SaaS Privacy Policy Requirements in 2025 – Full Breakdown

Auditors expect precise roles, retention logic, and AI disclosures. Use the list below as a drafting spine.

Essentials

• Controller vs Processor role clarity
• Lawful basis mapping
• Data minimization statement
• Retention schedule (active vs deleted)
• Subprocessors list / update cadence
• International transfer safeguards
• Security summary
• AI training disclosure + opt-out path

Retention Snippet

`Deleted documents move to a recovery state for 30 days then undergo secure permanent purging.`