Privacy policy pack: GDPR, CCPA, NDPR
The privacy notice, cookie notice, data protection policy and request procedure a customer asks to see, drafted against GDPR, CCPA and NDPR.
$1,200 to $2,500, fixed before we start. First draft in 10 working days.
Updated
PD-PP; specimen page
Privacy policy pack
Contents
- 1External privacy notice
- 2Cookie notice
- 3Internal data protection policy
- 4Data subject request procedure
- 5Records of processing template
1Purpose
1.1A privacy policy pack is the set of public notices and internal documents that state what personal data an organisation collects, why, who receives it, how long it is kept and how people exercise their rights, drafted against each privacy law that applies, such as GDPR, the CCPA or the Nigeria Data Protection Act 2023.
What it is
A privacy policy pack is the set of public notices and internal documents that state what personal data an organisation collects, why, who receives it, how long it is kept and how people exercise their rights, drafted against each privacy law that applies, such as GDPR, the CCPA or the Nigeria Data Protection Act 2023.
Who it is for
A SaaS company with users in Europe and California, a Nigerian business registering with the data protection authority, or any firm whose customer has asked to see its privacy notice before signing. The pack covers both faces of privacy: the notice the public reads and the policy and procedure your staff follow when a request arrives. It is drafted so that a support lead can answer a deletion request from the procedure alone.
What you get
5 deliverables, in Word (.docx) and PDF, with one round of revisions.
- External privacy notice
- Cookie notice
- Internal data protection policy
- Data subject request procedure
- Records of processing template
What each document settles
| Document | What it settles |
|---|---|
| External privacy notice | What you collect, why, on which lawful basis, who receives it, how long you keep it, and the rights a person can exercise |
| Cookie notice | Which cookies and trackers you set, in which categories, and how consent is given and withdrawn |
| Internal data protection policy | The rules staff follow for handling, sharing, retaining and securing personal data |
| Data subject request procedure | How access, deletion, correction and opt-out requests are received, verified, answered and logged within the statutory deadlines |
| Records of processing template | The register of processing activities a controller or processor keeps under GDPR Article 30 |
Most privacy notices fall apart at the sharing paragraph. Ours lists every category of recipient, names the transfer mechanism where data leaves the jurisdiction, and matches the records of processing line for line.
What it costs
$1,200to $2,500
The privacy policy pack is $1,200 to $2,500. The quote is fixed before we start and does not change. Maintenance is a separate plan, $29 to $99 a month, that keeps the privacy policy pack current when a rule it names changes.
How the document is made, from intake to delivery, is set out in how it works.
- Band
- Themed suite
- First draft
- 10 working days
- Revisions
- One round included
- Review
- Our legal team, before delivery
- Format
- Word (.docx) and PDF
- Maintenance
- $29 to $99 a month
What is the difference between the privacy notice, the cookie notice and a consent banner?
The privacy notice and the cookie notice are documents; a consent banner is software. The privacy notice explains what personal data you collect, why, who receives it, how long you keep it and what rights people have. The cookie notice lists the cookies and trackers your site sets, in categories, and says how consent is given and withdrawn. The consent banner is the on-screen control that asks a visitor to accept or refuse cookies, records the choice and sets cookies according to it.
The banner is configured in a consent tool or in your site's code, and running it is ongoing work: when the site adds a tracker, someone has to put it in the right category and check that the banner treats it that way.
The pack covers the written half. It contains the privacy notice, and a cookie notice written as the text and the cookie categories that sit inside a consent banner. You or your developer configure the banner and keep it working; PolicyDrafters does not supply the banner software. The guide to privacy notices and cookie consent sets out where each piece sits.
What we need from you
The intake asks what personal data you collect, from whom and through which channels, where it is stored, which processors and sub-processors touch it, whether any of it crosses a border, how long you keep it, and which cookies and trackers your site sets. Name your current notice and any processor agreements, and send them once we reply. Where you do not know an answer, the intake offers the usual options.
How it is drafted and reviewed
We draft the external notice against the information duties in GDPR Articles 13 and 14, and the notice at collection, privacy policy and consumer rights in California Civil Code sections 1798.100 to 1798.135.
For Nigeria, we draft against section 27 of the Nigeria Data Protection Act 2023 and Article 27(3) of the Nigeria Data Protection Commission's General Application and Implementation Directive 2025. The data subject rights in the Act are carried through to the request procedure.
The regime is still known as the NDPR. Under Article 3(3) of that directive, issued on 20 March 2025, the Commission no longer applies the Nigeria Data Protection Regulation 2019 as a legal instrument. The notice therefore cites the Act and the directive, not the regulation.
The records of processing template follows the fields in GDPR Article 30. Our legal team reviews the draft before it reaches you, and the review is recorded in the revision block. You mark what you want changed, we revise once, and the pack arrives in Word and PDF with a document ID on every page.
Where a pack falls in the $1,200 to $2,500 band depends on the number of regimes and processing activities. See pricing and how it works.
Drafted against
- GDPR, Regulation (EU) 2016/679, Articles 13, 14 and 30
- California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, Civil Code sections 1798.100 to 1798.135
- Nigeria Data Protection Act 2023, section 27
- Nigeria Data Protection Commission General Application and Implementation Directive 2025, Article 27(3); under its Article 3(3) the NDPR 2019 no longer applies as an instrument
What maintenance covers
When the rule changes, your document changes. Under the maintenance plan we track the regimes you were drafted against, including the California Privacy Protection Agency's CCPA regulations and the rules the Nigeria Data Protection Commission issues under the Nigeria Data Protection Act 2023, and issue a revised pack with the changes marked. Without the plan, the pack is still yours to use and to edit; it simply stops being tracked.
$29to $99a month, optional
Questions about the privacy policy pack
- Does a privacy policy pack have to cover GDPR, CCPA and NDPR?
- No, a privacy policy pack does not have to cover GDPR, the CCPA and the NDPR together. The intake asks where your users and customers are; the pack is drafted against only the regimes that apply. The regime is still known as the NDPR, but the pack cites the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Commission's General Application and Implementation Directive 2025. Under the directive's Article 3(3), the NDPR 2019 no longer applies as an instrument. A one-regime pack is quoted at the lower end of the $1,200 to $2,500 band.
- Is the cookie notice in a privacy policy pack the same as a consent banner?
- No, the cookie notice in a privacy policy pack is the text and the cookie categories, written to sit inside a consent banner that you or your developer configure. PolicyDrafters does not supply the banner software.
- Does PolicyDrafters decide whether we are a controller or a processor in our privacy policy pack?
- No, PolicyDrafters does not decide whether you are a controller or a processor: it drafts the privacy policy pack, our legal team reviews the draft, and you receive a document. The intake asks whether you act as controller or processor for each processing activity, and the pack is written on that basis; the question of your legal position stays with you.
- How long does a privacy policy pack take?
- The first draft of a privacy policy pack is delivered ten working days after a complete intake. Your review and the one included revision round add whatever time you need.
Guides that go deeper
GDPR, CCPA and NDPR privacy notices: what has to be in each?
GDPR, CCPA and Nigerian notices state identity, data, purposes, recipients, retention and rights; GDPR and Nigeria add lawful basis, the CCPA a sale or sharing opt-out.
Updated
What is the difference between a privacy notice and a cookie consent setup?
A privacy notice says what data you collect and why; a cookie consent setup asks before trackers run and records the answer. What each needs and who builds it.
Published
Policy templates vs drafted policies: when is a template enough?
A template is enough when the rule is generic, nobody will audit it and you will edit it honestly. It stops being enough when a reader compares it to what you do.
Updated
Which policies does a SaaS startup need before its first enterprise deal?
The eight policies a SaaS startup's first security questionnaire asks for, mapped to ISO 27001, SOC 2, the CAIQ and VSAQ, with a ninth where the product uses AI.
Updated
What documents does the EU AI Act require from a deployer of AI?
What the EU AI Act, Regulation (EU) 2024/1689, asks a deployer to document: Article 26 duties, Article 27 impact assessment, Article 4 literacy and Article 50 notices.
Updated