Under the GDPR you must keep individuals informed about your use of their
personal data and about their legal rights relating to that data. Such
information is commonly provided on websites by means of Privacy Policies
or Privacy Statements. What happens, though, if you want to do business
The GDPR and its information requirements apply whenever you are using
personal data. It doesn’t matter whether you’re collecting it, using it, or
storing it on a website, in the cloud, on paper, or wherever. If it’s
personal data, it’s covered.
What Information do I Need to Supply and When?
The right to be informed is one of the core rights set
down by the GDPR. This means that data subjects (e.g. customers) should be
- What personal data you hold about them
- What you use that data for
- The legal basis (i.e. grounds) for using it
- How long you will hold it
- Whether you will share the data (and with whom)
Information should also be provided about data subjects’ rights including
the right of access and the right to withdraw consent (if applicable).
If personal data is collected directly from the data subjects themselves,
this information should be provided at the time the data is collected. If
it is collected from a third party, data subjects should be informed within
a month, when you first communicate with the data subject, or when you
disclose the data to someone else – whichever comes first.
New Privacy Notice
To help in providing this important information, we have now published a
new Privacy Notice template which sets out the required information
(subject, of course, to you adding some key details) in a user-friendly
Those who have previously used our website privacy policies will find this
document instantly familiar. The context, however, is different, as it is
designed for use in situations (such as point of sale) where data is being
collected somewhere other than a website. After all, as much as it might
shock millennials to acknowledge it, not everything is online!
The contents of this Newsletter are for reference purposes only and do not constitute
legal advice. Independent legal advice should be sought in relation to any specific