GDPR The Necessity of Adding a Privacy Policy to Your Website

Article 13 of the GDPR is very prescriptive on the information that must be provided to the data subject at the time their personal data is collected.  It states that the privacy policy should include the following information:

1. the identity and the contact details of the controller
2. the contact details of the data protection officer
3. the purposes and legal basis for the processing
4. where the processing is based on legitimate interests, details of what these are
5. the recipients or categories of recipients of the personal data
6. details of any transfer to a third country and details of the safeguards and the means by which to obtain a copy of them or where they have been made available
7. the retention periods or the criteria used to determine that period
8. details on rights of access to and rectification/deletion of personal data. Rights to object to processing and the right to data portability
9. if processing is based on consent, the right to withdraw consent
10. the right to lodge a complaint with the supervisory authority
11. details on whether the data subject is obliged to provide the personal data and the consequences of failure to provide it
12. details of any automated decision making, including details of the logic used and potential consequences for the individual

As the information that is contained with your Privacy Policy needs to be “easily visible, intelligible and clearly legible….and meaningful overview of the intended processing”. (Article 12 (7) ) It is no longer acceptable to just use widely available templates for your policy. Each policy needs to be individualised to reflect the uniqueness  of each businesses specific set up in relation to how data is collected, used, stored etc.

While there is no doubt that GDPR is going to be somewhat of a headache for SME’s the overall principal behind it, the rights and protection of peoples personal data, is sound and is very much a good thing in general. If approached in the right way creating your Privacy Policy can become a very useful tool for you and your business. By starting off on the right foot now it can assist you in setting up better administrative structures, creating more streamline methods of collecting and using data, as well as eliminating old stockpiles of non -essential, non-relevant files.