# Privacy Notice
**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0
*Tailor this template before adoption; it is not legal advice.* Latest version: . Dedicated to the public domain under CC0 1.0 (): adopt and change it without attribution.
> **Guidance:** PT-5 asks for notice that is available when an individual first interacts with the organization, written in plain language, and that names the authority for the processing and its purposes. PM-20(1) asks for a privacy policy on every external-facing website, mobile application and digital service, with the date of its last change. This template does both with one full notice for the privacy page (Part 1), a short notice for each form or screen that collects information and links to the full one (Part 2), and, for federal collections, a Privacy Act statement (Part 3). Write each section from the system's [privacy impact assessment](https://kston83.github.io/nist-guide/templates/reports/privacy-impact-assessment/), so the notice and the assessment describe the same information, purposes and sharing (PT-2, PT-3). Laws in some jurisdictions and sectors require specific elements or formats; settle those with legal counsel before publishing. Assessors compare the notice with what the system actually collects and shares, and check that the posted version matches the approved one in the register.
| Organization | Notice version | Effective date | Last updated | Owner |
| --- | --- | --- | --- | --- |
| [Organization name] | [Fill in: version] | [Fill in: date] | [Fill in: date of the most recent change] | [Senior privacy official] |
## Part 1: Privacy notice
Publish this part on the organization's privacy page and link to it from every website, application and service it covers (PM-20, PM-20(1)). Delete any section that does not apply, and replace each example with what the organization actually does.
### Federal systems
Section 208(c)(1)(B) of the [E-Government Act of 2002](https://www.congress.gov/107/plaws/publ347/PLAW-107publ347.htm) (Pub. L. 107-347) lists what a privacy notice on an agency website must address, consistent with the Privacy Act: what information is to be collected; why it is being collected; the agency's intended use of it; with whom it will be shared; what notice or opportunities for consent individuals have; how it will be secured; and the rights of the individual under the Privacy Act and other privacy laws. [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf) (July 28, 2016), Appendix II, section 5.a, requires agencies to maintain and post privacy policies on all agency websites, mobile applications and other digital services. As of September 2026.
Add a section on Privacy Act rights to Part 1: how an individual requests access to or amendment of records about them in a system of records, and a link to the agency's Privacy Act rules and system of records notices on its privacy page.
- Each website privacy notice shall address every element section 208(c)(1)(B) of the E-Government Act lists, including the individual's rights under the Privacy Act. (PT-5e)
### About this notice
This notice explains how [Organization name] collects, uses, shares and protects personal information about you, and the choices you have. It covers [Fill in: the websites, applications, services and activities this notice covers]. It was last updated on [Fill in: date of the most recent change] (PM-20(1)(c)).
### Information we collect
| Category | Examples | Where it comes from |
| --- | --- | --- |
| [Fill in: category, for example contact information] | [Fill in: examples, for example name, email address and phone number] | [Fill in: source, for example from you when you register] |
| [Fill in: category, for example information collected automatically] | [Fill in: examples, for example IP address, device type and pages visited] | [Fill in: source, for example cookies and server logs] |
[Fill in: if the organization collects Social Security numbers, health, financial or biometric information, or information about children, say which and why (PT-7)]
### Why we collect it, and our authority
We collect and use your information only for the purposes below, and only as the listed authority permits (PT-5c, PT-5d).
| Purpose | Information used | Authority |
| --- | --- | --- |
| [Fill in: purpose, for example to provide the service you signed up for] | [Fill in: categories] | [Fill in: authority, for example our contract with you, your consent, or a named law] |
| [Fill in: purpose, for example to keep our systems secure] | [Fill in: categories] | [Fill in: authority] |
We will not use your information for a new purpose that is not compatible with these without first updating this notice and, where the law or our policy requires it, asking for your consent (PT-3d).
### Who we share it with
| Recipient | Information shared | Why |
| --- | --- | --- |
| [Fill in: recipient, for example service providers who host our systems] | [Fill in: categories] | [Fill in: purpose] |
| [Fill in: recipient, for example law enforcement, when the law requires it] | [Fill in: categories] | [Fill in: purpose] |
We do not sell your personal information. [Fill in: delete or change this sentence to match the organization's practice]
### Your choices
- [Fill in: each choice you have, for example to opt out of marketing email, to decline optional cookies, or to withdraw consent, and how to exercise it] (PT-4)
- If you withdraw consent, we stop the processing that relied on it. Withdrawing does not affect processing that happened before, or processing that another authority permits.
### Seeing and correcting your information
You can ask to see the personal information we hold about you, and ask us to correct it if it is wrong. [Fill in: how to make a request, what identification is needed, and how long a response usually takes]
### How long we keep it
We keep your information [Fill in: the retention period for each category, or the rule that sets it, for example for as long as your account is open and then for 2 years], then delete or de-identify it.
### How we protect it
We protect your information with administrative, technical and physical safeguards suited to its sensitivity, including [Fill in: examples in plain words, for example encryption, limits on who can see it, and monitoring for misuse]. No system is completely secure; if a breach affects your information, we will tell you as the law requires.
### Changes to this notice
When we change this notice, we update the date at the top. If a change is material, we tell you [Fill in: how, for example by email or a message when you next sign in] before it takes effect (PT-5a).
### Contact us
Questions, requests and complaints about privacy go to the [Senior privacy official]: [Fill in: public email address], [Fill in: public phone number], or [Fill in: postal address] (PM-20c).
## Part 2: Short notice at the point of collection
Put this on each form, sign-up screen or other place that collects personal information, next to the submit button or the first field, with a link to Part 1 (PT-5a). Keep it to a few sentences.
> **Privacy:** [Organization name] collects [Fill in: the information this form collects] to [Fill in: the purpose of this collection], under [Fill in: the authority]. Providing it is [Fill in: mandatory or voluntary]; if you do not, [Fill in: the effect, for example we cannot process your request]. We share it with [Fill in: recipients, or "no one outside the organization"]. [Fill in: the choice offered, if any, for example "Tick this box to also receive updates by email."] Read our full privacy notice at [Fill in: link to Part 1].
## Part 3: Privacy Act statement
Complete this part only for a form, screen or call that collects information to be kept in a U.S. Privacy Act system of records. Otherwise delete it.
### Federal systems
The Privacy Act requires each agency to inform every individual it asks to supply information, on the form it uses to collect the information or on a separate form the individual can keep, of the authority for the request and whether disclosure is mandatory or voluntary, the principal purposes, the routine uses, and the effects on the individual of not providing the information ([5 U.S.C. § 552a(e)(3)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). [OMB Circular A-108](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A108/omb_circular_a-108.pdf) (reissued December 23, 2016, 81 FR 94424), section 6.l, requires the statement in plain language whatever the medium, including websites, mobile applications and the telephone, and adds a citation (and, if practicable, a link) to the system of records notice. For collection by telephone, the agency gives the information orally and provides a way to receive it in writing. As of September 2026.
| Element | Statement |
| --- | --- |
| Authority | [Fill in: the statute or executive order that authorizes the request] |
| Mandatory or voluntary | [Fill in: whether providing the information is mandatory or voluntary] |
| Principal purposes | [Fill in: the principal purposes for which the information will be used] |
| Routine uses | [Fill in: the published routine uses, or a summary with a link to them] |
| Effect of not providing information | [Fill in: the effects, if any, on the individual of not providing all or part of the information] |
| System of records notice | [Fill in: the notice's name, number and Federal Register citation, with a link] |
- The [System owner] shall place the Privacy Act statement on the collection form, or on a separate form the individual can keep, before the form is used. (PT-5(2))
- For collection by telephone, the [System owner] shall give the statement orally and offer it in writing. (PT-5(2))
## Publishing and maintaining this notice
- The [Senior privacy official] approves each notice in this template, and each change to one, before it is published (PT-5).
- Individuals can see the full notice when they first interact with [Organization name], and it is shown again at [Fill in: the frequency at which a notice is provided to individuals after initial interaction with an organization. Typical: each later collection of personally identifiable information, and whenever the notice changes materially] (PT-5a).
- Each notice includes [Fill in: information to be included with the notice about the processing of personally identifiable information. Typical: what information is collected, with whom it is shared, the choices individuals have and how to exercise them, how individuals can access and correct their information, how long it is kept, how it is protected, and how to contact the privacy office] (PT-5e).
- The [System owner] tells the [Senior privacy official] before any change to what a system collects, why, or with whom it shares it, so the notice can be updated first (PT-3d).
- The [Senior privacy official] reviews every notice at least [Fill in: how often, for example annually], and whenever the privacy impact assessment changes (RA-8).
- Every published notice, and the date it was replaced, is recorded in the register below and kept for [Fill in: how long, for example as long as the records it described].
## Register
| Notice | Type | Where posted | Version | Approved by | Approved date | Effective date | Last reviewed | Replaced on |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: notice name] | [Fill in: full notice, short notice or Privacy Act statement] | [Fill in: web address, form number or screen] | [Fill in: version] | [Fill in: name and title] | [Fill in: date] | [Fill in: date] | [Fill in: date] | [Fill in: date, or blank if current] |