Is a website privacy policy legally required?
Short answer
The law does not require a separate document called a "privacy policy", but informing people is mandatory — and on a website, that text is the most convenient way to do it. So the practical answer is yes: if a website collects any data, the information must be available.
On this page
1.Where the duty comes from
The GDPR requires that a person know in advance who is processing their data, for what purpose, on what basis, for how long, to whom it is transferred, and what rights they have. The information must be provided in a concise, understandable and easily accessible form. For the specific information requirements, see Articles 13 and 14 GDPR; the form requirements are in Article 12(1).
The website is the easiest place to fulfil this duty, which is why the privacy policy became the standard. But it only covers the processes it actually describes: employees, job candidates or video surveillance often need separate notices.
2.What the text must cover
Who the controller is and how to contact them; what data is collected and for what purpose; the legal basis for each purpose; how long the data is kept; who it is shared with; whether it is transferred outside the European Economic Area; what rights the individual has and how to exercise them; the right to lodge a complaint with the supervisory authority.
If the website has an enquiry form, registration, a newsletter or an analytics tool, each one needs to be named separately. A generic sentence like "we use data to provide our services" does not satisfy the duty to inform.
3.Most common mistakes
First — copying someone else's text, which mentions tools the website does not have, or leaves out ones it does. Second — a policy that only describes the website, even though the organisation processes far more data than that. Third — text nobody updated after a new system was introduced.
The fourth mistake is language: a six-page legal text formally meets the requirement but fails the understandability condition. Short sentences and clear sections here are a matter of compliance, not style.
4.How to keep it current
The privacy policy is written from the record of processing activities, not the other way round. When a new process appears in the record, it is immediately clear whether the text needs updating. This avoids a situation where the document and reality drift apart.
It helps to state the date of the last update and keep earlier versions. If you ever need to show what information was published a year ago, you will have the answer.
Official legal text
We do not paraphrase the regulation's provisions here. The official Lithuanian text of the GDPR is available in one place and is more precise than any summary.
GDPR text in Lithuanian (EUR-Lex)