Privacy Notices and the Right to be Informed under the UK GDPR

Privacy Notices in Brief

A privacy notice is the one data protection document written for the people whose data it is. It tells them who holds their information, why, who else sees it, how long it is kept and what they can do about it.

Privacy Notices and the Right to be Informed

In the UK, data protection law is set by the UK GDPR and the Data Protection Act 2018, both amended by the Data (Use and Access) Act 2025, and regulated by the Information Commissioner's Office (ICO). Organisations elsewhere will find the same idea in their own law, often in very similar terms, but the detail below is the UK position.

Most of the records a data protection framework produces face inwards: the register of processing, the retention schedule, the breach log. A privacy notice faces out. It is how an organisation meets the right to be informed, which is the first of the individual rights and the only one it has to act on before anybody asks.

The right is set out in Articles 12 to 14 of the UK GDPR. Article 12 covers how the information is given: concise, transparent, intelligible and easily accessible, in clear and plain language, and particularly where it is aimed at a child. Articles 13 and 14 cover what is given, depending on whether the data came from the person or from somewhere else.

What a Privacy Notice Contains

Where personal data is collected from the person directly, the privacy notice is provided at the time it is collected. It sets out:

the name and contact details of the organisation, and of its data protection officer where it has one
the purposes the data is used for and the lawful basis for each, including the legitimate interests being relied on where that is the basis
who the data is shared with, by name or by category of recipient
any transfer outside the UK and the safeguard that covers it
how long the data is kept, or the criteria used to decide
the rights people have, including the right to withdraw consent where consent is the basis
the right to complain to the ICO
whether providing the data is a legal or contractual requirement, and what happens if someone does not provide it
whether any decision about the person is made solely by automated means, with meaningful information about how it works and what it means for them

Where the data comes from elsewhere, such as a recruitment agency, a referral or a public source, the notice also says what categories of data are held and where they came from. The timing is different too. The information is given within a reasonable period and no later than one month, or at the first contact if the data is used to get in touch, or before it is passed to anyone else if that happens first.

A privacy notice built from the record of processing activities is much easier to get right. Every purpose, lawful basis, recipient and retention period in the notice should already be sitting in the register, and a notice that says something the register does not is a sign that one of the two is wrong.

Writing a Privacy Notice People Can Use

A notice written for lawyers rather than for readers does not meet Article 12, however complete it is. Long passages copied from the legislation, every lawful basis listed in case one applies, and vague phrases such as "we may share your data with selected partners" are the usual problems.

The rights section is where most notices fall short. Listing the rights by name is common and rarely helps anybody. What a reader needs is what each right lets them actually do, how to make a request, what happens after they do, and how long it takes. A person who wants a copy of their records, or wants them corrected, should be able to find out from the notice exactly how to go about it.

Many organisations deal with several groups of people, and one notice rarely suits all of them. Customers, employees, job applicants and suppliers each have their data used for different purposes, on different lawful bases and for different periods. A separate privacy notice for staff and applicants, alongside the one for customers and suppliers, is a common and sensible arrangement. A layered approach also works well on a website: a short summary with the detail a click away.

We used to have one privacy notice on the website and pointed everyone at it, staff included. Nobody read it, and half of it did not apply to whoever was reading.

Now there are three. The customer one is short. The staff one goes out with the offer letter and is covered at induction, because that is the moment people actually want to know what we hold on them. The website one only talks about the website.

The biggest improvement was the rights section. We stopped listing the rights and wrote a line on each one saying what you can ask for and who to ask. Requests got easier to handle, because people knew what they were asking for.

Privacy Notices and the Right to Complain

Every privacy notice has to tell people they can complain to the ICO. Since 19 June 2026, the Data (Use and Access) Act 2025 has also required organisations to handle data protection complaints themselves. People need to be able to complain directly, for example through an online form, and a complaint has to be acknowledged within 30 days and dealt with without undue delay.

The privacy notice is the natural place to say how. A contact route for complaints, and a line explaining that the ICO is there if the matter is not resolved, sits well alongside the rights section.

Describing AI Use in a Privacy Notice

AI use belongs in the privacy notice. Where an assistant drafts correspondence, a note taker records and transcribes meetings, a chatbot answers enquiries, or a feature inside HR or recruitment software ranks or filters people, personal data is reaching a third party and being used in a way a reader would not assume. It is common for the tools, and the internal rules for using them, to arrive while the notice still describes an organisation that does not use AI at all.

Wording that holds up covers what the tools are used for, what personal data goes near them, who provides them, whether the provider uses that data to train its models, and whether anything about a person is scored or decided by software. None of this needs technical language. "We use an AI note taker in some internal meetings. Recordings and transcripts are held by the provider for 30 days and are not used to train its models" tells a reader more than a paragraph about artificial intelligence technologies.

Automated decisions need particular care. Since February 2026 the UK GDPR allows significant decisions based solely on automated processing on a wider range of lawful bases than before, but only with safeguards in place: people are told about the decision, can make representations, can ask for a person to be involved, and can contest it. Special category data remains heavily restricted. Where software shortlists job applicants or sets terms for a customer without a person reviewing the outcome, the privacy notice is where that is first explained.

Stating where AI is not allowed can be just as useful. Someone deciding whether to hand over their information often finds the boundary more reassuring than the list. A statement like that is a commitment, though, and belongs in the notice only where the organisation has decided the boundary and something in its own procedures holds it there.

Website Privacy Notices, Cookies and Chatbots

A website privacy notice covers what happens on the website: enquiry forms, analytics, cookies, embedded content, and any third party that receives visitor data along the way. Cookies and similar technologies fall under the Privacy and Electronic Communications Regulations 2003 (PECR) as well as the UK GDPR, and many sites handle them in a separate cookie policy linked from the notice.

Since February 2026, some cookies used only for aggregate analytics to improve a site, or to adapt how it appears on a visitor's device, can be set without consent. That exemption depends on visitors being given clear information and a simple, free way to object, so the website notice or cookie policy now does more of the work than a consent banner alone.

A website chatbot deserves its own treatment. It collects names, contact details and whatever a visitor chooses to type, from people who never completed a form and may never become customers. The website privacy notice is where those visitors look, so that is where the chatbot, its provider and how long conversations are kept need to be described.

Keeping a Privacy Notice Accurate

A privacy notice stays accurate only if something keeps it accurate. Three things do most of the work.

The record of processing activities shows which activities exist, which suppliers receive the data and which of them involve AI. When the register changes, the notice is checked against it. An approval step before a new tool or supplier is given access to personal data stops the notice going out of date the next time a feature is switched on inside software the organisation already uses. And the written agreement with each processor is what supports any statement in the notice about where data is held, who else sees it and whether a provider trains its models on it. A claim on the provider's website is not the same as a term in the contract.

Review is also worth tying to events rather than only to the calendar: a new system, a new supplier, a change in the law, or a complaint that shows the notice was misunderstood.

When auditing information security or data protection, I compare the privacy notice with the register and with a few supplier agreements. If the notice says data stays in the UK and the contract says otherwise, that is a finding.

The date on the notice tells me something too. A notice last reviewed three years ago, at an organisation that has since changed its HR system and started recording meetings, is unlikely to be right.

A privacy notice that matches the register and the contracts holds up when it is tested, whether that test is a complaint, a subject access request, an enquiry from the ICO or an ISO 27001 certification audit. One that describes a different organisation does not.

Practical Compliance Guidance

A privacy notice draws on the rest of the data protection framework: the register of processing activities, the supplier agreements that support what the notice says about sharing and transfers, and an impact assessment where AI or automated tools score or decide things about people.

The alphaZ GDPR toolkit brings the data protection documents together, and the documents below cover the notices themselves and the records that keep them accurate.

alphaZ document	How to use it
GDPR / Data Protection Toolkit	The full set of data protection documents, including the privacy notice, website privacy notice, personal data registers, data protection procedure and supporting forms.
P-26 Privacy Policy	The privacy notice for customers, employees, job applicants and suppliers. Explains each right in plain English and includes a section describing AI use.
P-84 Website Privacy Policy	The website notice, covering data collected from visitors, cookies, third party providers and any live chat or AI chatbot.
P-85 Website Cookies Policy	A separate cookie policy for sites that keep cookie detail out of the main website notice. Check it against the cookies the site actually sets before publishing.
F-IMS24 Personal Data Register	The record of processing activities that the notice is built from. Purposes, lawful bases, recipients, AI tools and retention periods are recorded here first.
F-Q21 Data Transfer and Processing Agreement	The written agreement with a processor, including sub-processors, AI providers and whether personal data is used for model training.
F-Q97 Data Protection Impact Assessment	Assesses higher-risk processing before it starts, including AI tools and software that scores or filters people.

Note: subscribers to alphaZ documents can download all of the documents above as part of the subscription.

Frequently Asked Questions

Does my privacy notice have to mention AI?

The UK GDPR does not mention AI by name, but a privacy notice has to say what personal data is used for, who it is shared with and whether any significant decision about a person is made solely by automated means. Where an AI tool processes personal data, those answers change, so the notice needs to reflect it. A short description of what each tool does, what data goes into it, who provides it and whether the provider trains on that data is usually enough.

Do employees need a separate privacy notice?

Not as a legal requirement, but it usually helps. Employee and job applicant data is used for different purposes, on different lawful bases and for longer periods than customer data, and a notice trying to cover everyone tends to be hard for anyone to follow. Many organisations give staff their own notice at the offer stage or at induction.

Does a privacy notice need to be signed or agreed to?

No. A privacy notice gives people information, it is not a contract and it does not ask for their agreement. Asking people to tick a box to accept a privacy notice can confuse it with consent, which is a separate lawful basis with its own conditions. What matters is that the notice is easy to find and provided at the right time.

How often should a privacy notice be reviewed?

The law sets no fixed period. The notice has to be accurate, so the practical answer is whenever something it describes changes, such as a new system, supplier or AI tool, as well as a periodic check against the record of processing activities. Where a change affects people significantly, telling them about it directly is better than quietly updating the web page.

UK Legislation

The following UK legislation is directly relevant to privacy notices. Organisations outside the UK should identify the equivalent legislation applicable in their jurisdiction.

Further Resources