A website privacy review starts with what actually happens to visitor information. List the forms, analytics, embedded services and providers in use before drafting a notice. This guide offers a practical technical inventory; the business's legal or compliance adviser must determine the applicable rules and approve the required wording.
This guide covers form fields, provider destinations, access arrangements and a technically accurate privacy-information inventory. Discuss the relevant requirements through ITZ’s Website Development service.
Data inventory
Document what contact forms, analytics tools, embedded services and messaging links collect or transmit. Identify the responsible providers and the purpose of each data flow before preparing the privacy notice.
Map each data-collection point to its purpose, destination and responsible owner. Include public forms, booking platforms, support widgets and uploaded documents. Identify copies created by email notifications, CRM integrations or exports. The UAE government describes the federal PDPL and other data-protection regimes; applicability can depend on the organisation, data and sector, so avoid assuming one generic policy covers every situation.
Forms and access
Request information proportionate to the enquiry and use appropriate access controls for received submissions. Avoid inviting sensitive documents through a general website form without an approved process.
For each field, ask whether it is needed at the initial stage and who can access the result. Separate optional marketing preferences from a customer's service request where appropriate. Use approved secure channels for information that should not enter an ordinary enquiry inbox. Technical controls should follow the organisation's reviewed purpose and handling requirements.
Review Your Website Data Journey to discuss form fields, provider destinations, access arrangements and a technically accurate privacy-information inventory.
Cookies and external services
Assess the technologies actually used on the site and their relevant requirements. A generic banner does not by itself establish appropriate handling. Configuration should match the organisation’s reviewed obligations and choices.
Inventory third-party scripts and embeds, including their settings and when they load. Do not assume a site uses no tracking merely because the business did not configure an analytics dashboard. Conversely, do not invent a cookie banner requirement without assessing the actual implementation and applicable rules. Record provider changes so the notice and controls can be reviewed together.
Clear privacy information
Describe the real enquiry process and provide a contact route for privacy questions. Requirements may depend on jurisdiction, sector and processing activity; obtain suitable legal advice before making a compliance claim.
Explain data handling in clear, accurate language, including relevant providers and contact routes approved by the business. A copied notice can describe tools you do not use while missing the ones you do. Keep a review record and an internal procedure for privacy questions. Publishing a policy page is one deliverable, not proof that all operational obligations have been met.
A practical example
Illustrative example: a form sends an enquiry to a processing provider, an email inbox and a CRM. A notice mentioning only the website host misses much of the journey. Mapping those destinations first allows the business to review access, retention, provider arrangements and the public explanation against the actual process.
Your review checklist
- Inventory forms, embeds, analytics and information destinations.
- Identify responsible owners and necessary initial fields.
- Have applicable requirements and notices reviewed appropriately.
- Recheck data journeys when providers or integrations change.
Frequently asked questions
Does adding a privacy notice make a website compliant?
No. A notice describes practices, while compliance also depends on the underlying collection, use, security and governance of personal information.
References and further reading
Related services and guides
Discuss the next step
Review Your Website Data Journey. Use the form below to discuss form fields, provider destinations, access arrangements and a technically accurate privacy-information inventory. Share the relevant goals and existing arrangements; do not include passwords, private records or access tokens.
Review Your Website Data Journey ↗
Reviewed and expanded on 15 October 2026. Examples are illustrative; the appropriate approach depends on your business requirements and existing systems.
