The GDPR privacy notice should ensure the following aspects:
Concise, Transparent, Intelligible, and Easily Accessible
Concise and Transparent
To minimize information overload, data controllers must convey information and communications in a "concise and transparent" manner. Instead of having to browse through a lot of information in an online setting in search of specific issues, a layered privacy notice will allow a data subject to navigate to the specific piece of the privacy notice they want to access right away.
Intelligible
The information must be "intelligible," which implies that it must be understandable to the typical member of the intended audience.
Easily Accessible
The "easily accessible" requirement states that the data subject should not have to look for the information; it should be immediately apparent to them where and how to access it, for example, by giving it to them directly, linking to it, clearly directing them there, or by providing the information as the response to a natural language question.
Clear and Plain Language
Best practices for clear writing should be observed when presenting written material (including when delivering written information verbally, visually, or by audio/visual means, even for persons with vision impairments).
Information should be delivered in the most straightforward manner possible, avoiding complicated sentence and language patterns, to comply with the criterion for clear and plain language. The information should be specific and unambiguous; it shouldn't be expressed in ambiguous or abstract words or allow for several interpretations.
When a data controller is directing their advertising at children or knows that their products/services target and are used by children frequently, it should make sure that the language's vocabulary, tone, and style are age-appropriate and can be easily understood by children and other vulnerable people.
In Writing or by Other Means
Under Article 12.1, the default position for providing information to, or communications with, data subjects is that the information is in writing. Data controllers are not limited to using digitally layered privacy statements and notices as their only written, electronic strategy. Other electronic tools may include, such as privacy dashboards, 3D touch or hover-over notices, and contextual pop-up notices.
When a data subject requests information, Article 12.1 expressly specifies that they may receive it verbally as long as their identity can be established in another way. To put it another way, the methods should go beyond relying solely on a person's assertions that they are a certain named person and allow the controller to confirm a data subject's identity confidently.
The oral communication of information required by Articles 13 and 14 does not always entail oral communication between individuals (i.e., in person or by telephone). It is possible to deliver automated oral information in addition to written information.
Free of Charge
Data controllers are typically prohibited from charging data subjects for the provision of information under Article 12.5. This element of transparency also means that no information provided in accordance with the standards for transparency may be contingent upon any financial transaction, such as the payment for or purchase of products or services.
How to Create a Privacy Notice
The privacy notice of GDPR should include the following:
- Who is processing the data?
- What legal basis allows the business to collect users' personal data?
- What are the purposes and intentions of collecting users' personal data?
- What types of personal data would be collected from users, and who will be data recipients?
- How long will the business store the personal data of users?
- Will the personal data obtained from users be transferred across borders?
- Will the personal data obtained from users be used for automated decision-making?
- Will the personal data obtained from users be shared with any third parties?
- How can data subjects exercise their rights?
- Who are the businesses’ data controllers, and their contact information?
- Who are the businesses’ data protection officers, and what is their contact information?
While providing information on the data storage period, organizations must keep in consideration that they cannot keep the data longer than it is necessary for the stated purposes. Moreover, it is not sufficient to generically state that personal data will be kept as long as necessary for legitimate purposes. In fact, where relevant, the different storage periods should be stipulated for different categories of personal data and/or different processing purposes, including, where appropriate, archiving periods.
- If a data controller has obtained personal information directly from a data subject, it is only exempt from Article 13 duties "where and to the extent that the data subject already knows the information."
- In the case of personal data not directly collected from the data subject, the right to information may be limited if the provision of such information proves impossible or would involve disproportionate effort from the controller.
- In the case of personal data not directly collected from the data subject, the right to information will not be exercised in so far as the obligation is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such a situation, the data controller must take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests.
- The right to information may be limited based on a legal requirement or on the grounds of professional secrecy.
Automate Privacy Notices with Securiti
As the global digital landscape witnesses a drastic transition, businesses must become even more privacy-conscious of their operations and adopt proactive measures to ensure compliance with international data privacy laws. Businesses must honor data subject rights and ensure their customer's data's utmost security and privacy.
Regulations of the law must be followed to operationalize compliance and avoid penalties for noncompliance. Securiti assists businesses in their compliance obligations through state-of-the-art robotic automation.
Securiti’s Privacy Notice Management enables businesses to build and publish a privacy notice on their website in minutes. Organizations can regularly update their privacy notices along with several other policies, such as cookie policy, terms, and conditions.
Additionally, Securiti’s Privacy Center enables organizations to easily comply with a myriad of complex and evolving global privacy regulations while building trust with users. Securiti’s Privacy Center takes care of all the complexity by building a fully functional Privacy Center in minutes which can be linked to the organization’s website and App.
Securiti can help you comply with the GDPR, privacy notice requirements, and other international privacy and security standards. Build your privacy notice today for free with Securiti.
Request a demo today and learn how Securiti can help your GDPR compliance efforts.
