Privacy policy: keep the list of services up to date

What the GDPR asks for

When you collect personal data from a person, Article 13(1) GDPR lists what you have to tell them at that time. Point (e) is “the recipients or categories of recipients of the personal data, if any”. A recipient, according to Article 4(9), is a person, authority, agency or other body to which personal data are disclosed, whether a third party or not. Point (f) adds, where applicable, information about a transfer to a third country. Article 12(1) asks for this information in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

The GDPR allows categories of recipients. Whether a category such as “analytics providers” is enough in your case, or whether you should name each service, is a legal question that this guide does not decide. If your privacy policy names individual services, that list has to match the website.

Why the list drifts

The website changes more often than the privacy policy. A new plugin, a new theme, a video in a blog post, a switch to another newsletter tool: each of these can add or remove a recipient. Often several people work on one website, and each change looks small. Nobody updates the policy, because the change did not look like a data protection topic. After a year, the policy may describe a website that no longer exists.

Typical gaps

• A plugin or theme loads a font, a map or a script from an external server, and nobody noticed.
• A tag manager adds a new tool without any change to the code of the website.
• An editor embeds a video or a social media post in a single article.
• A tool was removed months ago but is still named in the policy.
• You switched providers, for example for the newsletter or the chat, and the policy still names the old one.
• A template or a text generator added services that your website never used.

How to build the real list

1. 1Check what the website loads: open the main pages in a private window with the developer tools of your browser, or use a scan. Write down every external server and the service behind it.
2. 2Check what is installed: the plugins and extensions in your content management system, the tags in your tag manager and the embeds in your content.
3. 3Check who else receives data: go through the contracts and invoices of your service providers, including those that never appear on the website.
4. 4Compare this list with the privacy policy, service by service: is it named, with the right company, the purpose and, where it applies, the transfer to a third country?
5. 5Compare it with your consent banner as well. The banner has its own list of services, and it should describe the same reality.

The consent banner is a second list

For storing or reading information on the visitor's device, such as cookies, § 25 TDDDG in Germany requires consent based on clear and comprehensive information. In Poland, Article 399 of the Electronic Communications Law requires that the user is first informed, among other things about the purpose, and then agrees. Both provisions have exceptions for what is strictly necessary or necessary for a requested service. If a service is missing in the banner, the visitor cannot decide about it. If a removed service is still listed, the banner describes something that does not happen.

A review routine

Keep a short note of each review: the date, the pages you checked, what you found and what you changed in the policy or the banner. Then you can see later what was checked and when. Name one person who is responsible for the review, so that it does not depend on chance. This is a habit we suggest, not a rule from the law.

Work with Do4U

The Privacy policy check compares your privacy policy with your website. You enter the start page, a few more pages of the same website if you like, and the address or the text of your privacy policy. Do4U reads the pages and finds the third-party services they load. The Do4U AI reads the privacy policy and lists every service and recipient it names, each with a quote. The code checks that every quote is in the policy word for word and does the comparison itself. You get three lists: embedded but not named, named but not found, and found and named. The check is static: it does not run JavaScript and reads only the pages you enter.

Do4U finds hints, you check and decide. “Named but not found” can mean that a service loads later, on other pages or outside the website. The result does not say whether your privacy policy is complete or correct.