A personal data policy: which sections it needs

A policy is not there for length. It is there so a person and your own employee understand the same thing: who collects the data, why, for how long and where to write if the person changes their mind. The requirements come from the data protection law of your country, in the EU - GDPR. The text below is not a finished policy and does not replace a lawyer. It is the list of sections without which the document drifts away from the site.

What has to match reality

• Who the operator is: a name, not "the site administration".
• Which data is actually in the forms and in correspondence, not an abstract "other set".
• Why each field exists. If the purpose cannot be named, the field is better removed.
• How long you keep it and what happens next: deletion or de-identification.
• Who else sees the lead: CRM, a mail vendor, hosting. If they exist, they should be named by role.
• How to withdraw consent and how to ask a question. An address nobody reads is worse than no address.

A common break: the policy is copied from another industry and promises what you do not have, or stays silent about the CRM the form has been sending to for a year. That text is more dangerous than an empty one, because it feels as if the question is closed.

Lexora checks the policy against the live forms and access. A lawyer still has to confirm the final wording: we do not replace that person with phrases written "for the checkbox".