How to create a detailed privacy notice: The ICO Privacy Notice Generator

The Information Commissioner’s Office (ICO) has recently released a new privacy notice generator as part of the ICO25 Strategic Plan to ease compliance and transparency obligations for UK based small and medium sized enterprises. The tool offers SMEs an easy step-by-step process to create tailored privacy notices that are targeted to the business’s specific industry, such as education, finance, childcare, etc. It creates two different types of notices; one for organisations to display on their website and include in external communications for customers, and the other for internal communications geared toward staff members and volunteers. 

The ICO Privacy Notice generator is a useful tool if you already have an in depth understanding of your processing activities. In this article, we will focus on what you need to do before drafting the notice, including how to identify and describe your processing activities, and who to involve in the process. This aims to ensure that your organisation meets its obligations under GDPR Article 13 and 14, but also to make sure that your audience receives all information that they would need, for understanding your processing of their personal data. 

Below, is a detailed breakdown of the process you should follow before drafting the privacy notice: 

Step 1: Conduct a Data Inventory and Mapping exercise 

The first step is to understand what personal data your organisation collects, processes, stores, and shares. This involves: 

• Identifying Data Sources: Determine where personal data comes from, how it is collected (e.g., through websites, forms, or third parties), and the types of data collected (e.g., contact details). 
• Identifying the Purposes for Processing: Define the reasons why you are processing personal data. Organisations may use the same personal data for various purposes, and your privacy notice should document all of these uses. 
• Mapping Data Flows: Create a data flow map that tracks how data moves through your organisation. This includes collection points, where and how data is stored, who has access to it, and any third parties it is shared with.  
• Classifying Personal Data: Categorise the personal data you collect (e.g., identity data, financial data). This helps you define the categories you will include in the privacy notice and ensures you cover all the types of data processed. 
• Identifying Special Categories: Determine if your organisation processes sensitive personal data (e.g., health data, biometric data). Processing these categories requires specific safeguards, which should be detailed in the privacy notice. 
• Identifying Retention Periods: Identify how long your organisation stores personal data, and for which reason the data is stored (e.g., business use, legal obligation). This information should be documented in your privacy notice. 

Step 2: Identify and Document Third-Party Data Sharing 

Before drafting the privacy notice, you need to know with whom personal data is shared: 

• List of Recipients: Identify third parties with whom you share personal data (e.g., service providers, partners, legal authorities) and the purposes of sharing. This includes both internal and external parties. 
• Data Processor Agreements: Ensure that agreements are in place with third-party processors, outlining their responsibilities for data protection. This documentation will help you describe the data-sharing practices in the privacy notice. 
• International Data Transfers: Determine whether any data is transferred outside the UK or the European Economic Area (EEA). If so, identify the safeguards in place (e.g., standard contractual clauses, adequacy decisions) to comply with data transfer requirements under the UK and EU GDPR. 

 Step 3: Review Data Security Measures 

 Understanding the security measures in place for data protection is key and the follow actions will assist you in this respect:  

• Security Practices: Review your data security policies, including encryption, access controls, data minimisation, and employee training programs. 
• Data Breach Procedures: Ensure you have a process for handling data breaches, as this may need to be referenced in the privacy notice. 
• Data Retention Policies: Define the data retention periods for different categories of personal data or the criteria used to determine these periods. Understanding how long data is retained is crucial for the data retention section of the privacy notice. 

 Step 4: Draft the Privacy Notice 

 Based on the information gathered, input details in the key sections of the privacy notice: 

• who the controller entity is (i.e., the name and contact details of your organisation) 
• the type of data collected and how it is collected 
• why it is collected and used 
• the “lawful basis” the business relies on to process the data (e.g., consent, contractual obligation) 
• where the data is stored and the security measures in place 
• whether it is transferred to any third countries or other internal organisations 
• how long it is held for 
• the data subject’s rights in relation to the data, including their right to complain 
• how to contact your organisation or the DPO 
• information on changes to the privacy notice 

Step 5: Engage with stakeholders for review  

Given that this is a public facing document that communicates key information to your audience, it is important to ensure that your privacy notice is accurate and reflects the interests of key stakeholders. As such, you may consider involving the following key internal stakeholders to provide inputs and overall review and ensure the accuracy of your privacy notice: 

• Data Protection Officer (DPO): If your organisation has a DPO, involve them in the process to ensure compliance and address any legal concerns. 
• Legal and compliance teams: Work with your legal and compliance departments to validate the information, particularly where you have identified legal obligations to process personal data.  
• IT and Security teams: Collaborate with the IT and security team to accurately describe technical aspects, such as data security measures and retention schedules. 
• Marketing and Communications teams: While the privacy notice is a compliance requirement, it should also be transparent and easily understood. Involving your Marketing and Communications teams can be helpful for ensuring that the content aligns with your organisation’s messaging, and that it is written in an appropriate language for your audience. 

Step 6: Undertake regular reviews 

Once the privacy notice is published on your website, it’s crucial to review it regularly to ensure it remains accurate and up-to-date. Data processing activities, legal requirements, and organisational practices can change over time, and the privacy notice must reflect these updates.  

 Regular reviews should be conducted, at a minimum annually, or whenever significant changes occur, such as the introduction of new data processing activities, changes in third-party data sharing, or updates to data security measures.  

 A scheduled review process also provides an opportunity to assess and improve the notice's clarity and accessibility for users. By keeping the privacy notice current, you not only comply with data protection laws but also build trust with individuals by demonstrating your commitment to transparency and accountability in handling their personal data. 

By conducting a thorough data inventory, identifying lawful bases, understanding data subject rights, reviewing security practices, and consulting relevant stakeholders, you set a strong foundation for drafting a privacy notice. These steps ensure that the final document will be comprehensive, transparent, legally compliant, and tailored to your organisation’s data processing activities. 

The privacy notice generator released by the ICO is a great starting point for businesses wanting to improve on their data privacy compliance as it is user friendly and encourages businesses to think about how they process data. By following the process, we have outlined above, your organisation will be ready to create a detailed and compliance privacy notice.  

If you’d like to know more about how our data protection experts can support your organisation, check out the specialist services we provide.