Privacy notice

Articles 13 and 14 of the UK GDPR require you to tell people what you do with their personal data, at the point you collect it. The privacy notice is how that is done, and it is the only data protection document most of your customers will ever read. It is also the first thing a complainant sends to the Information Commissioner's Office, which is why a notice that does not match the business is worse than a short one that does.

It is not the same as a data protection policy

This notice faces outwards: it explains to customers and website visitors what happens to their information. A data protection policy faces inwards and tells your own people how to handle it. Businesses regularly publish one and believe they have both. You need each, and if you have staff you need a third, because workers and job applicants have to be given their own notice covering recruitment, monitoring, payroll and references.

The table at clause 4 is the work

It asks, for each thing you do with personal data, what you collect, why, the lawful basis, who you share it with and how long you keep it. Delete rows that do not apply, add anything missing, and check it against your record of processing activities. Completing it properly is the point of the exercise, because it surfaces the processing nobody had written down: the abandoned CRM, the spreadsheet of enquiries, the marketing tool holding contacts who never consented.

Retention is where most notices go vague. "As long as necessary" tells the reader nothing and tells a regulator less. A period tied to a reason, such as six years after the end of a contract for limitation purposes, is easier to justify and easier to operate.

Lawful basis, chosen rather than defaulted to

Consent has to be freely given and capable of being withdrawn, which makes it the wrong basis for processing you will carry on doing regardless. Performance of a contract and legitimate interests carry most ordinary business processing, and where legitimate interests is used the balancing assessment should exist somewhere you could produce it.

What sits alongside it

A cookie policy where the website sets cookies, which is almost every website, and the two have to agree with each other and with the banner. Where personal data leaves the UK the notice has to say so, and the transfer needs a mechanism behind it.

If you handle health or other sensitive data, children's data, or make automated decisions about people, the notice needs more than completion. Our UK GDPR and data protection solicitors build the set together.