Privacy notices have a reputation for being long, incomprehensible texts accepted without reading. The reputation is partly deserved. But a privacy notice, if you know where to look, answers the questions that matter in a few minutes: who uses my data, to do what, who they share it with and for how long. Learning to read one is the basic skill for exercising every other right.
What it must contain
Articles 13 and 14 of Regulation (EU) 2016/679 set out the information the controller must provide: Article 13 when it collects data directly from you, Article 14 when it obtains it from other sources. Article 12 adds that the information must be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
The main mandatory elements are:
- the identity and contact details of the controller and, if appointed, of the Data Protection Officer;
- the purposes of the processing and their legal basis;
- the legitimate interests pursued, if the processing relies on them;
- the recipients or categories of recipients;
- any transfers to non-EU countries and the safeguards in place;
- the retention period or the criteria for determining it;
- the data subject's rights and the right to complain to a supervisory authority;
- the option to withdraw consent, where processing is based on it;
- whether providing the data is mandatory and the consequences of refusing;
- the existence of automated decision-making, including profiling, with information on the logic involved.
When data is not collected from you, the notice must also state the source it comes from and the categories of data.
The five sections to read first
1. Purposes and legal bases
This is the heart of the document. A well-made notice pairs each purpose with its legal basis, often in a table. Pay attention to which purposes require your consent and which do not: the former are optional, and you can refuse them without losing the main service.
2. Legitimate interest
If you find many purposes based on legitimate interest, read how they are described. "Improving our services" is vague; "preventing payment fraud" is specific. Remember that you can exercise the right to object under Article 21 against this processing.
3. Recipients
Look for categories such as "business partners", "group companies", "advertisers". If data is passed to third parties for their own marketing purposes, there should be a separate consent.
4. Retention
A notice that only says "for as long as necessary", with no criteria, is not satisfactory. A good example: "account data is deleted 24 months after the last login; invoices are kept for the period required by tax law".
5. Transfers outside the EU
If data is transferred outside the European Economic Area, the notice must say to which countries or under which safeguards, for example a European Commission adequacy decision or standard contractual clauses.
Signs of poor transparency
| Sign | Why it is a problem |
|---|---|
| No distinction between purposes | You cannot tell what you are agreeing to |
| A single consent for everything | Consent must be specific for different purposes |
| "We may share data with third parties" without details | You do not know who receives the data |
| Indefinite retention | It conflicts with the storage limitation principle |
| Missing or generic controller contact details | You do not know where to send requests |
| Text only in a foreign language for a service aimed at local users | It is unlikely to meet the intelligibility requirement |
Layered notices
Many services use a layered notice: a short, visible summary with links to detailed sections. It is good practice, provided the summary does not leave out essential information, such as purposes based on consent or sharing with third parties.
A concrete example
You are about to install an app for booking gym sessions. The notice lists three purposes: managing bookings (contract), sending promotional offers (consent), analysing usage to improve the app (legitimate interest). You now know you can refuse consent to offers without losing bookings and that, if you wish, you can object to the usage analysis. In two minutes you have understood what you are really accepting.
When the notice does not answer
If the notice is incomplete or ambiguous, you can ask the controller or the Data Protection Officer for clarification, or exercise the right of access under Article 15, which entitles you to much of the same information as it applies to your specific case.
In short
- Articles 13 and 14 GDPR list the information every privacy notice must contain.
- Read purposes and legal bases, legitimate interest, recipients, retention and transfers first.
- Purposes based on consent are optional and can be refused without losing the main service.
- A single consent, vague recipients and indefinite retention are signs of poor transparency.
- If the notice is not enough, ask for clarification or exercise the right of access.