What must your UK privacy notice say?

Part of the guide UK GDPR’s seven principles, in plain English

What should you check before writing?

Start with the work, not a template. List the personal data you hold and how it is used. That gives you the facts the notice needs to explain.

For a fictional booking service, useful questions include: what does the form ask for, who can see the answers, and what happens after the booking? Write down the actual answers before drafting the notice.

What information belongs in the notice?

The checklist below covers the core information. Use it alongside the conditional items in the next section. UK GDPR requires the notice to reflect the data use, including the rights that apply to it.

Core information to explain
Topic	What the reader needs to know
Who is using the data	The organisation’s identity and contact details. Include a representative where applicable.
Why the data is used	Each purpose and its lawful basis, meaning the legal reason for using it.
Who receives it	The recipients or meaningful categories, including suppliers handling it for you.
How long it is kept	The period, or the criteria used to decide that period if you cannot give one.
The person’s rights	The rights that apply to this use and how to exercise them.
How to complain	The right to complain to your organisation and to the ICO.

What else depends on how you use the data?

Some information is needed only when the relevant situation applies. Do not add a clause saying you do something if you do not. For information obtained elsewhere, say what kinds of personal data you have and where they came from.

Check the conditions as well as the core list
If this applies	Explain this too
You have a data protection officer.	How to contact them.
You rely on consent.	That it can be withdrawn, and how.
You rely on the legitimate interests lawful basis.	Whose interests are being pursued and what they are.
Providing data is a legal or contractual requirement.	That requirement and the consequences of not providing it.
You transfer data overseas.	The intended transfer and the relevant UK arrangements. For transfers using specified safeguards, explain those and how to obtain them.
You make automated decisions covered by the safeguards requirement.	That these decisions take place, with meaningful information about their logic and likely effects on the person.
You obtained data from another source.	The categories of data and its source, including whether it was publicly available.

How can you make a privacy notice easier to read?

Use clear headings, short sentences and short paragraphs. The ICO says to leave out detail that is not relevant. A notice can have layers, with a short message on a form and a clear, prominent link to the fuller information.

Put unexpected uses, uses people may object to and uses with a significant effect where people will notice them. A link to a long page should not hide the part most likely to matter.

For the fictional booking form, an opening line might be: “We use your contact details to arrange your booking.” That is a partial example of a purpose statement, not a complete privacy notice.

Give the right detail at the right point

At the form Explain the immediate use. Make unexpected or significant uses prominent.
The full notice Give the remaining required information under clear headings, reached through a visible link.

A short first layer helps someone get started. The full information still needs to be easy to reach.

Do you need to publish your retention schedule?

Tell people how long you will keep their data. If you cannot give a period, explain how you decide it. Jon Baines distinguishes this from publishing your internal retention schedule.

Data protection specialist Jon Baines makes that distinction in a LinkedIn post. The useful point is to explain retention clearly to the person, using information that fits the data in question.

it is certainly not an Article 13/14 obligation to publish your *retention schedule*

When must you give the information?

When you collect data from the person, give the required information at collection. When it comes from elsewhere, the timetable depends on what happens next.

When to provide privacy information
How the data arrives	Normal timing
Directly from the person	At the time you collect it.
From another source	Within a reasonable period, no later than one month.
From another source, then used to contact the person	No later than the first communication, if that is earlier.
From another source, then disclosed to someone else	No later than the first disclosure, if that is earlier.

What to do

List the data you use and what actually happens to it.
Match the core and conditional information to those uses.
Put a short, clear explanation where the person needs it, with a visible route to the full notice.
Review the notice when practices change, and normally tell people before using their data for a new purpose.

Common questions

Must we repeat information someone already has?

The information duties do not apply to the extent the person already has the information. There are also exceptions for indirect collection. Check the relevant conditions before relying on an exception.

Can we copy a notice from another business?

Start from your own data and practices. The ICO recommends establishing what you hold and how you use it before writing, then reviewing the notice to keep it accurate. Another business’s description may not fit yours.

Does this guide use the current UK rules?

It uses the current UK GDPR text for the legal requirements. The ICO flags its drafting guidance as under review after the UK’s Data (Use and Access) Act. Check the rules again when reviewing your own notice.

Where next

Sources

This is an independent editorial guide, not legal advice.