about data processing can result in enforcement action by supervisory authorities. Penalties under Article 83 of the GDPR can reach up to 20 million EUR or 4% of annual global turnover, whichever is higher.