when combined with other information.

Examples of personal data within the meaning of the GDPR include name, personal identity number, address, telephone number, photos, and email address.

Direct personal data includes, for example, name and personal identity number, while, for example, IP address and place of residence are considered indirect personal data.

Privacy policy

All websites that process personal data must do so in line with the GDPR. One of the basic requirements for processing personal data is obtaining consent from the individual concerned. Consent must be informed, and a website’s visitors must be able to easily find out how personal data is processed there, which is why a policy should be established.

A privacy policy must clarify which personal data the website collects and stores, how it is used, how visitors can control this, and how they can contact the owner of the website in question.

How does it work?

A privacy policy for a website must be established by all companies and public authorities that have a website which processes personal data.

A website’s privacy policy constitutes an internal framework for how personal data will be processed. It must be clear, specific, and easily accessible. Once the policy has been established, it should be published on the website so that it is available to all visitors.

When creating a website, it is also a good idea to establish a cookie policy—i.e., a policy for how small text files store information from the user to improve their user experience—as well as terms of use to set the boundaries for what the website’s users may and may not do.