Do I need a privacy policy and a data processing agreement?
PrivacyComplianceContracts
If your product collects personal information, you need a privacy policy. California law requires one for any commercial website or online service that collects personal information from California residents, which in practice means nearly every app. A data processing agreement is a different document. You need one when you process personal data on behalf of your business customers, for example the customer records they upload into your software. European law requires it, and US state privacy laws require similar terms with service providers.
The privacy policy
It tells your users what you collect, why, who you share it with, how long you keep it and what rights they have. It must be accurate. The FTC treats a privacy policy that misstates your practices as deception, and that is the most common way small companies get into trouble: a template promises something the product does not do.
The data processing agreement
Under the GDPR, a business that decides why and how personal data is used is a controller, and a vendor that handles it on the controller's instructions is a processor. Article 28 requires a contract between them covering what the processor may do with the data, security, subprocessors, breach notice and deletion at the end. Enterprise customers will send you their own version. Having yours ready shortens the sale.
Which one you need
- Consumer app: a privacy policy, plus app store privacy disclosures.
- Business software: a privacy policy for your own users and website, and a data processing agreement for customer data.
- Any product with European users: both, plus a lawful basis for each use of their data.
What to do
- Map what personal data the product collects and where it goes.
- Write the privacy policy from that map, not from a template's promises.
- Prepare a data processing agreement before your first business customer asks.
- Update both whenever the product starts collecting something new.
Related questions
Written by the lawyers who built Arabella. This is legal information, not legal advice for your situation, and reading it does not make us your lawyers. For a real dispute or a high-stakes decision, talk to a licensed attorney. More questions.