Notice and policy generators 📝

Most notice generators produce text and leave you to guess whether it is complete. These work the other way round. Each one is driven by a requirements matrix built from the GDPR, the AI Act, the transparency guidelines endorsed by the EDPB and the Commission's Article 50 guidelines. The privacy notice also covers the UK GDPR with the Data Protection Act 2018, the Swiss Federal Act on Data Protection, Brazil's General Data Protection Law (LGPD), Canada's PIPEDA with the Quebec, Alberta and British Columbia private-sector laws, India's Digital Personal Data Protection Act with its 2025 Rules, China's Personal Information Protection Law with the Network Data Security Management Regulations, Japan's Act on the Protection of Personal Information, South Korea's Personal Information Protection Act, Singapore's Personal Data Protection Act 2012, Australia's Privacy Act 1988, South Africa's Protection of Personal Information Act, the California Consumer Privacy Act and the consumer privacy laws of 22 other US states: tick the laws that apply, and each adds its own rules and checks. Every document comes with a completeness check that names the row behind each sentence. The check tells you what the document covers and what it still lacks. It cannot tell you whether what you typed is true, and it is not a legal opinion.

How to use this

  1. Pick the document. One privacy notice per audience: a notice written for website visitors, applicants and employees at once ends up too vague for any of them.
  2. Describe the processing you actually do, not the processing you would like to document. A notice that promises a retention period nobody applies is evidence against you.
  3. Read the completeness check. Missing is a gap in the document. Review is wording the guidance warns against. Check before publishing is something only you can verify, such as where the notice is placed.
  4. Export and adapt. Download HTML or Markdown, or print to PDF, then fit it to your house style. Keep a copy of the completeness check with it: it shows a reviewer where each sentence comes from.

Nothing you type is sent anywhere. Everything runs in your browser. Save stores your answers in this browser only (localStorage, key ng-v1). Load restores them, Clear empties the form and keeps the saved copy, and Forget deletes the saved copy.

Policy or notice: which document does what

A policy sets rules for the people inside an organisation. A notice tells the people whose data is processed, or who meet an AI system, what happens to them. The law cares far more about the second. Articles 13 and 14 GDPR and Article 50 AI Act prescribe what a notice says and when it is given. No provision prescribes the content of a policy.

DocumentWhat it doesWho reads itLegal anchor
Privacy noticeExplains how a person's data is processed: purposes, legal bases, recipients, retention, transfers, rights.The people whose data it is: website users, client contacts, applicants, employees, each with a notice written for them.Articles 12 to 14 GDPR and UK GDPR; Article 19 FADP in Switzerland; Article 9 LGPD in Brazil, with Articles 14, 18 to 20 and 41 and, for transfers, Article 17 of the ANPD's International Data Transfer Regulation; in Canada, principle 4.8 of Schedule 1 to PIPEDA with the Privacy Commissioner's consent guidelines, section 8 of Quebec's private-sector Act, section 13 of Alberta's PIPA and section 10 of British Columbia's PIPA; in India, section 5 of the DPDP Act with Rules 3, 9 and 14 of the DPDP Rules, 2025; in China, Articles 17, 23, 30 and 39 of the PIPL with Article 21 of the Network Data Security Management Regulations; in Japan, Articles 21, 27, 28 and 32 of the APPI with Article 10 of its Enforcement Order; in South Korea, the privacy policy under Article 30 of the PIPA and Article 31 of its Enforcement Decree; in Singapore, the notification of purposes under section 20 of the PDPA, with the data protection officer's contact (section 11(5)); in Australia, the APP privacy policy under APP 1.4, with the APP 5 matters and, for decisions from 10 December 2026, automated decisions (APP 1.7 to 1.9); in South Africa, the notification under section 18 of POPIA, with the right to object (regulation 2.4 of its Regulations); in California, a privacy policy and a notice at collection (Civil Code 1798.100 and 1798.130, CCPA regulations 7011 and 7012); in the other US states with a consumer privacy law, a privacy notice (for example Va. Code 59.1-578(C)). Mandatory, content prescribed.
AI transparency noticeTells people they are dealing with an AI system or AI-generated content, at the moment it matters.People interacting with the system or exposed to its output.Article 50 AI Act, applicable since 2 August 2026. Articles 26(7), 26(11) and 86 for high-risk systems.
Data protection policySets the rules staff follow: responsibilities, procedures, security, retention, rights handling, breaches.Staff and contractors. Internal.Article 24(2) GDPR, "where proportionate". No content prescribed.
AI policy, including acceptable useSets the rules for choosing, approving and using AI: approved tools, prohibited uses, data inputs, human oversight.Staff and contractors. Internal.None requires the document. Article 4 (AI literacy) and Article 5 (prohibited practices) apply regardless. ISO/IEC 42001 clause 5.2 is voluntary.
Responsible AI statementStates the organisation's public commitments on AI.The public and clients.None. Voluntary, and a claim about conduct that has to be true.

The name on the page decides nothing. The GDPR does not reserve "policy" for internal documents. WP260, the transparency guidelines endorsed by the EDPB, lists data protection notice, privacy notice, privacy policy, privacy statement and fair processing notice as names in common use for the same Article 13 and 14 information (paragraph 24), and gives "Privacy Policy" as an acceptable label for the link to it (paragraph 11). A public page called Privacy Policy can therefore be the notice. Calling it a notice is a document governance choice: it keeps rules that bind staff out of the text people are owed, which Article 12 requires to be concise.

Employees need both kinds. As people whose data is processed, they are owed an employee privacy notice, including any automated decision-making and, from 2 December 2027, information before a high-risk AI system is used at work (Article 26(7) AI Act). As staff, they are bound by the data protection policy and the AI policy.

A footer link is not an AI disclosure. Article 50 information has to reach people clearly and at the latest at the first interaction or exposure. The Commission's guidelines list terms and conditions, URLs and documentation as insufficient on their own (C(2026) 7702, paragraph 38). A general AI notice page complements the disclosure in the product; it does not replace it. The two documents can meet: a deployer can add the Article 50(3) information on emotion recognition to its privacy notice (paragraph 110), as long as the notification is still in place before exposure.

WhereWhat goes there
Public website and productsPrivacy notice for users, linked from every page and every form. Article 50 disclosures inside the product, at the point of interaction. Optionally a responsible AI statement.
Client onboardingPrivacy notice for client and supplier contacts. Article 14 applies where the client organisation supplies their details.
Recruitment and HRPrivacy notices for applicants and for employees, and the Article 26(7) information before high-risk AI is used at work.
Internal governanceData protection policy and AI policy, with the procedures that implement them.

The generators

What these generators cannot do

  1. Check that the inputs are true. A notice is only accurate if the processing it describes is the processing that happens.
  2. Model national law. Employment rules under Article 88 GDPR, national restrictions under Article 23, the Member State laws that Articles 9(2) and 10 point to, and the national rules on informing workers that Article 26(7) AI Act refers to are all outside them. The employee notice says so in its check. For the UK, the generator records the Schedule 1 condition and any exemption you name in the Data Protection Act 2018 but does not test them; Swiss cantonal law is not covered.
  3. Make the legal calls. Whether a legal basis holds, whether a transfer is lawful, whether a system is high-risk, whether an AI interaction is obvious: the generators record your answer and show the rule it has to meet. The AI Assessment Pathway screens the high-risk question; the Transfer Impact Assessment covers transfers.
  4. Cover every regime. The privacy notice covers the EU GDPR, the UK GDPR, the Swiss FADP, Brazil's LGPD, Canada's PIPEDA with the Quebec, Alberta and British Columbia laws, India's DPDP Act and Rules, China's PIPL with the Network Data Security Management Regulations, Japan's APPI, South Korea's PIPA, Singapore's PDPA, Australia's Privacy Act, South Africa's POPIA, the California CCPA and the consumer privacy laws of 22 other US states (18 in force, 4 from 2027 or 2028). Some state laws were read only through secondary sources; the completeness check names them so you can confirm against the official text. For Brazil, the ANPD's regulation on data subject rights was still pending on 12 November 2026, and the ECA Digital (Law 15,211/2025) on digital services used by children is not modelled; the generator writes in English, while the transfer information has to be published in Portuguese. For Canada, Bill C-36, which would replace PIPEDA's privacy rules, was at second reading on 12 November 2026 and is not modelled, nor are the anti-spam law (CASL) and the provincial health information laws; Quebec's Act was read through extracts, because the official site did not answer on the day of the build. The generator writes in English, while Quebec's Charter of the French language calls for French. For India, the notice duty applies from 13 May 2027; the Act lets people read the notice in English or any of the 22 languages of the Eighth Schedule to the Constitution, and the generator writes English only; the Data Protection Board had published no complaint link the generator could cite, so it asks you for one. For China, only the Chinese text of the law is authentic and the generator writes English, so publish a Chinese version; it asks which transfer mechanism covers each overseas recipient but does not decide it, and it does not model State organs, critical information infrastructure operators or the recommended national standards. For Japan, the APPI as in force is modelled; its 2026 amendment (children under 16, facial feature data, statistics and AI development) takes effect on a date still to be set and is not, and the generator writes English while people in Japan normally need Japanese. For South Korea, the PIPA as in force since 11 September 2026 is modelled; its amendments on using personal information to develop AI (from 9 March 2027) and on mandatory certification (from 1 July 2027) are not, nor are the extra rules for public institutions, and a policy for people in Korea is normally written in Korean. For Singapore, the PDPA and its 2021 Regulations as in force on 13 November 2026 are modelled; data breach notification and the Do Not Call rules are left to the checklist, and data portability is not in force. For Australia, the Privacy Act 1988 and the Australian Privacy Principles as in force on 13 November 2026 are modelled for organisations, not agencies; a short collection notice at each collection point (APP 5) and the Spam Act and Do Not Call rules are left to the checklist. For South Africa, POPIA and its Regulations (2018, as amended in 2025) as in force on 13 November 2026 are modelled for private bodies; public bodies get a warning, and the PAIA manual, breach notification and consent to electronic direct marketing (Form 4) are left to the checklist. Other jurisdictions have their own notice rules and are not covered yet. The other three documents follow EU law.
  5. Replace review. The completeness check says which rows are covered. A document can pass every row and still be wrong about the facts.

The two policies are templates, and say so. Article 24(2) GDPR asks for data protection policies only where proportionate and lists no content; the data protection policy is built from the 71 activities of the GDPR Readiness model, each cited to the Articles it evidences. No law requires an AI policy document; the template carries the Article 5 prohibitions in full, the Article 4 literacy duty and, where relevant, the Article 26 deployer duties.

Sources

Rules checked against these texts on 12 and 13 November 2026, then reviewed independently against them: all 37 findings of the first review, all 23 findings of a second review of the UK and Swiss rules, all 25 findings of a third review of the California rules, all 22 findings of a fourth review of the US state rules, all 20 findings of a fifth review of the Brazilian rules, all 19 findings of a sixth review of the Canadian rules, all 22 findings of a seventh review of the Indian rules, all 30 findings of an eighth review of the Chinese rules, all 27 findings of a ninth review of the Japanese rules, all 30 findings of a tenth review of the Korean rules, all 26 findings of an eleventh review of the Singapore rules, all 20 findings of a twelfth review of the Australian rules, and all 18 findings of a thirteenth review of the South African rules, were applied before publication. This is not legal advice.