This article was published in 2019. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
As an organisation, you are obliged to inform your employees, customers and (website) visitors about the privacy-sensitive personal data you process. You…
As an organisation, you are obliged to inform your employees, customers and (website) visitors about the privacy-sensitive personal data you process. You must clearly state which data you process and for what purposes. Does your privacy notice, also known as a privacy statement, meet the requirements of the General Data Protection Regulation (GDPR)? When do you need one, and what should a good privacy statement include? We explain this and more in this article.
**When is a privacy notice / privacy statement required? **The General Data Protection Regulation (GDPR) has been in force since 25 May 2018. Almost every organisation processes personal data and is therefore affected by it. It is very likely that your organisation is also subject to the GDPR.
Under the GDPR, you have both an accountability obligation and a duty to inform. In essence, this means that you 1) must be able to demonstrate that you have taken measures to protect the privacy of the data subject and 2) must adequately inform the data subject about the processing of their data. An online privacy statement is a suitable means of informing people. Drawing up a privacy statement also forces you to think about how you process and protect personal data. In short: how do you handle personal data and how do you protect privacy? That is precisely the aim of the new privacy rules.Minimum requirements for a privacy notice / privacy statement
As a minimum, your privacy notice / privacy statement must include the following information:
- The identity and contact details of the controller and, where applicable, of the parties that process personal data on behalf of the controller.
- The contact details of the data protection officer (DPO), if there is one.
- The purpose and legal basis of the processing. If the organisation relies on a legitimate interest, state what that interest is.
- Recipients of the personal data.
- Whether the personal data are transferred outside the European Economic Area (EEA) or to an international organisation, and on what legal basis.
- The retention period of the data.
- The rights of the data subject, such as the right of access, rectification or erasure.
- The right of the data subject to withdraw consent given for a particular processing operation at any time.
- The right of the data subject to lodge a complaint with the competent privacy supervisory authority.
- Whether, and why, the data subject is obliged to provide the personal data, and what the consequences are if the data are not provided.
- Whether automated decision-making, including profiling, is used, and how these decisions are made.
- If the data were obtained from another organisation: the source of the personal data and, where applicable, whether they came from publicly accessible sources.