# Transparency and privacy notices What a privacy notice must tell people, when they must get it, the exceptions, and how to keep customer and staff notices accurate as processing changes. Source: https://sted.digital/docs/standards/gdpr/transparency-and-privacy-notices · Last reviewed 17 October 2026 · Strand Standards and regulations UK GDPR Articles 13 and 14 require you to tell people who you are, why you use their data and on what lawful basis, who receives it, how long you keep it and their rights: at collection under Article 13, or within a month when the data comes from elsewhere under Article 14. EU GDPR has the same articles. ## The requirement in plain English Transparency is a duty you meet before or as you collect data, not when someone asks. UK GDPR Article 12(1) sets the standard for how: concise, accessible and in plain language, with extra care where children are the audience. The same articles apply in EU GDPR. **When you collect data from the person** (UK GDPR Article 13), the information is due at the moment of collection. It covers your identity and contact details, your data protection officer if you have one, each purpose with its lawful basis, the legitimate interests you rely on, the recipients, any transfers abroad and their safeguard, how long you keep the data, the person's rights including withdrawing consent and complaining to the regulator, whether they have to give the data, and any automated decision-making with its logic and effects. **When the data comes from elsewhere** (UK GDPR Article 14), add the categories of data and where you got them. The deadline is a reasonable period and at the latest one month, or your first contact with the person if sooner, or before you pass the data on (UK GDPR Article 14(3)). **When you change the purpose**, tell people before you start the new processing (UK GDPR Article 13(3)). The right to object must be brought to people's attention explicitly and separately from other information (UK GDPR Article 21(4)). UK GDPR Since 5 February 2026, two changes narrow when a notice is needed in the UK. You need not give Article 13 information again where you will further process data only for research, archiving or statistics and doing so is impossible or would take disproportionate effort (UK GDPR Article 13(5)). For data obtained elsewhere, the exceptions in UK GDPR Article 14(5) now include impossibility or disproportionate effort for any purpose (UK GDPR Article 14(5)(e)), weighed by the number of people, the age of the data and the safeguards in place. In both cases you must still protect people's interests, including by publishing the information. EU GDPR In the EU, the exceptions for data obtained elsewhere include impossibility and disproportionate effort, in particular for research, archiving and statistics (EU GDPR Article 14(5)(b)). Where you rely on it you must protect people's interests, including by making the information public. There is no equivalent exception for data collected directly from the person. This is guidance to help you understand the requirement, not legal advice. ## What good looks like A 40-person health-tech company keeps two notices: one for customers and website users, one for staff and job applicants. Each is written from the record of processing, so every purpose in the notice matches an activity with the same lawful basis and retention period. The customer notice is layered. A short summary at each point of collection (the sign-up form, the contact form, the app's first screen) links to the full notice. The right to object sits in its own paragraph, not in a list of rights. The staff notice is given with the offer letter and acknowledged in the first week. The privacy lead owns both notices, reviews them every year, and reviews them again whenever a new supplier, a new purpose or a transfer abroad goes into the record of processing. Each version is dated, and the previous versions are kept so the company can show what people were told at any point. ## Evidence an auditor expects - **Current privacy notices**: required; the auditor checks each Article 13 or 14 item is present and matches the record of processing. - **Point-of-collection screenshots or forms**: usual; they show people saw the notice when the data was collected. - **Version history**: usual; the auditor asks what the notice said at the date of a complaint or a breach. - **Records of notifying indirectly obtained data**: required where Article 14 applies; the auditor checks the one-month deadline was met or an exception recorded. - **Exception assessments**: required where you rely on disproportionate effort; the auditor looks for the reasoning and the published information. - **Review records**: usual; they show the notice was checked after each change to processing. ## Common mistakes ### The notice describes the company you meant to be Notices drafted at launch from a template describe processing that never happened and miss what did. Write the notice from the record of processing, and change both together. ### Missing retention periods "As long as necessary" does not meet the requirement. Give a period per category, or the criteria that set it, such as "six years after the contract ends". ### Data from third parties with no notice Lead lists, referral partners and enrichment tools all supply data the person never gave you. Article 14 still applies, with a one-month deadline; plan the first contact so it carries the notice. ### The right to object hidden in a list Listing the right to object with the other rights fails the test in UK GDPR Article 21(4), which asks for it to be brought to people's attention explicitly and separately. Give it its own paragraph, and say how to use it for direct marketing. ### Staff left out Organisations with a polished website notice often have nothing for employees. Staff are data subjects too, and HR data is where special category data usually sits. ## How Sted helps Sted's knowledge base includes a Privacy Notice (NTC-PN) for customers and website users and an Employee Privacy Notice (NTC-EPN) for staff, each covering what is collected, why and on what lawful basis, who receives it, how long it is kept and people's rights. Sted drafts your policies and procedures from its knowledge base, adapted to your organisation, for you to review. Each revision records "Why this revision" and the changes; the PDF ends with a revision history of approved versions. Approving sets an effective date and a review date, which starts at the effective date plus the document's review frequency; a review task opens 30 days before the review date and turns overdue after it. Sted drafts the notices for you to review and approve. You publish them, and you make sure people see them at the point of collection. ## Related guides and terms - [UK GDPR and EU GDPR](/docs/standards/gdpr): where transparency sits in the regulation. - [Lawful basis for processing](/docs/standards/gdpr/lawful-basis): the basis each purpose in your notice must name. - [Individual rights and subject access requests](/docs/standards/gdpr/individual-rights-and-dsars): the rights your notice tells people about. - [Personal data](/docs/glossary/personal-data): what counts, and so what the notice must cover. - [Document control](/docs/guides/document-control): keeping notice versions and reviews in order. - [Documents](/docs/product/documents): where your notices live once drafted and approved. ## Frequently asked questions Q: Do I need a separate privacy notice for employees? A: Not by law, but almost always in practice. Staff data involves different purposes, lawful bases, recipients and retention periods from customer data, and a combined notice tends to bury both. A separate notice given at offer stage or in the first week also lets you show that staff received it. Q: Is a cookie banner the same as a privacy notice? A: No. The cookie banner deals with consent to store or read information on a device, which sits under the separate electronic communications rules. Your privacy notice still has to explain what the cookies collect, why and who receives the data.