Harper James advises UK businesses on privacy notices under the UK GDPR and the Data Protection Act 2018, helping start-ups, scale-ups and established companies explain their data use clearly. A privacy notice is not a formality. It tells customers, staff, suppliers and website users what personal data the organisation collects, why it uses it and what rights individuals have.
A useful notice identifies the organisation responsible for the data, the categories of personal data collected, each processing purpose, the relevant lawful basis and the retention period. It should also explain data sharing, international transfers, individual rights, complaint routes and any automated decision-making or profiling. Separate notices are often more effective for different audiences, such as employees, job applicants, customers and website visitors.
Businesses should review their notices against their actual processing records, contracts, cookie settings and internal procedures. Read a practical guide to privacy notice requirements before drafting or refreshing the document. The wording must match operational reality. Stating that data is retained for a fixed period, for example, creates a problem when the business has no retention schedule or deletion process.
Artificial intelligence, workplace monitoring, online advertising and large-scale analytics have made transparency more demanding. Notices should explain the role of new tools in plain English, including the data used, the purpose of the processing and whether a supplier receives the information. Cookie banners and direct marketing also require separate consideration under the Privacy and Electronic Communications Regulations, rather than being dealt with through a privacy notice alone.
The Data (Use and Access) Act 2025 introduces changes on a phased timetable, so businesses should check which provisions are in force and update their records, notices and procedures accordingly. A sensible review starts with a data mapping exercise, followed by a comparison between the notice and the organisation’s Article 30 records, contracts, consent mechanisms and retention policy. Harper James can review the notice as part of a wider Data Protection Health Check or provide continuing data protection support through an appropriate service plan.