At a glance
- A privacy notice explains how a business uses personal data. The GDPR requires clear information, but it does not prescribe a document called a “privacy notice” or require people to accept one.
- For each purpose, identify the lawful basis, the data used, recipients, retention criteria and the rights that apply. Keep the explanation specific to what the business actually does.
- Give the information when collecting data directly. If data comes from elsewhere, provide it within a reasonable period and generally no later than one month, subject to earlier-contact and other rules.
- Businesses of every size have transparency duties. The under-250-person exception in GDPR Article 30 concerns certain internal processing records, not privacy notices.
- Publish the notice where people can find it and link to it when collecting data. Update it before introducing a new purpose or other change that affects what people have been told.
A privacy notice is the explanation a business gives people about its use of their personal data. Customers, employees, job applicants, website visitors and business contacts may all be affected. The GDPR calls this the duty to provide information; a privacy notice is the practical way most organisations meet that duty in a clear, documented form.
This guide explains what to include, when to provide it and how to keep it accurate. A generic template cannot establish whether your processing is lawful.
What a privacy notice does—and does not do
GDPR Articles 12–14 require information to be concise, transparent, intelligible, easily accessible, clear and free of charge. The GDPR does not prescribe a document name or standard form. The important question is whether people receive the required information in a usable way.
A notice describes processing. It does not create permission to process personal data, and it is not a consent form. Do not make people accept the notice as a condition of contact or service. If consent is the lawful basis for a particular purpose, ask for that consent separately, in a way that meets the GDPR’s consent requirements. Other processing may rely on another lawful basis.
The controller generally decides why and how personal data is processed and is responsible for providing the information. A processor handles data on the controller’s behalf and has its own GDPR duties, but does not automatically have the controller’s notice obligation. Roles depend on what each organisation actually does.
Information about an individual is personal data even in a business-to-business setting. A named employee’s work email, direct phone number, job title or correspondence may identify that person. A business therefore needs to consider how it informs professional contacts, not only consumers.
What to include in the notice
Articles 13 and 14 set out the information required for data collected from the person and data obtained elsewhere. The lists largely overlap; Article 14 also requires data categories and sources. Explain your own purposes and data flows rather than copying a bare statutory list.
- Controller and contact details. Give the controller’s name and contact details. Include the representative’s details where a representative has been appointed, and the data protection officer’s details where one is required or appointed.
- Purpose and lawful basis for each use. Explain each purpose in concrete terms, such as delivering orders, managing customer accounts, recruitment or sending a newsletter. Match every purpose to its own lawful basis under Article 6. A contract basis does not automatically cover every use of a corporate contact’s data just because that person works for a customer or supplier. Where the basis is legitimate interests, state the interests pursued. If a purpose relies on consent, say so.
- Data categories and sources. Describe the kinds of data involved, such as contact details, order history or billing information. When you obtain data indirectly, identify its source and, where relevant, whether it came from a publicly accessible source. For Article 14 notices, explain the categories of data received.
- Recipients. Name recipients where practicable, or describe categories such as payment providers, delivery companies or IT service providers. Distinguish processors from organisations that receive data for their own purposes where relevant.
- Transfers outside the EEA. Explain intended transfers to countries outside the European Economic Area or to international organisations, including whether a European Commission adequacy decision exists. Where you rely on safeguards, such as standard contractual clauses, describe them and explain how people can obtain a copy or where they are available. The notice must reflect the transfer arrangement actually used.
- Retention period or criteria. State how long data is kept, or the criteria used to decide. Avoid a bare promise to keep data only “as long as necessary”: explain what necessity means in practice, such as a statutory recordkeeping period or the duration of an account followed by a defined review or deletion process.
- Rights and how to exercise them. Explain applicable rights, including access, rectification, erasure, restriction, objection and portability where the conditions are met. Tell people they may complain to a supervisory authority. If processing relies on consent, explain how it can be withdrawn and that withdrawal does not affect earlier lawful processing.
- Whether providing data is required. When collecting data directly, explain whether providing it is a statutory or contractual requirement, or necessary to enter a contract. State whether the person is obliged to provide it and the possible consequences of not doing so. This helps distinguish optional information from what is needed for the requested service.
- Automated decisions. If Article 22 applies to a solely automated decision with legal or similarly significant effects, provide meaningful information about the logic involved and the significance and envisaged consequences for the person. A vague statement that “automated processing may occur” is not enough.
When and where to provide it
When you collect data directly, provide Article 13 information at that time. A prominent, accessible link can form part of a layered explanation. Place it beside the relevant contact form, application, sign-up or checkout so people can open the information before submitting data.
If you obtain personal data from elsewhere, Article 14 generally requires information within a reasonable period and no later than one month after obtaining the data. If you use the data to contact the person sooner, provide the information at the latest when you first communicate with them. If you plan to disclose it to another recipient, inform the person no later than the first disclosure. Article 14 has defined exceptions, including where the person already has the information or providing it proves impossible or would involve disproportionate effort in specified circumstances. Do not assume that posting a notice on a website alone automatically meets the duty.
A short collection-stage message can identify the controller, immediate purpose and link to the full notice. Keep the full notice accessible from relevant pages, commonly in the website footer, and link it again where people submit information.
Use language your audience can understand. English alone may not be sufficient for people served in Finnish or Swedish; consider who uses the service and in what language.
Keep the notice tied to real practices
Check the basis against the actual activity. For example, processing a consumer’s delivery address may be necessary to fulfil their order, while retaining invoices may serve a legal recordkeeping obligation. Legitimate interests require a separate assessment of necessity and the balance with the individual’s interests and rights; merely naming that basis in the notice is not enough.
Assess separate requirements too. Non-essential cookies and similar tracking technologies generally require consent; mentioning them in the notice does not replace it. Keep consent choices separate from the information explaining how data is used.
Where the Article 21 right to object applies, bring it explicitly to the person’s attention, clearly and separately from other information, by the first communication at the latest. If someone objects to processing for direct marketing, stop using their data for that purpose.
Workforce data is also subject to Finnish rules. Employers should check the Act on the Protection of Privacy in Working Life alongside the GDPR. A separate employee notice can explain recruitment, payroll, time recording and employment records more clearly than a general customer notice.
The Article 30 record of processing activities is an internal compliance document, not normally published. The under-250-person exception is narrow: it does not cover processing that is not occasional, is likely to result in a risk to individuals’ rights and freedoms, or involves special-category or criminal-offence data. Articles 12–14 have no general small-business exemption.
Review and update the information
There is no universal annual deadline. Update the notice when a relevant change makes it inaccurate or incomplete, such as a new purpose, system, recipient, source, transfer or retention approach. Tell people about a new purpose and relevant additional information before further processing begins.
Keep dated versions and compare the notice with actual forms, systems, supplier arrangements and internal processing records. Map the data and purposes, identify the controller and recipients, choose a lawful basis for each purpose, set retention criteria, then write for the people concerned.
Frequently asked questions
Does every business need a privacy notice?
Where the GDPR applies, controllers must provide the required information unless a specific exception applies. There is no general exemption based on business size. The narrow Article 30 exception for some small organisations does not remove transparency duties.
Do customers have to consent to the privacy notice?
No. A privacy notice explains processing; it is not itself a request for consent. Choose a lawful basis for each purpose. Where consent is the basis, request it separately and make withdrawal possible.
What is the difference between a privacy notice and a record of processing activities?
The notice is information for people whose data is processed. The Article 30 record is an internal compliance record describing processing activities, with limited exceptions. One does not replace the other.
Is a privacy policy in the website footer enough?
A footer link helps, but for direct collection provide the information at collection and link the notice at the relevant form. For indirectly obtained data, follow Article 14’s timing and exceptions.
How often should a privacy notice be updated?
There is no fixed annual interval under the GDPR. Review it when processing changes. If you intend to use data for a new purpose, inform people before that further processing begins.
If you are preparing a notice, it may help to check it against the business’s actual systems, contracts and data flows. See more about data protection and GDPR services for businesses, including data processing agreements. Contacting me does not commit you to engaging my services.
Sources and further information
- General Data Protection Regulation (EU) 2016/679, especially Articles 5–7, 12–14, 21–22, 28 and 30.
- European Data Protection Board: Respect individuals’ rights.
- Traficom: Cookies and consent.
- Act on the Protection of Privacy in Working Life (759/2004) (Finnish text).
English adaptation and GDPR requirements reviewed on 12 October 2026. This guide provides general information and does not replace advice on a specific situation.
