Writing a GDPR-compliant privacy notice (template included)

Transparency and informing the public about how their data are being used are two basic goals of the GDPR. This article explains what is a privacy notice and offers a privacy notice template to help you comply with the law.

The EU General Data Protection Regulation (GDPR) is a first step toward giving EU citizens and residents more control over how their data are used by organizations. If your company handles the personal information of people in the EU, then you must comply with the GDPR, no matter where you are in the world. The fines for violating people’s new privacy rights can be up to 4 percent of your global revenue or €20 million, whichever is higher.

A GDPR privacy notice is an important way to help your customers make informed decisions about the data you collect and use. We’ve brought together some information from the law itself and from the EU’s guidance documents to help you understand the components of a good privacy notice. And at the bottom we’ve included a privacy notice template that you can adapt to your own organization.

What is a privacy notice?

A privacy notice is a public document from an organization that explains how that organization processes personal data and how it applies data protection principles. Articles 12, 13, and 14 of the GDPR provide detailed instructions on how to create a privacy notice, placing an emphasis on making them easy to understand and accessible. If you are collecting data directly from someone, you have to provide them with your privacy notice at the moment you do so.

Note that the terms “privacy notice” and “privacy policy” do not actually appear in the text of the GDPR and are essentially interchangeable. The guidelines explained in this article apply to any public documents in which your organization describes its data processing activities to customers and the public.

According to the GDPR, organizations must provide people with a privacy notice that is:

  • In a concise, transparent, intelligible, and easily accessible form
  • Written in clear and plain language, particularly for any information addressed specifically to a child
  • Delivered in a timely manner
  • Provided free of charge

The GDPR also stipulates what information an organization must share in a privacy notice. There is a slight variation in requirements depending whether an organization collects its data directly from an individual or receives it as a third party.

If an organization is collecting information from an individual directly, it must include the following information in its privacy notice:

  • The identity and contact details of the organization, its representative, and its Data Protection Officer
  • The purpose for the organization to process an individual’s personal data and its legal basis
  • The legitimate interests of the organization (or third party, where applicable)
  • Any recipient or categories of recipients of an individual’s data
  • The details regarding any transfer of personal data to a third country and the safeguards taken
  • The retention period or criteria used to determine the retention period of the data
  • The existence of each data subject’s rights
  • The right to withdraw consent at any time (where relevant)
  • The right to lodge a complaint with a supervisory authority
  • Whether the provision of personal data is part of a statutory or contractual requirement or obligation and the possible consequences of failing to provide the personal data
  • The existence of an automated decision-making system, including profiling, and information about how this system has been set up, the significance, and the consequences

If an organization obtains your data indirectly (via another organization) its privacy notice must provide all the same information, except for:

  • Whether the provision of personal data is part of a statutory or contractual requirement or obligation and the possible consequences of failing to provide the personal data

And instead must add:

  • The categories of personal data obtained

Per Article 14(3), if you obtain personal data from a third party, you must communicate the above information to the data subject either: no later than one month after you have obtained the data, at the time you first communicate with the data subject, or before sharing the data with another organization.

Generally, a privacy notice will be provided in writing and, where appropriate, supplied electronically. Every organization that maintains a website should publish their privacy notice there, under the title “Privacy Policy,” and it should be accessible via a direct link from every webpage. If a website collects any personal data online, the privacy notice or a link to it should be provided on the same page where the data collection occurs. The GDPR also states that privacy notices must be available orally upon request to ensure comprehension and to aid the visually impaired.

GDPR privacy notice best practices

Privacy notices should avoid using qualifiers such as “may,” “might,” “some,” “often,” etc. as they are purposefully vague. The writing should be in the active tense and sentences and paragraphs should be well structured, using bullets to highlight specific points of note. Avoid unnecessarily legalistic and technical terminology.

According to the European Commission’s GDPR guidelines, the phrases below are not sufficiently clear as to the purposes of processing. (We took these examples directly from the document.)

  • “We may use your personal data to develop new services” (as it is unclear what the “services” are or how the data will help develop them)
  • “We may use your personal data for research purposes” (as it is unclear what kind of “research” this refers to)
  • “We may use your personal data to offer personalised services” (as it is unclear what the “personalization” entails)

On the other hand, these kinds of phrases are much better:

  • “We will retain your shopping history and use details of the products you have previously purchased to make suggestions to you for other products which we believe you will also be interested in” (it is clear that what types of data will be processed, that the data subject will be subject to targeted advertisements for products and that their data will be used to enable this)
  • “We will retain and evaluate information on your recent visits to our website and how you move around different sections of our website for analytics purposes to understand how people use our website so that we can make it more intuitive” (it is clear what type of data will be processed and the type of analysis which the controller is going to undertake)
  • “We will keep a record of the articles on our website that you have clicked on and use that information to target advertising on this website to you that is relevant to your interests, which we have identified based on articles you have read” (it is clear what the personalization entails and how the interests attributed to the data subject have been identified)

GDPR privacy notice template

Here we have provided a sample privacy notice template for a website that collects personal data directly from individuals. It contains all the necessary information in a clean, easy-to-digest format. You should modify the contents depending whether this is a privacy policy for your website or a privacy notice about some other data processing activity.

Our Company Privacy Policy

Our Company is part of the Our Company Group which includes Our Company International and Our Company Direct. This privacy policy will explain how our organization uses the personal data we collect from you when you use our website.

Topics:

  •       What data do we collect?
  •       How will we use your data?
  •       Marketing
  •       Accessing your data and making corrections
  •       Cookies
  •       Privacy policies of other websites
  •       Changes to our privacy policy
  •       How to contact us

What data do we collect?

Our Company collects data from you when you register online or place an order for any of our products or services. We also collect data when you voluntarily complete a customer survey or provide feedback on any of our message boards or via email. Your website usage information is collected using cookies.

How will we use your data?

Our Company collects your data to process your order, manage your account and, if you agree, to email you with special offers on other products and services we think you might like.

Our Company uses the data it collected from your visits to its website to personalize the Our Company website for you according to your preferences.

If you agree, Our Company will share your data with our partner companies so that they may offer you their products and services.

Our Company PLC will not share your data for marketing purposes with any company outside the Our Company Group.

When Our Company processes your order, it may send your data to, and also use the resulting information from, credit reference agencies to prevent fraudulent purchases.

Marketing

Our Company would like to send you information about products and services of ours that we think you might like, as well as those of our partner companies. If you have agreed to receive marketing, you may always opt out at a later date.

You have a right at any time to stop Our Company from contacting you for marketing purposes or giving your data to other members of the Our Company Group.

If you no longer wish to be contacted for marketing purposes, please click here.

Accessing to your data and making corrections

You have the right to request a copy of the data that Our Company holds about you. If you would like a copy of some or all of your personal data, please email or write to us at the following address. Our Company may charge a small fee for this service.

Our Company wants to make sure that your personal data is accurate and up to date. You may ask us to correct or remove data you think is inaccurate.

Cookies

Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. This information is then used to track visitor activity on our website and to compile statistical reports on website activity.

For further information, visit allaboutcookies.org.

You can set your browser not to accept cookies, and the above website tells you how to remove cookies from your browser. However, in a few cases some of our website features may not function as a result.

Privacy policies of other websites

The Our Company website contains links to other websites. Our privacy policy applies only to our website, so if you clink on a link to another website, you should read their privacy policy.

Changes to our privacy policy

Our Company keeps its privacy policy under regular review and places any updates on this web page. This privacy policy was last updated on 22 June 2017.

How to contact us

If you have any questions about our privacy policy or information we hold about you, please do not hesitate to contact us.

By email at:

Or write to us at:

Leave a Reply

Your email address will not be published. Required fields are marked *