A privacy notice is evidence of what an organisation says it does. The legal question is whether people received clear, accessible information at the right time and whether actual practice matches it.
Key points
- Information differs depending on whether data came from you or elsewhere.
- The notice should explain purposes, lawful bases, recipients, retention, rights and complaint routes.
- Legitimate interests should be identified, not merely named.
- Material new purposes may require fresh information and a compatibility assessment.
- A privacy notice cannot authorise unfair or unlawful processing simply by mentioning it.
What you should be told
Core information includes controller identity and contact details, purposes and lawful bases, legitimate interests where relevant, categories and sources in indirect collection cases, recipients or categories, international-transfer safeguards, retention periods or criteria, rights, the ICO complaint right, and automated-decision information where applicable.
Timing and layers
Information should be provided when data is collected directly. Where it is obtained elsewhere, different timing rules apply, generally within a reasonable period and subject to the statutory detail. Layered notices can be effective if the first layer gives meaningful essentials and deeper information is genuinely accessible.
Notice versus reality
Audit the notice against events. If a notice says data is kept for six months but a five-year archive is used for scoring, the problem is not solved by updating the notice later. Challenge the retention, purpose, basis and fairness separately.
Changes and dark patterns
Buried wording, vague categories and forced acceptance can undermine transparency. Consent must not be bundled into simply acknowledging a notice. A change notification should explain the material difference rather than tell people to reread a long policy.
Build the record
Turn the concern into answerable questions
- Identify the exact personal data or processing activity.
- Record dates, systems, people and any decision or disclosure affected.
- Choose the right legal tool for the outcome you need.
- Ask for a reasoned answer and a specific corrective action.
- Keep the request, acknowledgement, evidence and final response together.
If several rights are involved, number them separately. A request for access, a request to correct data and a complaint about previous handling can run alongside one another, but they have different legal tests and may have different deadlines.
Worked examples
| What happened | The data-protection question | Likely next route |
|---|---|---|
| A lender obtained data from a broker | Ask what source, categories and Article 14 information were provided. | Data sharing and access |
| An app adds location tracking | Check purpose, basis, necessity and whether the new use was clearly explained. | Lawful basis and complaints |
| A notice says “trusted partners” only | Ask for recipient categories and, through access, actual recipients where applicable. | Data sharing and SAR |
Useful wording
“Please identify when and how the required privacy information was provided, the purpose and lawful basis for this use, the source and recipients, and the retention period. Please explain any difference between the published notice and the processing that occurred.”
Keep the request focused on the data or processing activity. Ask the organisation to identify its position and the corrective action it will take. Keep a copy and proof of delivery.
Official sources
Check the rules behind this guide
These are official or primary sources. Check the current text before relying on a formal deadline, procedure or court route.