Privacy Notices

The building blocks of Compliance e: stonearch@protonmail.com t: 01706 559 022

Stone Arch
Data Protection

UK GDPR Expertise You Can Rely On.

Privacy notices

Privacy notices make up one of the Stone Arch recommended "five steps" to compliance, alongside website compliance, key policy & procedures, Record of Processing Activity and Data Protection Impact Assessments.

We have delivered our brand new "5 Steps to Compliance Course" to tens of businesses across Great Britain. The three-hour course has been created to demystify the legislation and give small to medium businesses the tools they need to protect their business by ensuring a high level of data protection compliance. Please contact us us if you'd like more information on upcoming dates, or would like to arrange a tailored session.

Privacy notices: Into the detail...

Difficulty Rating

🟢 Low

Why are privacy notices important

Privacy notices are one of the most visible elements of data protection compliance. They explain to individuals what personal data your business collects, how it is used, who it is shared with, and what rights people have in relation to that information.

Data protection legislation is built around transparency. Individuals should not be surprised by how their information is used. A well-written privacy notice demonstrates openness, helps build trust, and enables people to make informed decisions about their personal information.

Privacy notices are commonly used for employees, applicants, customers, suppliers, website visitors and any other individuals whose personal data we process.

What are the risks if we get it wrong?

If privacy information is inaccurate, incomplete or missing, individuals may not understand how their information is being used. This can lead to complaints, challenges to processing activities, or regulatory scrutiny.

Common issues include:

Using data for purposes that are not described.
Omitting recipients or data sharing arrangements.
Using overly technical or unclear language.
Failing to update notices when a process changes.

In addition to compliance concerns, poor transparency can damage trust between your business and the people whose information you hold.

How is a privacy notice created?

Creating a privacy notice starts with understanding the processing activity itself. Before drafting anything, you need a clear picture of what personal data is collected, why it is needed, who will use it, and how long it will be retained.

Once the processing activity is understood, the notice should explain:

What information is collected.
The purpose for collecting it.
The legal basis relied upon (a specific condition from Article 6 and if applicable, Article 9 of the UK GDPR).
Whether the information is shared with any other business or individuals.
How long the information will be kept.
The data protection rights available to individuals.
How to contact your business regarding privacy matters.

The best privacy notices use clear and simple language. At Stone Arch, we recommend using a layered approach; creating a summary notice with clear punchy information, and links to more detail if it is needed. Remember: The objective is not to satisfy legal professionals or regulators, but to help ordinary people understand how their information will be used.

Whenever a new process is introduced or an existing process changes significantly, the privacy notice should be reviewed to ensure it remains accurate.

Need help?

If you're collecting personal data for a new purpose, updating an existing process, or are unsure whether a privacy notice is required, please contact us for support.

Stone Arch Data Protection can write your notice for you, or provide you with a privacy notice template which can be used time and time again; it explains everything you need to know - please reach out to us for more detail.