I'm really having some difficulties with the Privacy Policy for my site, the website in question is written in English but hosted in France, in additional to this the website is owned by people in Italy. It's also worth mentioning that the website is used by all types of people all around the globe.Taking all facts into consideration...What language(s) would I need to use?What privacy law (region) would my site be subject to?
Privacy Policy for an english site that is located in france but is owned people in Italy
language;privacy policy
If your site is handling personal data then it must (i.e. its practices for handling personal data must) comply with EU data protection laws (see the EU Data Protection Directive 95/46/EC for the definition of personal data).  However, there is nowhere in the European Union a requirement for a website to have its privacy policy posted - except for cookies. The directive 2009/136/EC (aka The Cookie Law) state it is necessary to obtain informed consent from the users if you intend to use cookies to track information on your website.And there is no explicit language requirement in The Cookie Law, but the word informed implies that your users must be able to understand your policy.  This means that the posted policy must be in a language your users should be able to understand.Since your site is entirely in English, I believe that your users can be assumed to understand English. I.e. having the cookie policy and opt-in instructions in English is the logical choice, and in compliance with the legal requirement of your users being informed.Looking beyond cookies, there is (currently) no legal requirement to have a public privacy policy posted - but doing so is certainly a good idea.  I would say that having it in the language of the website is the logical choice that best fulfils the objective of making your users informed about how your site treats personal data.  The word informed is very important in EU data protection laws - and will be even more so when the projected changes to Data Protection regulation that is currently winding its way through the EU legislative process, where the major shifts seems to be from regulation towards informed consent.Edit: For avoidance of misunderstanding: There is no formal requirement in the current Italian Privacy Law (i.e. D.Lgs. 196/2003) to have a public privacy policy posted on an Italian website.  The Italian privacy law only say the same thing as all other legislation in compliance with  Directive 95/46/EC: The data subject whose data is processed has the right to be told what the data controller do with his/her personal data. No current EU law, including the Italian, go into a details about how the data controller shall fulfil this obligation.  In other words, if the data controller responds to email that requests this information in a timely manner, the obligation is met.However, having a well-written public Privacy Policy page on the site may be a better and more economical way of fulfilling this obligation than having to deal with a lot of individual requests for this information.