Privacy Policy Product Requirements Checklist

A privacy policy is a public document that tells users how you handle their data. It is a one-to-many disclosure. A [data processing agreement](/templates/data-processing-agreement-template) is a contract between your company and a business customer (or between you and a third-party processor) that defines specific data handling obligations. B2B products typically need both: the privacy policy for end users and DPAs for enterprise customers.

GDPR requires products to implement: consent collection before processing, data access (users can view their data), data portability (export in machine-readable format), data deletion (right to erasure), and processing restriction. These are not optional product features. They are legal requirements for any product serving EU users. Use the [Technical PM Handbook](/technical-pm-guide) for guidance on building these technical requirements into your architecture.

Audit quarterly at minimum. Additionally, trigger an audit whenever you add a new third-party integration, change your data collection practices, expand to a new geographic market, or launch features that process new categories of personal data. AI features that analyze user content are a common trigger that PMs miss.

Ultimately, the Data Protection Officer (if one exists) or General Counsel owns compliance. But PMs are responsible for ensuring the product implements the requirements. If the privacy policy says users can delete their data, the PM must ensure that a deletion flow exists, works correctly, and cascades to all systems. Think of privacy requirements as [acceptance criteria](/glossary/acceptance-criteria) for your product.

If your privacy policy promises something the product does not deliver, that is a regulatory violation. Regulators treat this as a deceptive practice. If your product does something the privacy policy does not disclose, that is also a violation (undisclosed data collection). Both directions create legal risk. This checklist exists to catch those mismatches before a regulator or customer does. ---