How to Create a Privacy Policy

Welcome! Please comment and leave me a note telling me what you like and what you'd like to see more of. Sign up to my RSS Feed!
This entry is part of a wonderful series, How to create a Privacy policy»


One of the most requested items from me, for performance as well as for advice, is to create Privacy Policies.  Today I will start describing how I go about creating a privacy policy for a client.   Please let me know your thoughts.

Starting – Collecting The Information You Need

Before you start putting pen to paper (or key to keyboard), you must collect a few pieces of information that are required for you to create a privacy policy that is serviceable, not just a something to put on the wall or your website.   Let me re-emphasize this: having a privacy policy that you do not follow is worse than not having one at all.   Legal professionals will call that a liability.

Here are the information pieces I recommend you have before you start, in no particular order:

  1. Understand the industry you are in.   If you are in a particularly regulated industry, there are some extras that you need to pay attention to.   These industries generally include:
    1. Financial Services (and in particular, customer oriented businesses)
    2. Healthcare (and in particular, patient care)
    3. Education (and especially private education, as contrasted with state-sponsored)
    4. Providing legal advice to legal professionals (for obvious reasons )


  1. Know where you are.
    This might seem obvious, however, in the Internet era, there seems to be a lack of emphasis on geo-political boundries.   That, however, does not work.   You need to know what laws your local jurisdiction has regarding privacy.    You can use my pages at International or USA Privacy Laws, as references, but do not use those and those alone.   Laws change rapidly and I am not an attorney.  For example, some jurisdictions have no privacy rules at all.  Other jurisdictions have…well, yes… hundreds.


  1. Figure out your intended reach.
    Generally, if your intended audience is in Europe, versus for example, the United States, different rules may apply.  If you want to do business in France, this entire guide is not for you – give me a call instead.
    Likewise, if your targeted audience is minors, or if it is a historically protected minority, there are special considerations that you must adhere to.


  1. Is the same policy is intended to serve both your internal staff and visitors?


  1. Ascertain whether the privacy policy is meant only for an external website (This is the most requested feature of me).


  1. Analyze what data you need to collect and what you intend to do with it.
    I cannot emphasize this point too much: Do NOT collect what you do not need and do not store what you do not need.


  1. And finally, research what your own organization did, if anything, on this subject before.   If you change existing policies you should, and in some cases, must, inform the effected parties.


In the next article in this series, which I intend to publish tomorrow, I will talk further on creating a privacy policy. The next step is drilling-down on the data – how, when, and what to collect.







Blacklists, Whitelists and Secure Computing

Recently I responded to a thought out blog entry at British Telecom’s Secure Thinking ‘blog.   BT bought both INS (consulting) and CounterPane (Bruce Schneier’s MSSP company) to create a strong presence in the US.  They employ, along with my friends Ben Rothke and Jim Tiller, some of the best minds in the information security industry today.

In that blog entry, they discussed something they call CMAL, which is a nice tool.  They are creating sort of a Blacklist that keeps customers’ informed of malicious actions, or, as they state, Correlated Malware Detection (CMAL) module provides our customers with a global security perspective on every session that is logged by any monitored firewall.

There is no need for me to further extol the virtues of Bruce.  While we don’t always agree, he is amongst the brightest lights in information security today, world wide.   Bruce can see things coming "around the bend" ahead of their time.  

This was a well thought out article, and I see the value of CMAL.  And knowledge-sharing between the infosec community, be it regarding 201 CMR 17 or, as the case is in this article, Malware blacklists, is a boon and benefit to would-be effected users.

That said, we need something even better.   At the very least, we need a coordinated approach between all (not just major) players to create a blacklist-like database that deployed IPS’ can query and cache in real time.  We need a mesh approach to such sharing, and we need a US-CERT like ability to cross industries and geographical boundaries. 

Even better?  It is time for the entire infosec community to stop using blacklists and start using either whitelists or… more robust technologies (such as an inherently secure computing base).   Blacklists no longer work.


What do you think?