Privacy notice
Mandatory information under Art. 13/14 GDPR
TL;DR
The privacy notice must present all processing activities transparently: controller, purpose, legal basis, retention period, recipients, third country, data subject rights, supervisory authority.
What is a privacy notice?
Mandatory content (Art. 13):
- Identity of the controller
- DPO contact details (where applicable)
- Purpose and legal basis
- Legitimate interest where Art. 6(1)(f) applies
- Recipients / categories of recipients
- Third country transfers and safeguards
- Retention period
- Data subject rights (Art. 15-22)
- Right to lodge a complaint with the supervisory authority
- Obligation to provide the data
- Automated decision-making, Art. 22
Practical example
Online shop: privacy notice structured by processing purpose (ordering, newsletter, cookies, job applications); length based on practical experience around 8-12 pages, not a legal requirement.
Frequently asked questions
How often should it be updated?
Whenever the processing changes. A review every six months as a practice rhythm, not a statutory deadline.
Multilingual?
The information must be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language (Art. 12(1) GDPR). Where an offer specifically targets an audience speaking another language, this points towards a version in that language. Separate versions for DE/AT/CH are a practical recommendation, not a legal requirement.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult an admitted lawyer.