# What must your UK privacy notice say? Explain what happens to people’s information at the point they need to know. The Assurance Desk. Published 9 October 2026. Last checked 9 October 2026. Part of the guide [UK GDPR’s seven principles, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md). **The short answer.** A UK privacy notice needs to explain who uses personal data, why, the legal basis, who receives it and how long it is kept. It must also explain the relevant rights and routes to complain. The detail should describe what your organisation actually does ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/13), [ICO, What privacy information should we provide?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/) and [ICO, How should we draft our privacy information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/how-should-we-draft-our-privacy-information/), checked 9 October 2026). ## What should you check before writing? Start with the work, not a template. List the personal data you hold and how it is used. That gives you the facts the notice needs to explain ([ICO, How should we draft our privacy information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/how-should-we-draft-our-privacy-information/), checked 9 October 2026). For a fictional booking service, useful questions include: what does the form ask for, who can see the answers, and what happens after the booking? Write down the actual answers before drafting the notice. ## What information belongs in the notice? The checklist below covers the core information. Use it alongside the conditional items in the next section. UK GDPR requires the notice to reflect the data use, including the rights that apply to it ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/13) and [ICO, What privacy information should we provide?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/), checked 9 October 2026). **Core information to explain** | Topic | What the reader needs to know | | --- | --- | | Who is using the data | The organisation’s identity and contact details. Include a representative where applicable. | | Why the data is used | Each purpose and its lawful basis, meaning the legal reason for using it. | | Who receives it | The recipients or meaningful categories, including suppliers handling it for you. | | How long it is kept | The period, or the criteria used to decide that period if you cannot give one. | | The person’s rights | The rights that apply to this use and how to exercise them. | | How to complain | The right to complain to your organisation and to the ICO. | Source: legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/13 (checked 9 October 2026); ICO, What privacy information should we provide?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/ (checked 9 October 2026) ## What else depends on how you use the data? Some information is needed only when the relevant situation applies. Do not add a clause saying you do something if you do not. For information obtained elsewhere, say what kinds of personal data you have and where they came from ([ICO, What privacy information should we provide?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/) and [ICO, How should we draft our privacy information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/how-should-we-draft-our-privacy-information/), checked 9 October 2026). **Check the conditions as well as the core list** | If this applies | Explain this too | | --- | --- | | You have a data protection officer. | How to contact them. | | You rely on consent. | That it can be withdrawn, and how. | | You rely on the legitimate interests lawful basis. | Whose interests are being pursued and what they are. | | Providing data is a legal or contractual requirement. | That requirement and the consequences of not providing it. | | You transfer data overseas. | The intended transfer and the relevant UK arrangements. For transfers using specified safeguards, explain those and how to obtain them. | | You make automated decisions covered by the safeguards requirement. | That these decisions take place, with meaningful information about their logic and likely effects on the person. | | You obtained data from another source. | The categories of data and its source, including whether it was publicly available. | Source: legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/13 (checked 9 October 2026); ICO, What privacy information should we provide?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/ (checked 9 October 2026) ## How can you make a privacy notice easier to read? Use clear headings, short sentences and short paragraphs. The ICO says to leave out detail that is not relevant. A notice can have layers, with a short message on a form and a clear, prominent link to the fuller information ([ICO, How should we draft our privacy information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/how-should-we-draft-our-privacy-information/) and [ICO, What methods can we use to provide privacy information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-methods-can-we-use-to-provide-privacy-information/), checked 9 October 2026). Put unexpected uses, uses people may object to and uses with a significant effect where people will notice them. A link to a long page should not hide the part most likely to matter ([ICO, What methods can we use to provide privacy information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-methods-can-we-use-to-provide-privacy-information/), checked 9 October 2026). For the fictional booking form, an opening line might be: “We use your contact details to arrange your booking.” That is a partial example of a purpose statement, not a complete privacy notice. **Give the right detail at the right point** - At the form: Explain the immediate use. Make unexpected or significant uses prominent. - The full notice: Give the remaining required information under clear headings, reached through a visible link. A short first layer helps someone get started. The full information still needs to be easy to reach. Source: ICO, How should we draft our privacy information?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/how-should-we-draft-our-privacy-information/ (checked 9 October 2026); ICO, What methods can we use to provide privacy information?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-methods-can-we-use-to-provide-privacy-information/ (checked 9 October 2026) ## Do you need to publish your retention schedule? Tell people how long you will keep their data. If you cannot give a period, explain how you decide it. Jon Baines distinguishes this from publishing your internal retention schedule ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/13) and [Jon Baines on LinkedIn](https://www.linkedin.com/posts/jon-baines-374659277_the-ico-has-published-a-privacy-notice-generator-activity-7185974305602588675-TmkO), checked 9 October 2026). Data protection specialist Jon Baines makes that distinction in a LinkedIn post. The useful point is to explain retention clearly to the person, using information that fits the data in question ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/13) and [Jon Baines on LinkedIn](https://www.linkedin.com/posts/jon-baines-374659277_the-ico-has-published-a-privacy-notice-generator-activity-7185974305602588675-TmkO), checked 9 October 2026). > "it is certainly not an Article 13/14 obligation to publish your *retention schedule*" > Jon Baines, LinkedIn post excerpt > Jon Baines on LinkedIn, The ICO has published a “Privacy Notice Generator” tool, about which I have THOUGHTS. But for now, I’ll just say that it is certainly not an Article 13/14 obligation to publish your *retention…, Jon Baines, 12 comments, https://www.linkedin.com/posts/jon-baines-374659277_the-ico-has-published-a-privacy-notice-generator-activity-7185974305602588675-TmkO (checked 9 October 2026) > [View LinkedIn post](https://www.linkedin.com/posts/jon-baines-374659277_the-ico-has-published-a-privacy-notice-generator-activity-7185974305602588675-TmkO) ## When must you give the information? When you collect data from the person, give the required information at collection. When it comes from elsewhere, the timetable depends on what happens next ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/13) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/14), checked 9 October 2026). **When to provide privacy information** | How the data arrives | Normal timing | | --- | --- | | Directly from the person | At the time you collect it. | | From another source | Within a reasonable period, no later than one month. | | From another source, then used to contact the person | No later than the first communication, if that is earlier. | | From another source, then disclosed to someone else | No later than the first disclosure, if that is earlier. | Source: legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/13 (checked 9 October 2026); legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/14 (checked 9 October 2026) ## What to do 1. List the data you use and what actually happens to it ([ICO, How should we draft our privacy information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/how-should-we-draft-our-privacy-information/), checked 9 October 2026). 2. Match the core and conditional information to those uses ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/13) and [ICO, What privacy information should we provide?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/), checked 9 October 2026). 3. Put a short, clear explanation where the person needs it, with a visible route to the full notice ([ICO, How should we draft our privacy information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/how-should-we-draft-our-privacy-information/) and [ICO, What methods can we use to provide privacy information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-methods-can-we-use-to-provide-privacy-information/), checked 9 October 2026). 4. Review the notice when practices change, and normally tell people before using their data for a new purpose ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/13) and [ICO, How should we draft our privacy information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/how-should-we-draft-our-privacy-information/), checked 9 October 2026). ## Common questions ### Must we repeat information someone already has? The information duties do not apply to the extent the person already has the information. There are also exceptions for indirect collection. Check the relevant conditions before relying on an exception ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/13) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/14), checked 9 October 2026). ### Can we copy a notice from another business? Start from your own data and practices. The ICO recommends establishing what you hold and how you use it before writing, then reviewing the notice to keep it accurate. Another business’s description may not fit yours ([ICO, How should we draft our privacy information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/how-should-we-draft-our-privacy-information/), checked 9 October 2026). ### Does this guide use the current UK rules? It uses the current UK GDPR text for the legal requirements. The ICO flags its drafting guidance as under review after the UK’s Data (Use and Access) Act. Check the rules again when reviewing your own notice ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/13) and [ICO, How should we draft our privacy information?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/how-should-we-draft-our-privacy-information/), checked 9 October 2026). ## Where next - [A subject access request arrives: what should you do?](https://theassurancedesk.com/guides/subject-access-request-what-to-do.md) - [Does GDPR apply to small businesses and sole traders?](https://theassurancedesk.com/guides/gdpr-small-business-sole-trader.md) - [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md) - [Is UK GDPR changing in 2026?](https://theassurancedesk.com/guides/uk-gdpr-changes-data-use-and-access-act.md) - [UK GDPR versus EU GDPR: which rules apply?](https://theassurancedesk.com/guides/uk-gdpr-vs-eu-gdpr.md) ## Sources - legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/13 (checked 9 October 2026) - ICO, What privacy information should we provide?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/ (checked 9 October 2026) - ICO, How should we draft our privacy information?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/how-should-we-draft-our-privacy-information/ (checked 9 October 2026) - ICO, What methods can we use to provide privacy information?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-methods-can-we-use-to-provide-privacy-information/ (checked 9 October 2026) - Jon Baines on LinkedIn: https://www.linkedin.com/posts/jon-baines-374659277_the-ico-has-published-a-privacy-notice-generator-activity-7185974305602588675-TmkO (checked 9 October 2026) - legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/14 (checked 9 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.