You should have a privacy policy that explains to your website visitors in general terms how you collect, use, store, and delete PII data. Link to the privacy policy from the website footer and from registration forms, web forms, and other consent forms/messages.

The privacy policy should include the following information:

• how PII data is collected and managed (such as encryption, how long data is stored and so on)

• your security procedures

• detailed information about the data subject’s rights, such as the right to be forgotten, the right to give and to withdraw consent, the right to access own PII data, the right to complain to authorities

The privacy policy should include information about who to contact at your company regarding PII data issues.