A privacy notice explains how an organisation collects, uses, stores and shares personal data. Under the UK GDPR and the Data Protection Act 2018, it should give people clear information about processing before or when their data is collected. The notice should cover each relevant audience, such as customers, employees, website visitors, suppliers and job applicants, rather than relying on one general document that omits important details.
Harper James advises businesses on data protection and Data Protection Officer support under the laws of England and Wales.
A privacy notice normally identifies the organisation responsible for the data and provides its contact details, including the Data Protection Officer where one has been appointed. It should explain the purposes of processing, the relevant lawful basis for each purpose, the categories of personal data involved, recipients or categories of recipients, retention periods, and any transfers outside the United Kingdom. It should also explain individuals’ rights, including access, rectification, erasure, restriction, objection and data portability where applicable, together with the right to complain to the Information Commissioner’s Office.
The notice should state whether information is required by law or contract, or whether providing it is optional, and describe the consequences of not providing it. Where the organisation uses automated decision-making or profiling that produces legal or similarly significant effects, the notice should explain the logic involved and the likely consequences in an understandable way.
Use plain language, short sections, descriptive headings and a contents list for longer notices. Explain the actual processing rather than copying broad phrases such as “for business purposes”. A layered approach can provide a short explanation at the point of collection, with a link to fuller information. Separate privacy information from marketing consent, as a privacy notice explains processing and does not itself create consent for electronic marketing under the Privacy and Electronic Communications Regulations.
The notice should match the organisation’s real data flows, contracts, systems and retention practices. Before publication, map each source of personal data to its purpose, lawful basis, recipients and retention period. Review the notice when the organisation introduces a new product, changes a supplier, begins international transfers, changes tracking technologies or starts a new form of profiling. Keep records of changes and provide advance information where a material change affects existing processing.