.svg){kind=logo}
Your cookie banner says "we use cookies to improve your experience." The policy page it links to says "last updated 2021." Then a prospect's security reviewer opens browser dev tools on your signup page, clears storage, reloads, and counts nine third-party requests that appear in neither place.
That gap is the problem a cookie policy template exists to close, and it only closes if the template is filled in from what your pages actually load.
A cookie policy template is a fill-in outline of the public notice that tells visitors which cookies and similar trackers your site sets, why, who sets them, how long they last, and how to refuse them. It is only as good as the audit behind it, because a policy describing cookies you no longer use, or missing ones you do, is worse than a short one that is true.
Quick answer
A SaaS cookie policy needs ten clauses: who you are, what cookies are, why you use them, the categories, the cookie list, first and third parties, durations, how to manage or withdraw consent, user rights, and changes with an effective date. The consent rule in one line: non-essential cookies need prior opt-in consent in the EU, while California works on opt-out. The UK sits close to the EU model, with new exceptions since February 2026. Hand a buyer the live policy, a list of third-party scripts, and a one-line answer on how consent is stored.
A template is a starting point, not legal advice. Plan on counsel reading the final version before you publish it.
By the end of this guide you will have a clause-by-clause checklist, a five-step audit that produces a filled cookie table, sample wording you can adapt, a free ungated PDF, and a way to keep the policy true as the product changes.
Here's what I'll cover:
- What a cookie policy template is, and how it differs from your privacy policy and your cookie banner
- What the ePrivacy rule, GDPR, CCPA and UK PECR actually require
- The ten clauses every SaaS cookie policy needs
- A five-step audit and a filled example cookie table
- Sample clauses and a free PDF you can download
- What to hand a buyer, and the mistakes that cause most of the damage
What Is a Cookie Policy Template, and Where Does It Sit Next to Your Other Documents?
A cookie policy template is a structured draft of the document you publish about cookies, with the clauses laid out and the company-specific facts left for you to fill in. "Cookies" is shorthand. The same duties cover local storage, tracking pixels, SDK identifiers and fingerprinting, so a good template uses the wider phrase "cookies and similar technologies."
The cookie policy is the promise to the public. The template is the scaffold, and the audit is what makes the promise true.
Quick take
Cookies are the tracking mechanism, and the policy is the notice about them. If your site sets any cookie or similar identifier, the notice has to exist and has to match what loads.
Cookie Policy vs Privacy Policy: Which One Do You Need?
Both are customer-facing, and neither is the internal policy your auditor asks about. A cookie policy covers the trackers your site and product place on a device. A privacy policy covers all personal data you collect and what happens to it. ComplyJet's information security policy guide covers a third document, the internal policy that tells your own staff how to protect systems and data. They share vocabulary and nothing else.
Do you need a separate cookie policy? The law requires that the information is given and easy to reach. It does not require a separate page. Many companies keep a short cookie section inside the privacy policy, while a SaaS product with a dozen scripts usually keeps its own page, because the cookie list changes more often than the privacy policy does.
Cookie Banner vs Cookie Policy vs Consent Record: Three Things a Reviewer Can Ask For
Most pages blur three separate artefacts into one. A security reviewer can ask for each of them, and each fails in a different way.
| Artefact | Its job | Who sees it | What a reviewer asks | What breaks when it is missing |
|---|---|---|---|---|
| Cookie policy | Informs: lists what is set, why, by whom, for how long | Every visitor, via a link | "Send me the link and the list of third-party scripts" | Notice is missing or out of date |
| Cookie banner | Collects the choice before non-essential scripts run | Every visitor, on first visit | "Do scripts load before consent? Is refusing as easy as accepting?" | Consent is not freely given |
| Consent record | Proves what each visitor chose, and when | You, and a regulator on request | "Show me a record of a choice and the version of the policy it applied to" | You cannot demonstrate consent |
GDPR Article 7(1) is why the third row matters: where processing rests on consent, you must be able to demonstrate that the person consented.
Note
This page is the policy. The banner and the consent record are covered only as far as the policy depends on them, because the policy links to the banner's settings control and describes how choices are stored. A perfect policy next to a banner that loads ad scripts before anyone clicks is still a failed review.
Why a SaaS Product Needs More Than a Copied Cookie Policy
Do you need a cookie policy at all? In practice, yes, and three different parties are the reason.
- The law. The ePrivacy rule on storing or reading information on a device, GDPR transparency, and California's disclosure and opt-out rules all point at the same document.
- Third parties. Ad and analytics platforms put the duty on you. Google's own Analytics help page says customers need to inform users about the information being stored, and its EU User Consent policy requires customers to obtain consent for cookies where legally required.
- Enterprise buyers. A security or procurement reviewer asks for the link and then checks it against what loads.
The third one is the one that stalls deals, and it is where SaaS differs from a brochure website. A SaaS company has two cookie surfaces: the marketing site, with analytics and ad pixels, and the logged-in app, with session cookies, a CSRF token, in-app analytics and a support-chat widget. A policy copied from a generic template usually describes one of those and ignores the other.
Watch out
The exposure is rarely a missing policy. It is the distance between what the policy says and what loads. Tag managers widen that distance silently, because a marketer can add a script in minutes and nobody updates the policy.
Cookie notices also feed a broader privacy program. If you are building one, start with the GDPR framework page and see how the notice, the records and the rights process fit together.
GDPR
Building toward GDPR compliance?
A cookie notice is one piece of the program. See how ComplyJet supports GDPR as a framework, from policies to evidence.
Cookie Consent Requirements Under the ePrivacy Rule, GDPR, CCPA and UK PECR
Four legal sources set the cookie consent requirements behind most startup cookie policies. They overlap, but they do not agree on the consent model, which is why a single paragraph saying "we use cookies" is never enough.
| Rule | Who it reaches | Consent model | What the notice must say | What it does not require |
|---|---|---|---|---|
| ePrivacy Directive Art. 5(3) (EU, via national laws) | Anyone storing or reading information on a device of a user in the EU | Prior consent, with exceptions | Clear and comprehensive information, including purposes; per Planet49, duration and third-party access | Consent for transmission-only or strictly necessary storage |
| GDPR | Anyone processing personal data of people in the EU | Sets what valid consent is (Art. 4(11), 7) | Transparency duties in Art. 12 to 14 | A separate cookie page |
| CCPA / CPRA (California) | Businesses meeting its thresholds | Opt-out of sale and sharing, not prior opt-in | Disclosure of practices, the opt-out link, rights | Prior consent to set a cookie |
| UK PECR | Anyone storing or reading information on a device of a user in the UK | Prior consent, with exceptions in Schedule A1 since 5 Feb 2026 | Clear and comprehensive information about the purpose | Consent for the listed exceptions |
Quick take
One policy with region-specific sections is the common approach. Write to the strictest rule that reaches your visitors, which is usually the EU one, and add short California and UK sections for what differs.
GDPR Cookie Policy Template Elements: Prior Consent and What Users Must Be Told
The consent rule for cookies comes from Article 5(3) of the ePrivacy Directive, not from GDPR. The popular shorthand blurs this: in a May 2022 Ask HN thread on why apple.com shows no banner, one commenter wrote that "the GDPR requires permission to set tracking (advertiser) cookies." It is the common mental model, and it misses that analytics falls under the same rule.
The Directive says storing information, or gaining access to information already stored, on a user's device is only allowed if the user has given consent after being given clear and comprehensive information about the purposes. GDPR then supplies the standard for what valid consent is, through Articles 4(11) and 7.
A GDPR cookie policy template therefore has to cover two things: what the user is told and how consent is obtained. The exception is narrow. Consent is not needed for technical storage solely for transmitting a communication, or storage that is strictly necessary for the provider to deliver a service the user explicitly asked for. A login session cookie qualifies. A cookie that exists to measure your marketing does not.
Three points from case law and the text shape the template:
- Active choice only. In Planet49 (C-673/17, 1 October 2019), the Court of Justice held that a pre-ticked checkbox the user must deselect is not valid consent.
- Duration and third parties must be disclosed. The same judgment says the information given to a user includes how long the cookies operate and whether third parties may have access to them. That is why a policy needs a duration column and a third-party column, not just a purpose.
- Withdrawal is as easy as giving. GDPR Article 7(3) requires that withdrawing consent is as easy as giving it, so the policy needs a working link or control to change the choice, not an email address.
For the full set of GDPR duties around the notice, see our GDPR compliance requirements guide.
Note
As of mid-October 2026, the 2002 Directive and national laws remain the operative rules. The Commission withdrew its ePrivacy Regulation proposal in 2025, and cookie reform inside the EU's Digital Omnibus package is still being negotiated. Until a change is adopted and applies, write to the current rule, and re-read this section before you publish.
CCPA Cookie Policy Template Elements: Opt-Out, Sharing and Global Privacy Control
A CCPA cookie policy template starts from a different premise: California works on notice and opt-out. A business that sells or shares personal information, including sharing for cross-context behavioural advertising, must give people a way to opt out, usually through a "Do Not Sell or Share My Personal Information" link. Advertising cookies and pixels that pass data to ad platforms for cross-context behavioural advertising are what can bring a SaaS company under it.
Browser signals matter too.
Quick answer
Global Privacy Control is an opt-out preference signal. If you sell or share personal information, honoring it for that browser or device is not optional.
Under 11 CCR 7025, a business that sells or shares personal information must treat a compliant opt-out preference signal, such as Global Privacy Control, as a valid request to opt out of sale and sharing for that browser or device. A business that does not sell or share is not required to. The California Attorney General and the California Privacy Protection Agency both enforce the law. Our CCPA compliance guide covers the rest of the obligations.
Cookie Policy Requirements Beyond the EU: Cookie Policy Template Changes for the UK and US States
The UK follows the EU consent pattern through PECR, and it changed this year. Since 5 February 2026, a new Schedule A1 lists exceptions to the consent rule. Alongside strictly necessary storage for a requested service (including security, fraud and fault detection, and remembering selections made on a website), it allows storage for statistical purposes if every one of these holds:
- the sole purpose is statistics about how the service or website is used, with a view to improving it
- the information is not shared with anyone except to help make those improvements
- the user gets clear and comprehensive information about the purpose
- the user is given a simple, free way to object, and does not object
Advertising and marketing cookies are not on that list, so they still need consent. Other US states use opt-out signals in varying forms, so check the states where you have users before assuming California's model covers them.
What Should a Cookie Policy Include? A Website Cookie Policy Template Clause Checklist
What should a cookie policy include? Ten clauses cover what the rules above ask of a SaaS website cookie policy template. Treat the "why it exists" column as the test for whether your own wording is doing its job.
| # | Clause | Why it exists |
|---|---|---|
| 1 | Who we are and how to reach us | Controller identity and a contact point, so a complaint has somewhere to go |
| 2 | What cookies and similar technologies are | Scope: local storage, pixels and SDKs fall under the same rules |
| 3 | Why we use them | Purposes must be specific enough for consent to be informed |
| 4 | Categories | Strictly necessary, functional, analytics and marketing, each with its consent rule |
| 5 | The cookie list | The table of names, providers and purposes; the clause reviewers read first |
| 6 | First-party and third-party cookies | Planet49: users are told whether third parties may access the cookies |
| 7 | How long they last | Planet49: duration is part of the information users must receive |
| 8 | How to manage or withdraw consent | GDPR Art. 7(3): withdrawal must be as easy as giving consent |
| 9 | Your rights | Links to the privacy policy for rights and the right to complain |
| 10 | Changes and effective date | Shows the notice is maintained, and which version a visitor saw |
Pro tip
Write the "why" in plain language. "To improve your experience" tells a reader nothing. "To count how many people reach the pricing page, so we know which pages to improve" is a purpose a visitor can accept or refuse.
How to Build the Cookie Table: A Five-Step Cookie Audit for SaaS
Why does the audit come before the template? Because a template with placeholder rows becomes a liability the moment the product loads something the table does not list. I would do these five steps in order, and nothing below needs a paid tool.
Step 1: Scan the Marketing Site and the Logged-In App Separately
Treat them as two surfaces with two cookie sets. Load each in a clean browser profile, once before touching any consent control and once after accepting everything, and record what is set each time. The difference between the two runs is your non-essential list.
Try this yourself
Open dev tools on your own signup page, clear storage, reload, and do not touch the banner. Under Application, list every cookie and every local storage key. Under Network, filter to third-party domains. Anything that appears before you click is what a reviewer will see first.
Step 2: Sort Each Cookie Into a Category and a Consent Rule
Use four categories: strictly necessary, functional, analytics and marketing. For each cookie, ask what it does, who benefits, and whether the user asked for it. SaaS products produce the same borderline cases again and again:
- Login session and CSRF token: strictly necessary for the service the user asked for
- Language or theme preference: functional; the UK exceptions list remembering selections a user made, while EU regulators read the strictly necessary exemption narrowly, so keep the duration as short as the function allows and confirm with counsel
- In-app product analytics: analytics, so consent in the EU unless a regulator's narrow conditions are met
- Support-chat widget: decide by whether it runs only after the user opens the chat or loads on every page
- Ad retargeting pixel: marketing, so consent in the EU and UK, and a sale or sharing opt-out in California
Step 3: Fill the Cookie Policy Template's Cookie Table
Here is a filled example for a typical SaaS product. The rows are generic on purpose. Replace them with your own cookies, and take every duration from your vendor's documentation, not from this table.
| Cookie or tracker | Purpose | Set by | First or third party | Example duration | Category | Consent needed |
|---|---|---|---|---|---|---|
| Login session ID | Keeps you signed in during a visit | Our app | First | Session | Strictly necessary | No |
| CSRF token | Blocks forged requests to your account | Our app | First | Session | Strictly necessary | No |
| Interface preference | Remembers the language or theme you chose | Our app | First | [12 months] | Functional | Depends on duration and function |
| Product analytics ID | Counts feature usage to improve the product | Analytics provider | Third | [2 years] | Analytics | Yes in the EU; UK only if every Schedule A1 condition holds |
| Support-chat visitor ID | Recognizes a returning visitor in chat | Chat provider | Third | [270 days] | Functional | Decide per widget |
| Ad retargeting pixel | Measures ads and builds audiences | Ad platform | Third | [per platform] | Marketing | Yes in the EU and UK; opt-out in California |
Two real examples show why the duration column is not decoration:
- Google Analytics 4: Google documents the default expiry of the
_gacookie as 2 years. - Intercom Messenger: Intercom documents its session cookie at 1 week by default and its device identifier at 270 days, refreshed on each successful ping.
Those are very different lifetimes, and a policy that says "cookies last up to 12 months" is wrong for both.
Step 4: Wire the Cookie Policy Template to the Banner and the Consent Record
The policy is only credible if the mechanics behind it match. Link the policy from the banner. Add a persistent "cookie settings" control so withdrawal is as easy as acceptance. Store a consent log. In the EU and UK, block non-essential scripts until the user has agreed.
If your inventory is large, build it as a data map first. Our guide to data mapping software covers tools that discover where data flows, which helps when scripts are scattered across teams.
Step 5: Set a Re-Scan Trigger Before You Publish Your Cookie Policy Template
An audit is a photograph. Cookies change when the product does, so set the next scan before you publish the first one. Re-scan on every new script, tag-manager change, vendor swap, and release that touches client-side code. Every one of those scripts is also a vendor, and our third-party risk management policy guide covers the vendor side of the same list.
Customer Story
"It felt like having a dedicated point of contact who genuinely cared about our success, making the entire compliance process much smoother and easier to manage."
Faisal Bhat, Senior Legal Counsel at TyrAds, an ad-tech company running ISO 27001, SOC 2 and GDPR together
Cookie Policy Template for SaaS: A Free Cookie Policy Example You Can Download
The audit gives you facts. This section turns them into wording. The sample clauses below are written to be used as they stand once the bracketed facts match your product, and the PDF carries the full set.
Cookie Policy Example: Sample Clauses You Can Adapt
Sample clause 3: Why we use cookies
We use cookies and similar technologies to keep you signed in, to protect your account, to remember choices you make, to understand how our website and product are used so we can improve them, and, only if you agree, to measure and personalize our advertising.
Sample clause 6: First and third parties
Some cookies are set by us. Others are set by providers that supply services to us, such as [analytics provider] and [support-chat provider]. Those providers may be able to read the cookies they set. The cookie table below names each provider and what its cookie does.
Sample clause 8: Managing and withdrawing consent
When you first visit, we ask for your choice before we set any cookie that is not strictly necessary. You can change or withdraw your choice at any time by selecting "Cookie settings" in the footer of any page. Withdrawing consent does not affect cookies already set for strictly necessary purposes. Most browsers also let you block or delete cookies, though some parts of our service may stop working if you block strictly necessary ones.
Sample clause 10: Changes
We update this policy when we change the cookies we use, and we show the date of the latest version at the top. This version took effect on [date]. If a change requires new consent, we ask you again.
Free Template
Download the Free Cookie Policy Template (PDF)
All ten clauses with filled sample wording, a cookie table with example rows to replace, a changes log, and a one-page audit and customization checklist. A starting point, not legal advice.
Cookie Policy Placement Examples: Footer, Banner, Settings Panel and Signup Flow
Where you put the policy decides whether it counts as easy to reach. Link it from the footer of every page, from inside the banner, from the in-app settings area, and from the signup form. A plain URL that needs no login works better than a PDF behind a form, because a buyer or regulator should reach it without an account.
Can You Use a Free Cookie Policy Template as Is, or Do You Need a Cookie Policy Generator?
Not as is. A template cannot know which scripts your marketing team added last quarter, and it will include clauses that do not apply and miss ones that do. A cookie policy generator that scans your site is useful for building the list, but it does not decide your legal basis, and it does not fix a banner that loads scripts before consent.
Choose by situation:
- A handful of known cookies: a counsel-reviewed template and the manual audit above are enough
- Many scripts across several teams: a scanner earns its cost for the list, with a human deciding each category
- You need blocking and a log buyers can inspect: a consent management platform, which does a different job from the policy
I would not rank vendors here, because the right pick depends on how many scripts you run and who owns your tag manager. For a broader tool comparison, see our data privacy software guide.
Try this yourself
Ask any tool you are considering two questions. What happens when a new script arrives through my tag manager? Can I export the consent records, with the policy version each choice applied to? A good answer to both is worth more than a long feature list.
Keeping Your Cookie Policy Template Accurate: Updates, Triggers and Version History
How often should you update it? Whenever the facts change, and on a fixed cadence even when nothing seems to have. These are the triggers I would write down:
| Trigger | What to update |
|---|---|
| New analytics or ad tool | Cookie table, categories, consent rule for the new row |
| New embedded widget (chat, video, maps) | Third-party column, durations |
| Tag-manager change | Re-scan, then the table |
| Vendor swap | Remove the old provider's rows, add the new one's |
| New market | Region-specific sections (EU, UK, California) |
| Change in a cookie's duration | Duration column |
| Change of consent tool | Description of how choices are stored and withdrawn |
Keep a version log with a dated effective date, and keep prior versions. The consent record should note which version of the policy a visitor saw when they chose.
Here is what creating, approving and distributing a policy looks like inside ComplyJet. It shows the company policy workflow, not cookies, but the discipline is the same: a named owner, an approval step, and a record of who accepted which version.
Your public cookie policy needs the same ownership and review trail, even though it is published to visitors, not distributed to staff.
Note
Review cadence and consent-record retention are your own commitments. No statute sets a fixed number of years for keeping consent records, so state the period in your own policy and apply it consistently.
Cookie Policy Evidence for Buyers, SOC 2 and ISO 27701
Different readers ask for different proof of the same thing.
| Audience | What they ask | What you show |
|---|---|---|
| Enterprise security reviewer | Link to the policy, list of third-party scripts | Live cookie policy and the cookie table |
| Procurement or legal | How consent is collected and logged | Banner settings and a sample consent record |
| Regulator | Evidence consent was valid | Consent log with policy version and timestamp |
| Auditor (SOC 2, ISO 27701) | Notice and choice are operating | Policy, review history and sign-off |
What Enterprise Security Reviews Ask About Cookies and Trackers
The questions repeat: where is the cookie policy, which third-party scripts load on your site and app, how is consent collected and logged, how does a user withdraw it, and do any scripts load before consent?
Sample questionnaire answer
Our cookie policy is published at [URL] and lists every cookie and tracker, its provider, purpose and duration. Non-essential cookies load only after the visitor agrees. Choices are stored with a timestamp and the policy version, and visitors can change them from the "Cookie settings" link on every page. We re-scan after any change to client-side scripts, and at least [every six months].
Where SOC 2 and ISO 27701 Look for Notice and Consent Evidence
Notice and choice are tested through ISO 27701 for privacy information management, and through the SOC 2 Privacy category when a company includes it. Many startups begin with the Security category alone, so a cookie policy tends to come up in a buyer's questionnaire before it comes up in an audit. Our ISO 27701 guide explains how that standard treats privacy notices and consent.
Cookie Policy Template Mistakes to Avoid
These are easy to get wrong, and most are visible to anyone with dev tools.
- Treating continued browsing as consent for non-essential cookies. Consent needs an active choice, as Planet49 says about pre-ticked boxes.
- Pre-ticked boxes. A box the user must deselect is not valid consent.
- A banner that makes refusing harder than accepting. One click to accept and three to refuse is not a free choice.
- Scripts loading before consent. A policy that says "we ask first" while the network tab shows otherwise is the most common failed review.
- Calling analytics identifiers anonymous. A persistent identifier that distinguishes users is not anonymous, whatever the label says.
- A cookie table left as placeholders. Brackets in a published policy tell a reviewer nobody owns it.
- No way to withdraw consent after the first visit. Withdrawal has to be as easy as giving consent, so a settings control has to survive past the first page view.
How ComplyJet Helps You Maintain Your Cookie Policy Template
The policy is a document. Keeping it true is a process, and that is the part we help with. ComplyJet supports GDPR as a framework, with AI-assisted policy drafting, policy distribution with employee acknowledgment tracking, and evidence collection for audits. Your cookie policy sits alongside your internal policies, with the review dates and sign-offs an auditor looks for.
To be direct about scope: we do not run a cookie banner or consent platform, we do not scan your site for cookies, and we are not a legal advisor. You still own the policy text and the legal review. If you need script blocking and a consent log, pair this template with a consent tool. What we do is keep the surrounding compliance program organized and ready for audit.
Compliance Automation
Keep your policies reviewed and audit-ready
See how ComplyJet handles policy drafting, distribution and acknowledgments alongside your GDPR and audit evidence.
FAQs
Do I Need a Cookie Policy, and Is It Required by Law?
In practice, yes, if your site or product sets any cookie or similar tracker beyond what is strictly necessary. The information is what the law requires, and a policy is the usual way to give it. In the EU and UK, the cookie policy requirements are clear and comprehensive information plus prior consent for non-essential cookies. California requires disclosure and an opt-out for sale and sharing. No rule demands a separate page, and enterprise buyers ask for the link anyway.
What Is the Difference Between a Cookie Policy and a Privacy Policy?
A cookie policy covers the trackers placed on a device. A privacy policy covers all personal data you collect and what you do with it. The two should link to each other and agree. A cookie policy that contradicts the privacy policy on retention or sharing is a finding waiting to happen.
Do I Need a Separate Cookie Policy?
Not by law. The rule is that people are told and can easily find the information. A short cookie section inside the privacy policy can satisfy it. A SaaS product with many scripts usually benefits from its own page, because the cookie list changes more often than the privacy policy does.
What Is the Difference Between a Cookie Policy and a Cookie Banner?
In the cookie banner vs cookie policy question, the policy informs and the banner collects the choice. The policy lists what is set and why. The banner asks before non-essential cookies run and gives the user a way to refuse. A third item, the consent record, proves what each visitor chose. A reviewer can ask for all three separately.
Do I Need Consent for Google Analytics Cookies?
In the EU, usually yes, because analytics is not strictly necessary for the service a user requested under Article 5(3). France's CNIL allows a narrow consent exemption for tightly configured audience measurement, with conditions including a 13-month tracker lifetime. In the UK, since 5 February 2026, an exception exists if every Schedule A1 condition holds. Whether a given analytics setup meets them depends on how the provider may use the data.
Can I Use a Free Cookie Policy Template as Is?
It is a good start and not a finish. A template cannot know your tools, your durations or your regions, so it will include clauses that do not apply and miss facts that do. Fill it from your own audit and have counsel review it before you publish.
How Often Should I Update My Cookie Policy?
Update it whenever you add, remove or change a cookie, script or consent tool, and review it on a fixed schedule you set, such as every six months. The cadence is your own commitment. Ask counsel whether a rule in your jurisdiction sets a minimum.
Where Should I Put My Cookie Policy?
Link it from the footer of every page, from the banner, from in-app settings and from the signup form. Keep it a plain page that does not sit behind a login, so a buyer or regulator can reach it without an account.
Related Reading
- GDPR Compliance Requirements: the full obligations behind the notice
- CCPA Compliance Guide: what California law requires beyond the cookie disclosure
- GDPR Compliance: the wider GDPR program
- Best Data Privacy Software: tools for privacy and consent programs
- Data Retention Policy: how long to keep records, including consent records
- Information Security Policy: the internal counterpart to this public document
