The Dutch regulator's privacy policy template leaves out the legal basis for each purpose

Open your privacy policy and find the paragraph on legal bases. If it lists contract, consent, legal obligation and legitimate interest and stops there, your users cannot tell which one covers their account, and GDPR Article 13 asks you to give the purposes you use their data for together with their legal basis. In May, vague information of that kind was part of why Italy's data protection authority fined Emirates 180,000 euros, even though the regulator found collecting the data lawful 5. On 3 September 2026 the Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), published a free privacy policy template that, filled in as written, leaves out four things Article 13 requires: the legal basis for each purpose, the specific interest behind any "legitimate interest", which sign-up data is required and why, and the named safeguard for each transfer outside the EEA.

Published policies share these gaps. When my co-founder Ulf scanned privacy policies from Product Hunt launches, 54.7% named no legal basis at all and 65.0% said nothing about data leaving the EEA. So the four items below are worth checking whether you are about to fill in the AP's template or already have a policy live.

Which four things does the AP template leave out?

The AP announced the template for small businesses that wanted ready-made GDPR documents. It is a Word file in Dutch with blocks for ten sectors, and the instructions are to delete what does not apply, fill in the brackets and publish it as a PDF 4. Its IT block names one recipient, a hosting provider, and leaves you to add the rest of your vendors. The quotes from it below are my translations.

The template covers most of what Article 13 lists: who you are, how to reach you, recipients, retention, people's rights and how to complain 1. These four are missing or left as a placeholder. The AP's own guidance page lists two of them, the legal basis and whether people must provide the data, as things a privacy policy must contain "in any case" 3.

1. Which legal basis covers which purpose

The template's "Why do we use your data?" section gives one general sentence about purposes and then lists five of the six legal bases GDPR allows. A reader cannot tell which one covers their account, their invoices or their newsletter. Article 13(1)(c) asks for the purposes "as well as the legal basis for the processing" 1.

Article 13 does not spell out "per purpose", so this is my reading: a menu of every basis a company might use does not tell the reader which one it does use. The transparency guidelines endorsed by the European Data Protection Board (EDPB), the body where the EU's data protection regulators sit together, say that "the purposes of, and legal basis for, processing the personal data should be clear" 2. The template's own checklist asks whether every purpose has a legal basis, but its text has no place to write the pairs down. Write one line per purpose:

• We use your email address and password to run your account (contract).
• We keep invoices for seven years because tax law requires it (legal obligation).
• We keep error logs to find and fix faults in the service (legitimate interest, see below).

2. The legitimate interest itself

The template says only that "we have a legitimate interest in using your data", and its filled-in example for a fictional meal producer says "for our legitimate interest". Neither names an interest. Where you rely on legitimate interest, Article 13(1)(d) requires you to state the interest you pursue 1. The same guidelines say the specific interest "must be identified", and that the policy should tell people they can ask for the balancing test behind it, which is the written weighing of your interest against the user's 2.

Name it in a sentence a user can check: "We keep server logs with IP addresses for 30 days to detect and investigate attacks on the service. You can ask us for the assessment behind this."

3. Which sign-up data is required, and what happens without it

For a software product this is the sign-up form. The email address is required because the account and password resets run on it. A company name or phone number is optional, and leaving it blank changes nothing. Say so on the form and repeat it in the policy.

The template has no section for this, though Article 13(2)(e) asks for it 1. The transparency guidelines say online forms "should clearly identify which fields are 'required', which are not, and what will be the consequences of not filling in the required fields" 2.

4. Which safeguard covers data leaving the EEA

The template's transfer section asks for the country your vendors are in, then offers a choice: the processing happens "on the basis of an adequacy decision OR because we take appropriate safeguards". Where you rely on a safeguard, Article 13(1)(f) asks you to name it and say where people can get a copy 1, and the guidelines say to link to it 2. The template's own list of situations that need an expert includes doing business with organisations outside the EEA, which covers most software products on a US cloud.

For each vendor outside the EEA, name one of two things:

• An adequacy decision, the European Commission's finding that a country protects personal data well enough. Some cover only part of a country: the US one covers only companies certified under the EU-US Data Privacy Framework. Look the vendor up on the Data Privacy Framework list, and if it is there, name the framework.
• Standard contractual clauses (SCCs), if it is not. These are usually part of the vendor's data processing agreement; link to where a copy can be found.

Is a "we may update this policy" line enough?

No. The transparency guidelines call a policy that tells people to check the page for updates "not only insufficient but also unfair" 2. The AP template's changes section takes that approach: the company may update the policy, and the current version is always on the website.

A software product changes its processing when a pull request adds a vendor, a tracking event or an AI feature. Two duties follow:

• A new purpose. When you intend to use data for a purpose you did not collect it for, Article 13(3) says you tell people before that processing starts 1.
• Other material changes, such as a new kind of recipient or a new transfer outside the EEA. The guidelines say these should reach people well before the change takes effect, through a message devoted to the change, such as an email or a notice in the product 2.

Both depend on someone noticing the change before the release ships. When nobody does, the published policy describes an older version of the product, which is what I mean by privacy policy drift.

What should you add to your privacy policy?

Whether you are filling in the AP template or checking a policy that is already live, add:

• A legal basis next to each purpose, one line each.
• The interest itself for each legitimate-interest purpose, plus a sentence saying the assessment is available on request.
• Required and optional fields marked on the sign-up form, with what happens if a required one is left blank, repeated in the policy.
• The adequacy decision or SCCs, with a link, for every vendor that receives data outside the EEA.
• Your vendors by name in place of "hosting provider", which the guidelines say is generally the most meaningful information 2.
• A way to announce changes, such as an email or an in-product notice, used before a new purpose or a new kind of recipient goes live.
• An owner for changes: the person who updates the policy when a pull request adds a vendor or a new use of data.

The last item is the problem we built Lawcel for. Lawcel is a compliance tool that reads your website, asks you the questions it cannot answer from it, and drafts your legal documents from those facts. It then watches the platforms where your team plans and ships work (GitHub, Linear and Jira) for changes that affect the documents. When a change does, it proposes an edit to the affected document for your team to approve and publish. Telling existing users about the change stays with your team.