Financial companies handle clients’ personal data and outline the related data processing conditions in online privacy policies. Despite data privacy laws, legislative guidelines for these policies are lacking. This research aimed to address the current state of online privacy policies, firstly by proposing holistic criteria for what must be included in a website privacy policy. Thereafter, a case study methodology was applied to review online privacy policies in the financial industry in South Africa, applying the proposed criteria. The key findings of this research indicate that financial companies do not fully address the criteria relating to the data subject's choice and consent, the integrity and security of the data, enforcement and redress, and any further information transfer that may occur in terms of their online privacy policies. The proposed criteria offer value to financial companies by providing a measure by which to assess their online privacy policy content.