This page is engineering guidance, not legal advice. For anything beyond a simple site, have the privacy notice and processing reviewed by a qualified professional.
Collect less
Section titled “Collect less”- Collect only the personal data a feature needs; write the purpose next to each field in the spec.
- Prefer aggregate or anonymous analytics. Do not send personal data (names, emails, phone numbers, IDs) in analytics events or URLs.
Consent and notice
Section titled “Consent and notice”- A plain-language privacy notice explains what is collected, why, for how long, who processes it, and how to exercise rights.
- Where consent is the legal basis (for example non-essential cookies or analytics in the EU/UK), ask before collecting, make declining as easy as accepting, and remember the choice.
- Load non-essential trackers only after consent where consent is required.
Retention and deletion
Section titled “Retention and deletion”- Each personal-data store has a retention period and an automated deletion or anonymisation job.
- Users can request access, correction and deletion; there is a documented process that covers backups and third-party processors.
Processors
Section titled “Processors”- List every third party that receives personal data (hosting, email, analytics, payments, LLM providers) and keep the list current.
Security of personal data
Section titled “Security of personal data”- Encrypt in transit and at rest; restrict access by role; log access to sensitive data.
- Have a written breach response: who decides, who is notified, within what time.
Children
Section titled “Children”- If the product may be used by people under 18, apply the stricter rules your jurisdictions require (for example verifiable parental consent) before launch.
Jurisdiction pointers (verify current status before relying on these)
Section titled “Jurisdiction pointers (verify current status before relying on these)”- India — Digital Personal Data Protection Act, 2023 (DPDP). Consent-based processing with notice, purpose limitation, rights to access, correction and erasure, breach reporting, and extra obligations for children’s data. Implementing rules were notified with phased timelines; check the current official text from MeitY before launch.
- EU / UK — GDPR / UK GDPR. Lawful basis for each purpose, consent for non-essential cookies under ePrivacy rules, data subject rights, records of processing, and breach notification within 72 hours to the regulator where required.
- Other regions: check the laws where your users are, not only where you are.
Checklist
Section titled “Checklist”- Purpose written for each personal-data field
- Privacy notice published and linked in the footer
- Consent before non-essential tracking where required
- Retention periods and deletion jobs
- Processor list current
- Breach response written