GDPR Q21

What information should be in a privacy notice?

Q21. What information should be in a privacy notice?

Category: Notices

Privacy notices explain how you use personal data. They help people understand and trust your organisation.

In simple terms

Tell people who you are, why you need their data, and how long you keep it.
Explain their rights and how to exercise them.
Keep notices clear, accessible, and up to date.

Essential information

Articles 13 and 14 list the minimum content. Include your contact details, your DPO’s contact details (if you have one), purposes, lawful bases, categories of recipients, and retention periods.

Explain whether data will be transferred internationally and the safeguards used.
Tell people if providing data is optional or required and the consequences of not providing it.
List the rights available, including access, rectification, erasure, restriction, portability, and objection.
If you obtained data from another source, explain where it came from and when.

Presentation tips

Use layered notices, headings, and simple language. Provide versions tailored for children where appropriate.

Highlight key points with icons or summaries.
Link to more detailed sections for those who want extra information.
Review notices whenever you change a process or launch a new product.

Practical steps to take

Audit existing notices against Articles 13 and 14.
Map each data collection point to the relevant notice.
Test readability with real users, including people with additional needs.
Update notices promptly when processing changes.
Version-control your notices and keep an archive for reference.

Real-life examples

Website privacy notice

An online service uses a layered notice with a simple summary and links to detailed sections about data sharing, retention, and rights.

Employee privacy notice

An employer provides staff with a tailored notice covering payroll, benefits, monitoring, and retention periods.

Helpful reminders

Make notices easy to find—do not hide them in terms and conditions.
Update notices when you introduce new partners or tools.
Ensure translated versions stay accurate if you support multiple languages.

Key takeaway

A clear privacy notice builds trust—tell people exactly what happens to their data and how to stay in control.