Explanation
A privacy notice is a document that provides individuals with information about how their personal data is processed, as required by Article 13 and 14 of the UK GDPR5. A privacy notice must include the following information, among others:
* the identity and contact details of the controller and, where applicable, the controller's representative and the data protection officer;
* the purposes and legal basis of the processing;
* the categories of personal data concerned;
* the recipients or categories of recipients of the personal data, including any third parties or international organisations;
* where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available;
* the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
* the existence of the rights of the data subject, such as the right to access, rectify, erase, restrict, object or port the data, and the conditions or limitations on those rights;
* the existence of the right to withdraw consent at any time, where the processing is based on consent;
* the right to lodge a complaint with a supervisory authority;
* whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;
* the existence of automated decision-making, including profiling, and meaningful information about the
* logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
A privacy notice does not need to contain details of the processor's staff, as this is not relevant or necessary for the data subject to understand how their personal data is processed. However, the controller may need to inform the data subject if their personal data is shared with a processor, and provide the identity and contact details of the processor, as part of the information on the recipients or categories of recipients of the personal data. References:
* Article 13 and 14 of the UK GDPR5