The privacy notice is a company’s most visible data protection document and also the most frequently copied. A copied notice, however, describes not your own processing but someone else’s. It is therefore not just worthless but potentially wrong.
Minimum content under the FADP
Under Art. 19 of the revised FADP, when collecting personal data the controller informs at least about its identity and contact details, the purpose of processing, the recipients or categories of recipients and, for disclosures abroad, the state and the safeguards or exception relied on. Where data is not collected from the data subject, the categories of data processed must also be stated.
Additional information under the GDPR
The GDPR requires more: the legal basis of each processing activity, a description of legitimate interests where relied on, the retention period or its criteria, data subjects’ rights including objection and withdrawal, the right to lodge a complaint with a supervisory authority, whether providing the data is required, and the existence of automated individual decisions. Companies subject to both frameworks usually align with the more comprehensive standard.
What is often missing
Concrete information on disclosures abroad instead of “worldwide”. A complete list of services used such as hosting, email delivery, analytics and AI tools. Retention periods. And processing outside the website: customer relationships, applications, suppliers. The privacy notice is not a website notice; it describes all processing about which people must be informed.
Deriving it from the record of processing
A company keeping a record of processing activities already has most of the information: purposes, recipients, foreign links, retention. The privacy notice is then derived from the record rather than written freely. That keeps it accurate and makes changes traceable.
Keeping it current
Every new tool handling personal data, every new vendor and every new feature can change the notice. A fixed step in the approval process — “does this affect the privacy notice?” — prevents it from going stale. The principles for disclosures abroad are described in our article on data transfers.