The person already has the information. (Arts 13(4), 14(5)(a)) For indirectly collected data, where providing it is impossible or would involve disproportionate effort, or where law requires the collection or confidentiality. (Art 14(5))

What happens if it goes wrong?

Regulatory: Missing or misleading information breaches the transparency principle and Arts 12 to 14. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change. Criminal: No offence. Civil: Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.

What is a privacy notice, and what must it say?

Q: When you must give it

At the time you collect personal data from the person. (UK GDPR Art 13) Within a reasonable period, at the latest one month, after obtaining data from another source; or at first contact or first disclosure if sooner. (Art 14(3)) Before you use data for a new purpose. (Arts 13(3) and 14(4))

A privacy notice is the information you must give people about how you use their personal data: who you are, why and on what basis you use it, who you share it with, how long you keep it and what rights they have. You must give it when you collect data from them, or within a month if you get it from someone else.

Data protection

What it is

Articles 13 and 14 UK GDPR set out the content. The information must be concise, transparent, intelligible and easily accessible, in clear and plain language, especially for children. From 2026-02-05 the DUAA allows controllers not to provide Art 13 information about further processing for research where that would be impossible or involve disproportionate effort.

When you must give it

At the time you collect personal data from the person. UK GDPR Art 13
Within a reasonable period, at the latest one month, after obtaining data from another source; or at first contact or first disclosure if sooner. Art 14(3)
Before you use data for a new purpose. Arts 13(3) and 14(4)

When you need not

The person already has the information. Arts 13(4), 14(5)(a)
For indirectly collected data, where providing it is impossible or would involve disproportionate effort, or where law requires the collection or confidentiality. Art 14(5)

Who is responsible

The controller. Joint controllers must make the essence of their arrangement available.

What it involves

Identity and contact details, and the DPO's.
Purposes and lawful bases, including legitimate interests relied on.
Recipients and international transfers.
Retention periods.
Rights, including to complain to the regulator and to the controller.
Whether data is required, the source if not collected directly, and any automated decision-making.

If it goes wrong

Regulatory: Missing or misleading information breaches the transparency principle and Arts 12 to 14. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change.
Criminal: No offence.
Civil: Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.

Go further

The law: UK GDPR, DUAA 2025
Guides: Transparency and privacy notices, Fairness as a distinct test

Sources

Primary UK GDPR, Article 13 legislation.gov.uk
Primary UK GDPR, Article 14 legislation.gov.uk
Primary Data (Use and Access) Act 2025, section 77 legislation.gov.uk
Regulator UK GDPR guidance and resources Information Commissioner's Office

Updated 2026-11-09