A 23-section master privacy policy organisations can adapt to publish a compliant, transparent notice covering data collection, lawful bases, AI-assisted processing, cross-border transfers, data subject rights and complaints handling.
Bracketed placeholders such as [Organisation Name] and [Insert Effective Date] mark the fields to complete. Download the fillable PDF (or request the source Word file) to adapt this template to your organisation before publication.
About This Template
This Master Privacy Policy template gives an organisation a complete, publication-ready structure for the notice it owes data subjects under Article 31 of the Constitution and the Data Protection Act, 2019. It runs from foundational definitions and the categories of personal data collected through to lawful bases, cookies, AI-assisted processing and automated decision-making, data sharing, cross-border transfers, security, retention, data subject rights, children's data, marketing, and the complaints pathway to the ODPC. Each clause is drafted to be adopted as-is or adapted to the organisation's actual processing activities, with bracketed placeholders marking the fields that need organisation-specific detail.
Document Control
| Template Number | MPA-DP-001 |
| Document Type | Privacy Policy |
| Version | 1.0 |
| Approved By | [Board / Management] |
| Effective Date | [Insert Effective Date] |
| Next Review Date | [Insert Review Date] |
| Policy Owner | Data Protection Officer |
| Document Classification | Public |
Contents
- Introduction
- Scope
- Definitions
- Who We Are
- Information We Collect
- Sources of Personal Data
- Purposes of Processing
- Lawful Bases for Processing
- Cookies and Similar Technologies
- AI-Assisted Processing
- Automated Decision-Making
- Data Sharing
- International Transfers
- Data Security
- Data Retention
- Your Rights
- Exercising Your Rights
- Children's Data
- Marketing Communications
- Third-Party Websites
- Changes to this Policy
- Contact Information
- Complaints
How to Use This Template
Replace every bracketed placeholder with organisation-specific detail, delete any clause that does not apply to your processing activities, and route the completed document to your Data Protection Officer or legal counsel for sign-off before it is published or put into effect. Review on a fixed cycle (at least annually, or on any material change to processing activities) and keep a version history in the Document Control table.