Privacy Notices: What Should Your Business Tell Customers?

A privacy notice is one of the most visible parts of your organisation's data protection compliance. Its purpose is practical: helping people understand what happens to their information.

What should a privacy notice explain?

The precise content depends on your processing, but organisations will commonly need to explain who is responsible for the information, what personal data is collected, why it is used, the lawful basis, recipients, international transfers where relevant, retention, individuals' rights and how to raise concerns.

Do not copy another company's privacy notice

Two businesses that appear similar may use completely different systems, suppliers and marketing practices. Your notice should describe your processing rather than somebody else's.

Check what actually happens

Before drafting or updating a privacy notice, understand how personal information moves through the business. Where does a website enquiry go? Does it enter a CRM? Does a booking provider receive it? Are customer details added to a mailing list? Are overseas service providers involved?

Keep the language understandable

Privacy information is written for customers and other individuals — not solely for lawyers or regulators. Technical and legal concepts may sometimes be necessary, but unnecessary jargon makes the notice less useful.

Review it when the business changes

You may introduce a CRM, change booking platforms, start a newsletter, introduce AI tools or appoint new suppliers. Significant changes to how personal information is used should prompt consideration of whether your privacy information needs updating.

When did you last review yours?

If your privacy notice has not changed for several years while your business has, it is worth checking whether it still accurately describes your practices.