# How to Make Privacy Policies both GDPR-Compliant and Usable

arXiv: https://arxiv.org/abs/1806.06670 · HTML: https://mlsanity.com/paper/1806.06670/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 18 Jun 2018.

## Built on by (most cited first, 2 of 2)

- [Legally Binding but Unfair? Towards Assessing Fairness of Privacy Policies](https://mlsanity.com/paper/2403.08115/) (2024)
- [Detecting Compliance of Privacy Policies with Data Protection Laws](https://mlsanity.com/paper/2102.12362/) (2021)

## Abstract (arXiv)

It is important for organisations to ensure that their privacy policies are General Data Protection Regulation (GDPR) compliant, and this has to be done by the May 2018 deadline. However, it is also important for these policies to be designed with the needs of the human recipient in mind. We carried out an investigation to find out how best to achieve this. We commenced by synthesising the GDPR requirements into a checklist-type format. We then derived a list of usability design guidelines for privacy notifications from the research literature. We augmented the recommendations with other findings reported in the research literature, in order to confirm the guidelines. We conclude by providing a usable and GDPR-compliant privacy policy template for the benefit of policy writers.