A privacy notice that does not match what systems actually do with personal data is a transparency failure, and regulators treat it as one. This template is the public privacy notice: the information Articles 13 and 14 of the GDPR and the UK GDPR require you to give people about how you use their data. It is not the internal staff policy, which is covered by the Privacy Policy Template. The template is written for privacy, legal and security leads who need a notice that is complete, readable and kept accurate as systems change, and it includes a mapping of each section to the legal requirement and a process to keep the notice true.
Status on 13 November 2026: this template reflects UK GDPR and EU GDPR Articles 13 and 14 as in force on that date. It is general information, not legal advice; have the final notice reviewed by your data protection officer or legal adviser.
How to use this template
- Replace text in square brackets, such as [Organisation], [DPO email] and [6 years], with your own details. Delete any section marked "if applicable" that does not apply, and say nothing rather than something vague.
- Build the notice from your record of processing activities, not from memory. Each purpose, lawful basis, recipient and retention period in the notice should trace to an entry in the record. See the Data Mapping and ROPA Guide and the ROPA Template.
- Write for the reader. Article 12(1) requires information in a concise, transparent, intelligible and easily accessible form, using clear and plain language, especially where it is addressed to a child. The ICO recommends common, everyday language and a layered approach: a short first layer with links to the detail.
- Avoid open-ended wording such as "we may share your data with partners". Name the recipients or their categories, and state what you do, not what you might do.
- The template is drafted against the EU GDPR and UK GDPR. If US state privacy laws or sector rules also apply, add their required disclosures in a jurisdiction annex. The Global Privacy Regulatory Map and the CCPA and CPRA Guide help identify them.
- UK users: the ICO states that its right to be informed guidance is under review following the Data (Use and Access) Act 2025. Check the current ICO guidance before publishing.
1. Who we are and how to contact us
[Organisation] ("we", "us") is the controller of the personal data described in this notice. Our registered address is [address], company number [number].
- Contact for privacy questions: [[email protected]] or [postal address].
- Data protection officer (if applicable): [name or role], [DPO email].
- Representative (if applicable): if we are established outside the [EU or UK] and offer services to, or monitor, people there, our representative is [name, contact details].
- Joint controllers (if applicable): for [activity], we act as joint controllers with [organisation]. The essence of our arrangement is [summary], and you can contact either of us.
2. The personal data we use and where it comes from
| Category of personal data | Examples | Source |
|---|---|---|
| [Identity and contact data] | [Name, email address, phone number] | [You, when you register or contact us] |
| [Account and authentication data] | [Username, hashed password, MFA enrolment, login history] | [You, and our systems when you sign in] |
| [Device and usage data] | [IP address, browser type, pages viewed, cookie identifiers] | [Your device, through cookies and similar technologies] |
| [Transaction data] | [Orders, payment status; card data handled by our payment provider] | [You and [payment provider]] |
| [Data from other sources] (if applicable) | [Business contact details, credit reference results] | [Named source, or category of source, and whether publicly accessible] |
| [Special category data] (if applicable) | [Health information you give us for accessibility requests] | [You] |
[If you must provide data by law or contract, or to enter a contract, say which data, why, and what happens if it is not provided, for example: "We need your email address to create an account. Without it we cannot provide the service."]
3. Why we use your data and our lawful basis
We use your personal data only for the purposes below. Each purpose has its own lawful basis.
| Purpose | Personal data used | Lawful basis | Legitimate interest (if relied on) |
|---|---|---|---|
| [Provide and administer your account] | [Identity, account data] | [Contract, Art. 6(1)(b)] | |
| [Keep our services secure, detect fraud and abuse] | [Account, device and usage data] | [Legitimate interests, Art. 6(1)(f)] | [Protecting users and systems from unauthorised access] |
| [Send marketing emails] | [Contact data, preferences] | [Consent, Art. 6(1)(a)] | |
| [Keep financial records] | [Transaction data] | [Legal obligation, Art. 6(1)(c)] | |
| [Process special category data] (if applicable) | [Health data] | [Art. 6 basis and Art. 9(2) condition] |
If we plan to use your data for a new purpose that is not compatible with the original one, we will tell you before we start and explain the lawful basis.
4. Who we share your data with
- Service providers acting for us (processors): [hosting, email delivery, customer support, analytics]. They act on our instructions under contract. [List names, or categories with an offer to provide names on request.]
- Other controllers: [payment providers, professional advisers, insurers], who use the data for their own purposes under their own notices.
- Authorities: [regulators, law enforcement] where the law requires it.
- Corporate changes: [a buyer or successor] if [Organisation] is sold or merged, under confidentiality terms.
We do not sell your personal data. [Remove this line if it is not true in every jurisdiction where you operate.]
5. International transfers
[If applicable] Some recipients are located in [countries]. Where the destination does not have an adequacy decision [or UK adequacy regulations], we use [standard contractual clauses / the UK International Data Transfer Agreement or Addendum / binding corporate rules]. You can obtain a copy of these safeguards by contacting [privacy contact]. See the International Data Transfers Map.
6. How long we keep your data
| Record | Retention period or criteria |
|---|---|
| [Account data] | [For as long as your account is open, then [12 months]] |
| [Security and access logs] | [[13 months], then deleted] |
| [Financial records] | [[6 years] after the end of the financial year, to meet [law]] |
| [Marketing preferences] | [Until you unsubscribe, then a suppression record is kept so we do not contact you again] |
The retention periods must match your retention schedule. See the Data Retention and Disposal Policy Template.
7. Your rights
You have the right to: access your personal data; have inaccurate data corrected; have data erased in certain circumstances; restrict our use of it; receive data you gave us in a portable format where processing is based on consent or contract and carried out by automated means; and withdraw consent at any time where we rely on consent, without affecting processing before withdrawal. Withdrawing consent is as easy as giving it: [method].
Your right to object: you can object at any time to processing based on our legitimate interests, and we will stop unless we have compelling legitimate grounds. You can object to direct marketing at any time, and we will stop. [Keep this paragraph visually separate: the right to object must be brought to people's attention clearly and separately from other information.]
To use your rights, contact [privacy contact] or use [form link]. We will need to confirm your identity, using only information we already hold where possible, and will respond within one month, which may be extended by two further months for complex requests. See the Data Subject Request Verification Procedure Template.
8. Automated decision-making (if applicable)
[If you make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects: describe the decision, meaningful information about the logic involved, its significance and the likely consequences for the person, and how to ask for human review. UK controllers should check the decision-making rules as amended by the Data (Use and Access) Act 2025. Otherwise state: "We do not make decisions with legal or similarly significant effects based solely on automated processing."]
9. Cookies and similar technologies
We use cookies and similar technologies as described in our [cookie notice link]. You can manage non-essential cookies through [the cookie settings link]. See the Cookie and Tracking Technology Compliance Guide.
10. How we protect your data
We protect personal data with technical and organisational measures appropriate to the risk, including [encryption in transit and at rest, access controls with multi-factor authentication, logging and monitoring, staff training and supplier assessments]. [Describe measures at a level that informs people without exposing details useful to attackers.]
11. Complaints
If you are unhappy with how we use your data, please contact us first at [complaints contact or form]. We will acknowledge your complaint within [30 days] and respond without undue delay. You also have the right to complain to a supervisory authority: [in the UK, the Information Commissioner's Office, ico.org.uk] [in the EU, the authority in your country of residence, work or the place of the alleged infringement; our lead authority is [authority]].
12. Changes to this notice
This notice was last updated on [date] (version [x.y]). We review it at least [annually] and whenever our processing changes. We will tell you directly about changes that materially affect you [by email or in the service] before they take effect. Earlier versions are available on request.
Implementation guidance
The template sections map to the transparency requirements as follows. Use the table as a completeness check before publishing.
| Requirement | Art. 13 (data from the person) | Art. 14 (data from elsewhere) | Template section |
|---|---|---|---|
| Controller identity and contact details; representative | Always | Always | 1 |
| DPO contact details | If applicable | If applicable | 1 |
| Categories of personal data | Not required | Always | 2 |
| Source of the data, and whether publicly accessible | Not required | Always | 2 |
| Statutory or contractual requirement and consequences | If applicable | Not required | 2 |
| Purposes and lawful basis; legitimate interests | Always | Always | 3 |
| Recipients or categories of recipients | If applicable | If applicable | 4 |
| International transfers and safeguards | If applicable | If applicable | 5 |
| Retention period or criteria | Always | Always | 6 |
| Rights, right to object, withdrawing consent | Always | Always | 7 |
| Automated decision-making including profiling | If applicable | If applicable | 8 |
| Right to complain to a supervisory authority | Always | Always | 11 |
When to give the notice
- Collected from the person (Art. 13): at the time the data is obtained. The ICO notes this includes collection by observation, such as CCTV or online tracking, so the notice or a just-in-time link must be in place before collection starts.
- Collected from elsewhere (Art. 14): within a reasonable period and at the latest within one month; at the latest at first communication if you will contact the person; and at the latest at first disclosure if you will pass the data on. The ICO advises giving it sooner where the use would be unexpected or involves special category data.
- Exemptions (Art. 14(5)): the person already has the information; providing it is impossible or would involve disproportionate effort (then take other measures, including making the information public); obtaining or disclosure is required by law; or professional secrecy applies. Record the reasoning when you rely on one. In the UK, the ICO notes the Data (Use and Access) Act 2025 added a disproportionate effort route for reusing data for scientific research, with the notice published on your website.
Keeping the notice accurate
- Assign an owner: the privacy lead owns the text; system owners own the facts about their processing.
- Link to change management: add a question to change requests and DPIA screening: "Does this change a purpose, a data category, a recipient, a transfer or a retention period?" A yes triggers a notice review. See the DPIA Guide.
- Reconcile with real data flows: at least annually, compare the recipients listed with the processor contract register, the cookie and tag inventory, and outbound integrations. Security teams can help: SaaS discovery, OAuth app inventories and egress logs reveal recipients the notice does not mention.
- Test readability: the ICO recommends user testing; ask a small sample of real users whether they understood what you do with their data.
- Version and archive: keep each published version with its date, so you can show what people were told at the time they gave their data.
Measures that show it is working
- Traceability: percentage of processing activities in the record that are reflected in the notice. Target 100%.
- Recipient drift: number of processors or third-party tags found in reconciliation that the notice does not cover. Target zero.
- Review currency: days since last review, against your [annual] target.
- Change triggers: number of changes that triggered a notice review, compared with DPIAs completed. A long run of DPIAs with no notice reviews suggests the trigger is not working.
- Transparency complaints: complaints and rights requests that cite surprise at a use of data.
Common mistakes
- One lawful basis listed for everything, or a list of bases with no link to purposes.
- "We may share with third parties" with no recipients named.
- Retention described as "as long as necessary" with no period or criteria.
- The right to object buried in the general rights list.
- A notice copied from another organisation that describes processing you do not do, or omits processing you do.
- Security, fraud prevention and logging uses missing, even though they involve personal data. See the Privacy in Security Logging and Monitoring Guide.
Framework references: GDPR and UK GDPR Articles 12, 13, 14 and 21(4); NIST SP 800-53 Rev. 5 PT-5 Privacy Notice; ISO/IEC 27001:2022 Annex A 5.34 Privacy and protection of PII. Sources: ICO: What privacy information should we provide?, ICO: When should we provide privacy information?, ICO: How should we draft our privacy information?, ICO: The Data (Use and Access) Act 2025, what does it mean for organisations?, EUR-Lex: Regulation (EU) 2016/679 (GDPR).
Related NHI Mgmt Group resources: Privacy Policy Template · Data Mapping and ROPA Guide · DSAR Guide: Handling Data Subject Requests · UK GDPR and Data Protection Act 2018 Guide. This guide summarises the transparency requirements of the GDPR and UK GDPR and is not legal advice.