Glossary term
Privacy Notice
Subject: Technology, Cyber and Data, Data Protection and Privacy
Also known as: Privacy policy, Fair processing notice, Privacy statement
A privacy notice is the statement an organisation gives people to explain what personal data it collects, why, how it is used and shared, how long it is kept, and what rights they have.
Explanation
Transparency is a basic privacy principle, and the notice is how it is met. Under the GDPR it must say who the controller is, what the purposes and legal bases are, who receives the data, whether it goes abroad, how long it is kept and how to complain. It must be concise, easy to find and written in plain language, which is hard to square with long legal text. Many organisations use layers: a short summary up front with detail behind it, and just-in-time notices at the point of collection. Notices need updating when practices change, and the text has to match what the business really does. A privacy policy on a website often serves as the notice, though staff and applicants need their own. A notice that contradicts actual practice counts as a failure, however well it is written.
Example
A recruitment firm collects CVs through its website. Its privacy team replaces a 12-page policy with a short layered notice at the upload button, saying how CVs are used, that they are shared with hiring clients, and that they are deleted after 12 months. A link leads to the full version for those who want it.
Not to be confused with
- Consent
- A notice informs people about processing. Consent is their agreement to it, and a notice alone does not create consent.