Under UK GDPR (our data protection law) people (‘data subjects’) have a right to know how you will use their information before they give it to you.  A privacy notice lets people know what you are going to do with their information.  It also helps reassure them that you know how to keep personal information safe, that you will share it responsibly and lawfully and will delete it safely when you no longer need it. Having a privacy notice will engender trust from individuals and other organisations, and demonstrate to the ICO that you take your data protection responsibilities seriously.

What must be in a privacy notice?

Your privacy notice must include the following:

• the types of personal information you collect
• where personal information comes from if not directly from the person concerned
• why you have personal information and what you do with it
• what your lawful basis is for having and processing personal information
• how long you will keep it for
• who you will share it with, and
• what people’s rights are with regard to their personal information.

By having a privacy notice that is simple and easy to read, understand and access you will be meeting your transparency obligation.

What’s next?

Once you have a privacy notice, you should give it to people when you first seek to collect their personal information.  If you receive personal information indirectly, i.e. from someone other than the data subject, you must them with provide your privacy notice as soon as possible and in any event, within 1 month of receiving their personal information.

Where does the privacy notice go?

Transparency and accessibility are key and you need to make the privacy notice freely available.  Here are some examples of where it could go:

• On your website
• On email footers
• As a web address in voicemail
• On a contact us page
• In print form

Make it available at all points where a data subject provides personal information to your organisation.

Review and update your privacy notice

It’s important that you review your privacy notice periodically to make sure that it is up to date and reflects the way in which you handle personal information now.  As businesses grow and evolve, they may process data differently – for example, by changing how they manage payroll, or issue invoices. If you make changes to how your business processes personal data, you need to reflect these in your privacy notice. Then you need to proactively bring it to the attention of the people whose personal information you process.

We can help you understand your obligations in more detail, and support you in demonstrating your compliance with UK privacy protection legislation. Give us a no obligation call and we would be happy to answer your questions.