The privacy notice template #
Fill in each grey prompt in plain words, and delete any row that does not apply to you. The ICO treats some items as always required and others as required only where they apply, and the template marks which is which. This is a starting document, not legal advice, and it is only as good as its match to what your organisation really does with the data.
Click anything in brackets to type over it, then copy, print or download the result. Nothing you type leaves this page.
How we use your personal information
Who we are
| Organisation | [Registered name and trading name] |
|---|---|
| Contact for privacy questions | [Email and postal address] |
| Data protection officer (if you have one) | [Name and contact details] |
| Representative (if you are outside the UK) | [Name and contact details, or delete] |
What we collect, why, and our lawful basis
One row for each separate purpose, for example customers, enquiries, staff, suppliers.
| Whose information | What we collect | Why we use it | Lawful basis |
|---|---|---|---|
If the basis is legitimate interests, say what the interests are: [The interests, in a sentence]
Where we get it
[Directly from you, or from another source such as a referrer, a public record or a supplier. If another source, say which and what categories of information we hold.]
Who we share it with
| Recipients or categories of recipient | [For example payroll provider, accountant, software supplier, regulator] |
|---|---|
| Sent outside the UK? | [No, or where, and the safeguard used] |
How long we keep it
| Information | How long | Why that long |
|---|---|---|
Decisions made by a computer
[We do not make decisions about you using only automated processing. Or, if you do: what the decision is, how it works in outline, and what it means for the person.]
Your rights
You can ask us for a copy of your information, to correct it, to delete it, to restrict or object to how we use it, and in some cases to move it to another organisation. Where we rely on your consent, you can withdraw it at any time: [How, for example by replying STOP or emailing the privacy contact].
To use any of these rights, contact us: [Email and postal address].
Complaints
If you are unhappy with how we have used your information, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, at ico.org.uk or on 0303 123 1113.
Changes to this notice
| Last updated | [Date] |
|---|---|
| Next review | [Date, or the change that triggers one] |
What is required, and what only if it applies #
Always
- Your name and contact details
- The purposes of the processing
- The lawful basis for each purpose
- How long you keep the data
- People’s rights
- The right to complain to the ICO
Only where it applies
- Your representative and your data protection officer
- The legitimate interests you rely on
- Who receives the data
- Transfers outside the UK
- How to withdraw consent
- Automated decision making
- Data from elsewhere: the categories you hold and where it came from
Giving it to people, not only publishing it #
Writing the notice is half of it. The ICO says privacy information is given at the time you collect the data, and within a month at the latest if you got it from somebody else. It also says a notice sitting on your website is not enough on its own, so the place people see it is wherever they hand over their details: the enquiry form, the sign-up page, the first email.
Where it connects to the rest #
The notice describes what you do; the DPIA template is where you test whether a new process should go ahead at all. A supplier that handles the data needs a contract: see what a data processing agreement must contain, and the guide on UK GDPR and AI for a small organisation.
What the office does with it by hand #
The notice itself is written once. The work around it is the checking that each form links to the current version, the reminder when the review date arrives, and the logging of requests under it. Those follow a rule. Deciding what your purposes and lawful basis are is a judgement, and it stays with a person.
The task sorter separates the two kinds of work, and the admin time calculator shows what the first kind costs in a month.