What must a privacy notice contain?

The standard components of a privacy notice

A privacy notice typically states who processes the data, why, and what rights the data subject has in connection with that processing. Specifically, it includes the identity and contact details of the organization that processes the data, and the contact details of a data protection officer if one has been appointed. It also sets out the purposes for which the data is used and the lawful basis for that processing — for example, contract performance, a legal obligation, or a legitimate interest, with that interest also being specified.

The notice must also state who the data is disclosed to, whether it goes to a country outside the EU, and how long it is retained — or, if a fixed period cannot be given, what criteria are used to determine the retention period. The data subject's rights are also included: access, rectification, erasure, restriction, objection, portability, and the ability to withdraw consent that has been given. Finally, the notice states the right to lodge a complaint with the supervisory authority, and — if applicable — whether the provision of data is a legal or contractual obligation and what the consequences are if someone does not provide it, plus whether automated decision-making or profiling is taking place.

This is set out in Article 13 of the GDPR

This list follows directly from Article 13 of the GDPR, which prescribes what information an organization must provide at the time it collects personal data directly from the data subject. The GDPR is a regulation and these requirements therefore apply in substance equally in every Member State; what differs is which supervisory authority handles the complaint right mentioned — in the Netherlands the Dutch Data Protection Authority, in Germany the supervisory authority of the state where the establishment is located. For the full text of the provision and for further guidance, the regulation itself can be consulted, and for Dutch practice the website of the Dutch Data Protection Authority.