Privacy notice basics without the legal theater
A privacy notice is the page that tells people what you do with their data. It is not a legal costume. If a customer cannot tell who you are, why you have their email, and how to complain, the notice has failed even if it is long.
Write it for the person who will read it
Start from the ICO’s right to be informed. The duty is to tell people, in clear language, the things they need in order to understand what is happening to their information. A notice copied from a bank, or from a generator, usually fails that test because it describes a company you are not.
Name your organisation, the country you operate from, and a contact that a person can actually use. If you have a data protection lead, name the role. If you do not, name the mailbox that will be read. A notice with no working contact is a poster.
Say the five things, in that order
- What you collect. Email, payment details, an address, a photo. List the real fields, not “various data”.
- Why. One reason per use. Marketing is not the same reason as delivering an order. If you do both, say both.
- Who else sees it. Payment providers, email tools, accountants. Name the category, and name the company where you can.
- How long you keep it. A period, or the event that starts the clock, such as the end of a contract.
- The person’s choices. Access, correction, deletion, and the right to complain to the ICO. Link to the ICO. Do not make people search for the regulator.
Do not hide the notice behind the banner
The cookie banner is not a substitute. People should be able to open the notice before they create an account, from the footer, on a page that works without accepting optional cookies. If the only way to read it is after signup, you have asked for agreement to a document they could not see.
Update the date when the practice changes, not when you remember the page exists. A new tool that stores customer records is a change. A font change is not. When you add a tool, the notice and the contract with that tool should move together. The legal cost of adding tools is covered separately in when to stop adding tools.
What this article will not do
It will not give you a template to paste. The ICO’s guidance for organisations is the place to check the current duties. If you are unsure whether you are a controller, that is a question for advice on your facts, not a sentence this magazine can finish for you.
If you are a customer trying to read someone else’s page, start with how to read a product privacy page.