Checklist: What to include in your organisation’s privacy notice (UK)

Introduction

This checklist provides guidance on the drafting of privacy notices (sometimes also called an information notice or privacy policy) informing individuals such as clients, users, staff or others about the use of their personal data. It can be used by both in-house counsel and private practitioners advising organisations.

The checklist is UK-focused but covers:

• general requirements under the EU GDPR, as these may still be relevant to some UK organisations to which the EU GDPR applies due to the application of the extra-territorial scope provisions in Article 3(2), EU GDPR; and
• the ICO’s interpretation of such EU GDPR requirements.

However, it does not cover any local EEA data protection law requirements or interpretation of the EU GDPR by EEA data protection regulators.

The checklist addresses the following steps:

1. What to include in the privacy notice
2. When to give the privacy notice
3. How to give the privacy notice
4. Fulfilling ongoing governance and compliance requirements

The checklist is presented as a list of requirements that you can tick off as they are addressed. At the end of the document there are explanatory notes, and specific notes corresponding to the relevant step in the checklist.

Key definitions, such as ‘controller’, ‘processor’, ‘data subject’, ‘personal data’ and ‘processing’, are further explained in How to Guide: Understanding key data protection definitions.

This checklist can be used in conjunction with How-to guide: How to ensure compliance with the GDPR and Checklists: GDPR compliance self-assessment audit and Lawful processing of personal data under the GDPR.

Step 1 –What to include in the privacy notice

Step 2 – When to give the privacy notice
 

Step 3 – How to give the privacy notice

Step 4 – Fulfilling ongoing governance and compliance requirements

Explanatory notes

General notes

Legal framework

The checklist covers the requirements under:

• Regulation 2016/679 – General Data Protection Regulation (EU GDPR);
• the EU GDPR as it forms part of the domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 (UK GDPR);
• the Data Protection Act 2018 (UK DPA 2018);
• the UK Information Commissioner’s Office’s guidance on the right to be informed (‘ICO right to be informed guidance’) and transparency section of the accountability framework (‘ICO transparency guidance’); and
• Article 29 Working Party Guidelines on transparency under Regulation 2016/679 (As last Revised and Adopted on 11 April 2018) (‘EDPB transparency guidelines’) – the Article 29 Working Party has been replaced by the European Data Protection Board.

References to the ‘GDPR’ mean either the EU GDPR or the UK GDPR, unless specified otherwise.

Articles 12–14, GDPR set out the key information an organisation must provide when processing the personal data of individuals.

Why have a privacy notice?

A privacy notice is a way of addressing the transparency requirements under data protection laws, which ensure that individuals (or data subjects) are fully informed and given clear information about how the organisation will process their personal data.

The requirement to have a privacy notice is separate from other obligations such as establishing a valid lawful basis to process the personal data (see article 6, GDPR). However, the content of your privacy notice can also hamper your ability to lawfully process personal data – for instance:

• if you request consent to process personal data, this will not be ‘fully informed’ if you do not present individuals with relevant privacy information upfront; and
• relying on ‘legitimate interests’ (see explanatory notes at 1.9) will be difficult if individuals are not aware of how you will use their data.

Exceptions and exemptions to the requirement for a privacy notice

Consider whether any of the limited exceptions and exemptions to the requirement to provide the prescribed information in a privacy notice apply to your organisation.

When the information is collected directly from the individual, if the individual already has the information you do not have to provide it again.

When you collect personal data from a source other than the individual it relates to, privacy information does not have to be provided if:

• the individual already has the information; 
• providing the information to the individual would be impossible; 
• providing the information to the individual would involve a disproportionate effort; 
• providing the information to the individual would render impossible or seriously impair the achievement of the objectives of the processing; 
• you are required by law to obtain or disclose the personal data; or 
• you are subject to an obligation of professional secrecy regulated by law that covers the personal data. 

See articles 13(4) and 14(5), GDPR.

Sources of information for the notice

Your organisation should maintain certain records as part of its data protection compliance obligations, such as records of its data processing activities (ROPA) (article 30, GDPR) or a data inventory, which will provide much of the information you need for the privacy notice. If this record does not exist, you may need to conduct an information audit or data-mapping exercise to identify the relevant data flows in terms of what personal data you hold and what you do with it.

Implications of non-compliance

Infringement of the transparency requirements under the GDPR can attract the highest tier of fines of up to the greater of €20 million / £17.5 million and 4% of global annual turnover, or other enforcement action from the regulator. There can also be reputational damage resulting from individuals losing trust in your ability to use their information responsibly and compliantly.

Step 1 – Content of the privacy notice

1.1 Controller details

Set out the full entity name and contact details of the controller in the notice (articles 13(1)(a) and 14(1)(a), GDPR).

1.2 Controller’s representative’s details

If your organisation is required to have a representative (for example, if they are not established respectively in the UK or in the EEA), set out their full entity name and contact details in the notice (articles 13(1)(a) and 14(1)(a), GDPR).

1.3 Data protection officer’s contact details

You can use an email address or a contact form via which individuals or regulators can reach the data protection officer (DPO) (articles 13(1)(b) and 14(1)(b), GDPR).

1.4 Categories of personal data you collect and how you collect this

This information is not legally required if the data is obtained directly from the relevant individual, but it is practically impossible to draft the notice without this. Consider both information collected directly from the individual and other information observed from their behaviour.

1.5 Categories of personal data you have acquired

The privacy notice only has to include this information if the data is not obtained directly from the relevant individual, although it is good practice to include this anyway (article 14(1)(d), GDPR) (see explanatory notes at 1.4).

1.6 Sources of personal data

The privacy notice only has to include this information if the data is not obtained directly from the relevant individual. If applicable, you need to specify if the data originates from publicly accessible sources (article 14(2)(f), GDPR).

If, for example, you are buying in personal data from another organisation, you must provide your own privacy notice to data subjects (unless an exemption or exception applies). 

1.7 Purposes for which you will process personal data

Detail why you are using the data to give the individual a clear picture of what will happen to their information (articles 13(1)(c) and 14(1)(c), GDPR).

1.8 Lawful bases relied on to process personal data

For each processing activity, you need to establish a valid lawful basis to process the personal data (see article 6, GDPR). These broadly include consent, performance of contract, performance of a legal obligation and ‘legitimate interests’ (see explanatory notes at 1.9) and other reasons. Additional exemptions / conditions must be met if special categories of personal data, such as health or ethnicity data (see article 9, GDPR and Schedule 1, UK DPA 2018), will be processed (articles 13(1)(c) and 14(1)(c), GDPR), (see also articles 6(1) and 9, GDPR).

1.9 Any legitimate interests pursued by the controller or a third party

You can use personal data if necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where the data subject’s rights and interests requiring protection of their data override these interests, in particular where children are concerned (articles 13(1)(d) and 14(2)(b), GDPR), (see also article 6(1)(f), GDPR).

The GDPR specifically references use of client or employee data, marketing, fraud prevention, intra-group transfers, or IT security as potential legitimate interests, but there may be others. Certain compliance steps will determine if you can rely on legitimate interests, such as carrying out a legitimate interests assessment (LIA).

1.10 Recipients of the personal data – by name or by category

This requirement is contained in articles 13(1)(e) and 14(1)(e), GDPR.

The ICO right to be informed guidance says that in your privacy notice you must inform data subjects whom you will share (or sell) their information with and why (unless an exception or exemption applies). This includes details of group companies, suppliers and partners or customers that will have access to the data. You can either name them specifically or state the categories of recipient with enough detail for the individual to understand the nature of the recipient’s role in the processing of their data (eg the type of business at least).

1.11 International data transfers

The notice needs to state if the controller will transfer the personal data to a country or to an international organisation outside the UK or EEA. ‘Transfer’ includes both physical data transfers and remote access to data. If applicable, you must also outline:

• if there is an adequacy decision; or
• what alternative transfer mechanism (or adequate safeguards) are used; and
• if so, how the individual can obtain or access a copy of the transfer mechanism.

This requirement is contained in articles 13(1)(f) and 14(1)(f), GDPR. See also chapter V, GDPR.

An adequacy decision may be made by the UK Secretary of State (referred to as a 'data bridge' in the UK) or the European Commission, as applicable. It effectively whitelists countries assessed as adequate in terms of data protection (with some adequacy decisions (data bridges) being subject to certain conditions, eg, the EU-US Privacy Framework (July 2023) and the UK-US Data Bridge (October 2023), a UK extension to the EU-US Privacy Framework) and allows personal data to be transferred there without additional safeguards. If there is no adequacy decision, and you are relying on an article 46 transfer mechanism (ie, that appropriate safeguards are in place) you must carry out a transfer risk assessment (see the ICO’s Transfer risk assessments guidance). Appropriate safeguards include standard contractual clauses (in the UK in the form of international data transfer agreement and the addendum to the EU standard contractual clauses) and binding corporate rules.

See the ICO’s Brexit guidance and the ICO’s International transfers guidance.

1.12 Details of any countries outside the UK or EEA where personal data will be transferred

The GDPR does not expressly say that you have to list the countries to which personal data is being exported. However, this information may help an individual to make an informed decision about whether they are comfortable with the controller doing this with their data.

1.13 Data retention

The notice must specify the data retention period or the criteria you use to determine how long personal data will be stored (articles 13(2)(a) and 14(2)(a), GDPR).

1.14 Data subject rights, including the right to object

The notice must outline the data subject rights available to the individual, in particular that they can request from the controller access to and rectification or erasure of personal data, or to restrict or object to processing concerning them, and the right to data portability. Not all of these rights will always be available to the individual, and exceptions and exemptions will apply.

The right to object must be brought to the individual’s attention clearly and separately from any other information. You need to make the right to object stand out (eg in bold, underlined, a different colour or through functionality).

These requirements are contained in articles 13(2)(b), 14(2)(c) and 21(4), GDPR.

1.15 Details of how the data subject can exercise their rights

Given that the GDPR requires controllers to have a process to deal with data subject requests, it is strongly recommended that you also tell them how to make a request. Asking data subjects to follow a process will also make requests easier for you to manage (although you will still need to respond to all valid requests even if they do not follow your preferred process).

1.16 Right to withdraw consent

Where processing is based on consent (express or implied), the notice needs to inform the individual that they have a right to withdraw consent at any time, but this will not invalidate processing up to that point (articles 13(2)(c) and 14(2)(d), GDPR).

1.17 Right to complain to data protection regulator

The notice needs to inform the individual that they have the right to make a complaint to the ICO or other relevant data protection regulator (known as a supervisory authority under EU GDPR) (13(2)(d) and 14(2)(e), GDPR).

1.18 Statutory or contractual requirements

The notice needs to specify if providing personal data is a statutory or contractual requirement, or necessary to enter into a contract, and what will happen if the individual does not do so. This only applies if the personal data is collected directly from the relevant individual (articles 13(2)(e) GDPR).

1.19 Solely automated decision-making, including profiling

The notice needs to explain whether you do any solely automated decision-making, including profiling, (of the kind referred to in article 22, GDPR) and, if so, include meaningful information about:

• the logic used; and
• the envisaged consequences for the individual.

This requirement is contained in articles 13(2)(f) and 14(2)(g), GDPR. See also article 22, GDPR. Use of AI models should be explained in this part of the privacy notice. The UK has not yet implemented an AI Act, but has published a draft AI Bill.  Note that the EU have now implemented the EU AI Act which is now in force and the EDPB has adopted an opinion on the use of personal data and the development and deployment of AI models.

1.20 Other automated decision-making and profiling

The GDPR is ambiguous about whether the privacy notice needs to disclose automated decision-making and profiling that you carry out aside from that covered by article 22, GDPR. It seems likely that this requirement will be covered in articles 13(2)(f) and 14(2)(g), GDPR.

In addition, the ICO right to be informed guidance recommends explaining your use of these processing activities and, in particular, your use of artificial intelligence (AI), for example.

Step 2 – When to give the privacy notice

2.1 Data collected directly from the individual

Where personal data is collected directly from the individual, the notice must be provided at the time of data collection (article 13(1), GDPR).

2.2 Data not collected directly from the individual

Where personal data is not collected from the individual (ie, you receive this from another source), the notice is provided within a reasonable time no later than one month after collection.

If you intend to use the personal data to communicate with the data subject, the latest you can provide the information is when you first communicate with the individual or disclose their data – this still needs to be within the one-month time limit. 

If you are collecting the data and will then disclose it to someone else, the latest you can provide the information is when you disclose the individual’s data – again, this still needs to be within the one-month time limit. 

These requirements are contained in article 14(3), GDPR.

Step 3 – How to give the privacy notice

3.1 Conciseness

Try not to overwhelm individuals with overly wordy explanations (article 12(1), GDPR).

3.2 Transparency

Ensure you do not omit or obfuscate key information (article 12(1), GDPR).

3.3 Intelligibility

Ensure the notice is legible, eg, not in tiny print, and in the language of the individuals who will read it (article 12(1), GDPR).

3.4 Easy access

Make sure that the individual can access the information easily, eg, does not have to click multiple times to get to the notice (article 12(1), GDPR).

3.5 Clear and plain English

Explain complex concepts in easy-to-understand terms (article 12(1), GDPR).

Avoid technical jargon. Consider having a basic ‘summary’ and also a ‘detailed explanation’ for those who want to read more (article 12(1), GDPR).

3.6 User-centric approach

Take a user-focused approach to privacy notices – think from the point of view of the data subject and what information they would want to know about the use of their information. Where appropriate, carry out user testing to evaluate how effective and comprehensible your notice is. Consider also the needs of specific types of users, such as children.

These are recommendations in the ICO right to be informed guidance and the ICO children and the UK GDPR guidance. The ICO’s 10 Step Guide to Sharing Information to Sharing Information to Safeguard Children and Guidance on ‘Likely to be assessed by Children’ are also relevant when processing personal data relating to children.

3.7 Means of conveying notice

The notice may be provided in writing or by other means, including electronically where appropriate (article 12(1), GDPR).

3.8 Orally providing the notice, if requested

If an individual requests, the information may be provided orally (subject to additional ID verification) (article 12(1), GDPR). We query how workable this is in practice however given that the information being provided is publicly available in any event, and that the ID requirement would mean the organisation collecting additional personal data.

3.9 The information in the privacy notice is provided for free

In most circumstances you cannot charge a fee to provide the information in the privacy notice – the individual has a legal right to be given this information (article 12(5), GDPR).  However, if the data subject request is manifestly unfounded or excessive, a reasonable fee may be charged, provided such charge reflects the administration cost for responding to the request.

3.10 Delivery of the notice

The notice needs to be delivered appropriately for the relevant audience and the relevant media. For example, the ICO right to be informed guidance recommends dashboards, layering, just-in-time notices and standardised icons (machine-readable). Also, ensure that mobile and smart device functionalities are factored in. From a privacy by design perspective, consider the ICO transparency guidance.

Step 4 – Ongoing governance and compliance

4.1 Regularly reviewing the notice

The ICO right to be informed guidance recommends regular reviews of privacy notices. In practice, if the privacy notice is not up to date and does not contain all of the relevant information about data processing, it will not be legally compliant.

4.2 Regular information audits

The ICO right to be informed recommends regular information audits. Check the results of the audit against the information in the privacy notice and make any necessary updates.

4.3 Using the data for a different purpose

You will need to provide privacy information to individuals before using personal data for a different purpose to that which you told them about in your original notice. This is to comply with the ‘purpose limitation’ principle, which requires personal data to be collected for specified, explicit and legitimate purposes and not further processed incompatibly with those purposes. Consent may also need to be obtained.

This requirement is contained in articles 13(3) and 14(4), GDPR. See also article 5(1)(b), GDPR. In relation to change of purpose, also see the ICO’s Purpose limitation guidance and the ICO What else do we need to consider?

Additional resources

Related Lexology Pro content

How-to guides:

Understanding key data protection definitions
How to ensure compliance with the GDPR
How to comply with data processing principles under the GDPR
How to establish a valid lawful basis for processing personal data under the GDPR
How to transfer personal data lawfully outside the UK
How to reduce the risk of a GDPR data breach
How to deal with a GDPR data breach
How to deal with an ICO dawn raid

Checklists:

GDPR compliance self-assessment audit
Lawful processing of personal data under the GDPR
Assessing whether an organisation is a controller or processor under the GDPR
Processor due diligence (data protection and cyber security)
Obtaining and managing consent under the GDPR
Data subject access rights under the GDPR
When and how to appoint a data protection officer
Making an international transfer of personal data under the UK GDPR
Complying with cookie requirements under the PECR and the GDPR

Reliance on information posted: 

While we use reasonable endeavours to provide up to date and relevant materials, the materials posted on our site are not intended to amount to advice on which reliance should be placed. They may not reflect recent changes in the law and are not intended to constitute a definitive or complete statement of the law. You may use them to stay up to date with legal developments but you should not use them for transactions or legal advice and you should carry out your own research. We therefore disclaim all liability and responsibility arising from any reliance placed on such materials by any visitor to our site, or by anyone who may be informed of any of its contents.