The General Data Protection Regulation (GDPR) is an EU law designed to ensure the security and privacy of EU residents’ personal data and give them greater rights. It’s a comprehensive regulation whose requirements are based on seven data protection principles, one of which is transparency.
To comply with GDPR’s transparency principle, you must provide privacy notices for all your processing activities. These notices must be precise and accessible since they’re often the first signal to users and customers that your organization can be trusted with their data.
In this article, you will learn:
- What a GDPR privacy notice is
- What are the contents of a GDPR privacy notice
- How to craft a notice in five steps
What is a GDPR privacy notice?
A privacy notice is a public-facing document that clarifies how an organization collects, processes, and protects personal data under the GDPR. It promotes transparency and accountability by telling customers why and how organizations process their data.
While the terms “privacy notice” and “privacy policy” are often used interchangeably, they serve different purposes:
- Privacy notice: Written in plain, customer-oriented language and published on your website for data subjects
- Privacy policy: A more detailed, precisely worded governance document that outlines your internal privacy practices and procedures
“
A privacy notice is what you communicate publicly to customers about your privacy practices. A privacy policy is an internal policy that governs how an organization keeps information private and confidential. Oftentimes, you’ll see organizations include their privacy policy within their privacy notices.”
Publishing a privacy notice is a core GDPR compliance requirement. Not creating a compliant notice can be treated as a violation and may result in substantial financial penalties.
{{cta_withimage14="/cta-blocks"}} | GDPR compliance checklist
What should a GDPR privacy notice contain?
The GDPR has strict guidelines on the contents of a privacy notice. However, the requirements slightly differ depending on whether you’re collecting data directly from the subjects or indirectly from another source.
For data obtained directly, your notice must include several key components, such as:
- Identity and contact details of the organization or data protection officer (DPO)
- Purpose and legal basis for processing
- Data retention period
- Data subject rights
- Whether providing personal data is contractually required
The requirements are mostly the same if you’re collecting information indirectly, except that you don’t need to state the contractual requirement. Instead, you must specify the categories of personal data obtained and their source.
5 steps for crafting a privacy notice
The specifics of your privacy notice will vary slightly depending on the size of your organization, the type of data you collect, your location, and the number of third parties you work with.
That said, you can create a GDPR-compliant privacy notice by following these five steps:
- Determine the processing purpose for your notice
- Create a draft of your privacy notice
- Assess your notice against GDPR requirements
- Publish your notice
- Review and update your notice
Step 1: Determine the processing purpose for your notice
Start by determining the purpose of the notice. Doing this early helps you define a clear scope, including what you need to disclose, to whom, and why, so your notice stays focused.
In this step, you should perform the following actions:
- Identify the types of personal data collected and used
- Specify the data subjects involved
- Map out any data sharing or transfers
- Determine the legal basis for processing
- Document the processing activities end-to-end
Being thorough during scoping is critical. You will need to rectify any oversight later, such as misinterpreting the type of data or the data subject group, which can delay the publication of the notice and potentially increase costs.
Step 2: Create a draft of your privacy notice
Draft your privacy notice according to Article 12 of the GDPR, which requires it to be clear, concise, in plain language, and easy to access.
As a best practice, use only the active voice, with clear paragraphs and bullet points to emphasize particularly important information. Avoid qualifiers such as “may,” “might,” or “often,” since they can create ambiguity.
If your organization operates internationally, translate the notice into all relevant languages to ensure accessibility. It should also clearly indicate whether subprocessors are involved, their types and roles, and how data subjects can exercise their rights throughout the processing chain.
Some of the topics your privacy notice should cover include:
- What data do we collect?
- How do we collect your data?
- How will we use your data?
- How do we store your data?
- What are your data protection rights?
- What are cookies?
- How do we use cookies?
Step 3: Assess your notice against GDPR requirements
After you draft your privacy notice, it’s time to assess it against the criteria outlined by Article 13 and Article 14 of the GDPR to confirm that you’ve included all of the required information.
Some of the activities you should perform during this evaluation include:
- Ensuring that the language of the notice is plain and intelligible
- Verifying that the draft states the processing purpose and legal basis
- Affirming compliance with the transparency and accessibility principles
- Confirming that the data subject rights are visible and well-explained
- Validating the information about data transfers
This review should be led by your designated data protection officer (DPO). However, to ensure a more comprehensive overview and better GDPR alignment, involve stakeholders across departments such as IT, legal, and product. If you face any legal ambiguities during the assessment, consult your national data protection authority for guidance.
Step 4: Publish your notice
After you’ve ensured that your privacy notice meets all GDPR criteria, you can publish it. The notice should be available in writing and supplied electronically, where applicable.
The GDPR outlines strict guidelines and best practices for publishing your notice:
- The notice must be available before collection or begins on the same page where personal data is collected
- If the notice is available on a website, link to it from every page under the title “Privacy Policy”
- Where appropriate, use standardised icons to give users an easily visible overview of intended processing
Accessibility is another important factor: make sure to create an audio form of the notice for individuals with visual impairments. Before you publish your notice, test it on different devices to ensure that it appears correctly and is fully accessible.
{{cta_withimage11="/cta-blocks"}}| The US data privacy checklist
Step 5: Review and update your notice
Ongoing GDPR compliance requires that you review and update your notice for several potential reasons, such as:
- A change in processing activities
- Regulatory changes
- Introduction of new technologies
- Evolving data subject expectations
Keeping your notices up to date can become complex, especially if you have many processing activities. You must continually track personal data uses, regulatory changes, and version history, which can be time-consuming when processing is fragmented across departments.
You can streamline ongoing notice management with an automation tool that monitors changes in real time, updates notices automatically, and helps maintain long-term compliance.
Stay on top of GDPR documentation and compliance with Vanta
Vanta is a leading trust management platform that helps organizations achieve and manage ongoing GDPR compliance. It streamlines evidence collection across 400+ integrations, offers pre-built, customizable policy templates (including privacy policies, DPIAs, RoPA, and breach response plans), and supplies step-by-step guidance that minimizes legal research and external consultations.
Vanta’s GDPR compliance solution comes with features that help translate regulatory requirements into actionable tasks for your team. You can:
- Use automation for up to 50% of compliance workflows
- Monitor in real-time with instant reports
- Review everything GDPR on a centralized dashboard
- Manage framework updates with version control
- Access staff security and awareness training materials
If you’ve already achieved or are pursuing compliance with other frameworks such as SOC 2 or ISO 27001, Vanta can efficiently cross-map overlapping controls across requirements.
Schedule a custom demo to see how Vanta supports GDPR compliance.
{{cta_simple19="/cta-blocks"}} | GDPR product page
A note from Vanta: Vanta is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.
Understanding GDPR requirements
A step-by-step guide to writing a GDPR privacy notice
Understanding GDPR requirements
Looking to streamline the work for GDPR compliance?
The General Data Protection Regulation (GDPR) is an EU law designed to ensure the security and privacy of EU residents’ personal data and give them greater rights. It’s a comprehensive regulation whose requirements are based on seven data protection principles, one of which is transparency.
To comply with GDPR’s transparency principle, you must provide privacy notices for all your processing activities. These notices must be precise and accessible since they’re often the first signal to users and customers that your organization can be trusted with their data.
In this article, you will learn:
- What a GDPR privacy notice is
- What are the contents of a GDPR privacy notice
- How to craft a notice in five steps
What is a GDPR privacy notice?
A privacy notice is a public-facing document that clarifies how an organization collects, processes, and protects personal data under the GDPR. It promotes transparency and accountability by telling customers why and how organizations process their data.
While the terms “privacy notice” and “privacy policy” are often used interchangeably, they serve different purposes:
- Privacy notice: Written in plain, customer-oriented language and published on your website for data subjects
- Privacy policy: A more detailed, precisely worded governance document that outlines your internal privacy practices and procedures
“
A privacy notice is what you communicate publicly to customers about your privacy practices. A privacy policy is an internal policy that governs how an organization keeps information private and confidential. Oftentimes, you’ll see organizations include their privacy policy within their privacy notices.”
Publishing a privacy notice is a core GDPR compliance requirement. Not creating a compliant notice can be treated as a violation and may result in substantial financial penalties.
{{cta_withimage14="/cta-blocks"}} | GDPR compliance checklist
What should a GDPR privacy notice contain?
The GDPR has strict guidelines on the contents of a privacy notice. However, the requirements slightly differ depending on whether you’re collecting data directly from the subjects or indirectly from another source.
For data obtained directly, your notice must include several key components, such as:
- Identity and contact details of the organization or data protection officer (DPO)
- Purpose and legal basis for processing
- Data retention period
- Data subject rights
- Whether providing personal data is contractually required
The requirements are mostly the same if you’re collecting information indirectly, except that you don’t need to state the contractual requirement. Instead, you must specify the categories of personal data obtained and their source.
5 steps for crafting a privacy notice
The specifics of your privacy notice will vary slightly depending on the size of your organization, the type of data you collect, your location, and the number of third parties you work with.
That said, you can create a GDPR-compliant privacy notice by following these five steps:
- Determine the processing purpose for your notice
- Create a draft of your privacy notice
- Assess your notice against GDPR requirements
- Publish your notice
- Review and update your notice
Step 1: Determine the processing purpose for your notice
Start by determining the purpose of the notice. Doing this early helps you define a clear scope, including what you need to disclose, to whom, and why, so your notice stays focused.
In this step, you should perform the following actions:
- Identify the types of personal data collected and used
- Specify the data subjects involved
- Map out any data sharing or transfers
- Determine the legal basis for processing
- Document the processing activities end-to-end
Being thorough during scoping is critical. You will need to rectify any oversight later, such as misinterpreting the type of data or the data subject group, which can delay the publication of the notice and potentially increase costs.
Step 2: Create a draft of your privacy notice
Draft your privacy notice according to Article 12 of the GDPR, which requires it to be clear, concise, in plain language, and easy to access.
As a best practice, use only the active voice, with clear paragraphs and bullet points to emphasize particularly important information. Avoid qualifiers such as “may,” “might,” or “often,” since they can create ambiguity.
If your organization operates internationally, translate the notice into all relevant languages to ensure accessibility. It should also clearly indicate whether subprocessors are involved, their types and roles, and how data subjects can exercise their rights throughout the processing chain.
Some of the topics your privacy notice should cover include:
- What data do we collect?
- How do we collect your data?
- How will we use your data?
- How do we store your data?
- What are your data protection rights?
- What are cookies?
- How do we use cookies?
Step 3: Assess your notice against GDPR requirements
After you draft your privacy notice, it’s time to assess it against the criteria outlined by Article 13 and Article 14 of the GDPR to confirm that you’ve included all of the required information.
Some of the activities you should perform during this evaluation include:
- Ensuring that the language of the notice is plain and intelligible
- Verifying that the draft states the processing purpose and legal basis
- Affirming compliance with the transparency and accessibility principles
- Confirming that the data subject rights are visible and well-explained
- Validating the information about data transfers
This review should be led by your designated data protection officer (DPO). However, to ensure a more comprehensive overview and better GDPR alignment, involve stakeholders across departments such as IT, legal, and product. If you face any legal ambiguities during the assessment, consult your national data protection authority for guidance.
Step 4: Publish your notice
After you’ve ensured that your privacy notice meets all GDPR criteria, you can publish it. The notice should be available in writing and supplied electronically, where applicable.
The GDPR outlines strict guidelines and best practices for publishing your notice:
- The notice must be available before collection or begins on the same page where personal data is collected
- If the notice is available on a website, link to it from every page under the title “Privacy Policy”
- Where appropriate, use standardised icons to give users an easily visible overview of intended processing
Accessibility is another important factor: make sure to create an audio form of the notice for individuals with visual impairments. Before you publish your notice, test it on different devices to ensure that it appears correctly and is fully accessible.
{{cta_withimage11="/cta-blocks"}}| The US data privacy checklist
Step 5: Review and update your notice
Ongoing GDPR compliance requires that you review and update your notice for several potential reasons, such as:
- A change in processing activities
- Regulatory changes
- Introduction of new technologies
- Evolving data subject expectations
Keeping your notices up to date can become complex, especially if you have many processing activities. You must continually track personal data uses, regulatory changes, and version history, which can be time-consuming when processing is fragmented across departments.
You can streamline ongoing notice management with an automation tool that monitors changes in real time, updates notices automatically, and helps maintain long-term compliance.
Stay on top of GDPR documentation and compliance with Vanta
Vanta is a leading trust management platform that helps organizations achieve and manage ongoing GDPR compliance. It streamlines evidence collection across 400+ integrations, offers pre-built, customizable policy templates (including privacy policies, DPIAs, RoPA, and breach response plans), and supplies step-by-step guidance that minimizes legal research and external consultations.
Vanta’s GDPR compliance solution comes with features that help translate regulatory requirements into actionable tasks for your team. You can:
- Use automation for up to 50% of compliance workflows
- Monitor in real-time with instant reports
- Review everything GDPR on a centralized dashboard
- Manage framework updates with version control
- Access staff security and awareness training materials
If you’ve already achieved or are pursuing compliance with other frameworks such as SOC 2 or ISO 27001, Vanta can efficiently cross-map overlapping controls across requirements.
Schedule a custom demo to see how Vanta supports GDPR compliance.
{{cta_simple19="/cta-blocks"}} | GDPR product page
A note from Vanta: Vanta is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.
Explore more GDPR articles
Introduction to GDPR
Understanding GDPR requirements
Preparing for GDPR compliance
Streamlining GDPR compliance
Get started with GDPR:
Start your GDPR journey with these related resources.
GDPR basics: Everything you need to know to keep your business compliant
Learn the basics of GDPR, what GDPR compliance means for your organization, and how the GDPR rights granted to those in the EU may impact your business.
A step-by-step GDPR compliance checklist
Vanta makes it easy to prove your GDPR compliance.
An essential guide to GDPR compliance for SaaS companies
Learn about the basic principles of GDPR compliance for SaaS companies.
.png)
.png)
.png)