Transparency is the part of the first principle that people can check. If you process personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out., you must tell people what you are doing with it, in a form they can understand, at the right time. The privacy notice is how you do that, and it is the document every later dispute is measured against.
What must be in it
The content is fixed by Articles 13 (data collected from the person) and 14 (data obtained from elsewhere). In practice:
| Topic | What to say |
|---|---|
| Who you are | Your identity and contact details, and your data protection officerData protection officerA protected adviser who monitors compliance and is the contact point for the regulator. Mandatory for public authorities and some large-scale processing.’s if you have one |
| Why | Each purpose, and the lawful basis for each |
| Legitimate interestsLegitimate interestsA lawful basis needing a three-part test: a legitimate purpose, necessity, and a balance against the individual's interests and rights. | What they are, where that is the basis |
| Who receives it | Recipients or categories of recipient |
| Transfers | Any transfer outside the UK and the safeguard relied on |
| How long | Retention periods, or the criteria that set them |
| Rights | Access, rectification, erasure, restriction, objection, portability, and how to complain |
| Consent | The right to withdraw it, where consent is the basis |
| Obligation | Whether providing the data is required, and what happens if they do not |
| Automated decisions | Their existence, the logic, and the significance and consequences |
| Source | For Article 14 cases, where the data came from |
When to give it
For data collected from the person, at the time of collection. For data obtained elsewhere, within a reasonable period and at the latest within one month, or at first contact, or before disclosure to another recipient, whichever is soonest.
The right to object must be brought to the person’s attention explicitly, clearly and separately from other information, at the latest at the first communication.
The Article 14 exceptions
Where data comes from a third party, you need not give the notice if the person already has the information, if it would be impossible or involve disproportionate effort, if obtaining or disclosure is required by law, or if the data must stay confidential under a professional secrecy obligation. Disproportionate effort is a test, not a label: record why it applies and what you did instead, such as publishing the information.
How to write it
Concise, transparent, intelligible and easily accessible, in clear and plain language. Layer it: a short notice at the point of collection with the essentials, linking to the full one. Use the same purpose wording as the record of processing. Date it, and keep old versions, because a complaint will ask what the notice said on the day the data was collected.
Common failures
- A single notice for every product, so no purpose is specific.
- Lawful bases listed in a block, not matched to purposes.
- Retention given as “as long as necessary”.
- Recipients described as “partners”.
- Legitimate interests named but never described.
For a complaint
Cite the notice in force at the time, quote the passage, and show the gap between what it said and what happened. Transparency failures are rarely the whole complaint, but they are almost always part of it.