Every organization that processes personal data must inform the people concerned. Failure to provide proper information about processing can lead to administrative fines and a loss of trust. This guide explains what the information should contain, how to implement it, and where to look for technology support.
What is information about the processing of personal data?
Information about the processing of personal data is a document or notice explaining to people (customers, employees, users) how the controller uses, processes, and protects their data.
The obligation to prepare it follows directly from the GDPR (the General Data Protection Regulation). If you run a business and collect any personal data, this obligation applies to you.
Also see the earlier posts in the GDPR series for information about managing access to personal data and documenting processing activities.
What should information about personal data processing contain?
Under the GDPR, the information must be clear, understandable, and easy to access. It should include the following:
- The controller’s identity and contact details: who processes the data? This may be a company, organization, institution, or individual.
- The purpose of processing: why is the data processed? Examples include performing a contract, marketing, and handling requests.
- The legal basis for processing: on what basis is the data processed? This may be consent, performance of a contract, a legal obligation, or a legitimate interest.
- Categories of personal data processed: what data is collected? For example, a first name, surname, email address, or telephone number.
- Recipients of personal data: who may receive the data? For example, business partners, IT service providers, or public authorities.
- Data retention period: how long will the data be kept? This may be a defined period or the point when the processing purpose no longer exists.
- The data subject’s rights: the right to access, rectify, erase (the “right to be forgotten”), restrict processing, object to processing, and data portability.
- Information about transfers outside the EEA (where applicable): if data is sent to third countries, identify the safeguards used.
- Information about automated decision-making, including profiling (where applicable): is the data used in automated processes?
- The data protection officer’s contact details (if one has been appointed): the person responsible for personal data protection in the organization.
How do you implement information about personal data processing?
Implementing processing information in an organization requires several principles to be taken into account:
Tailor it to the type of processing
The information should reflect your business and the types of data processed. A notice for an e-commerce store will differ from one for a recruitment company.
Clarity and readability
Use plain language without unnecessary legal jargon. Your information must be understandable to every person whose data you process, regardless of their education or experience.
Publication and availability
Make sure the information is easy to access:
- on the company’s website,
- in registration forms,
- in contracts with customers and business partners.
The people concerned should have continuous access to it.
Updates
Update the information regularly, especially when:
- the purposes of processing change,
- you modify internal processes,
- you introduce new data-processing tools.
How can AI support the creation of personal data processing information?
Artificial intelligence can support your organization in three key areas:
Automating updates
AI can automatically update the processing information when processing activities change. The stated result is up-to-date GDPR compliance without manually monitoring every change.
Generating tailored notices
AI can create dedicated notices for different groups of people, such as separate information for marketing, recruitment, and customer service.
Monitoring compliance
AI can help monitor whether processing activities match the published information. If they do not, you receive an automatic notification.
Summary
Information about personal data processing is a required part of every organization’s data protection policy. The GDPR requires you to tell people whose data you process about:
- the purposes and legal bases for processing,
- how the data is used,
- the rights of the people concerned.
Properly preparing and sharing this information makes processing activities more transparent. With AI tools, you can automate updates, monitor compliance, and generate tailored notices.
If your company needs help preparing or updating personal data processing information, contact our law firm. We support organizations with data protection, including advice and help meeting GDPR requirements.
Frequently asked questions
What is information about personal data processing (a privacy notice), and who has this obligation under the GDPR?
Information about personal data processing is a document or notice explaining to people, including customers, employees, and users, how the controller uses, processes, and protects their data. The GDPR directly requires it from every organization that collects personal data. If you run a business and collect data, the obligation applies to you.
What must information about personal data processing contain under the GDPR?
It must include the controller’s identity and contact details, the purpose and legal basis for processing, categories of data processed, recipients, the retention period, and the data subject’s rights. If relevant to your organization, also include information about transfers outside the EEA, automated decision-making (including profiling), and the data protection officer’s contact details.
Where and how should you make processing information “easily accessible” to the people concerned?
Publish it on the company website, include it in registration forms, and attach it to contracts with customers and business partners. The key point is that people whose data you process should have continuous, unrestricted access to it, regardless of when or how they contact your organization.
When should a company update its personal data processing information?
Update it whenever the purposes of processing change, you modify internal processes, or you introduce new data-processing tools. In practice, the article says that every significant change in how personal data is used should automatically trigger a review and update of the notice.
How can AI help create and maintain up-to-date personal data processing information?
AI supports an organization in three areas: it can automatically update the information when processing activities change, generate tailored notices for different groups (for example, separate versions for marketing, recruitment, and customer service), and monitor whether processing activities match the published information. If they do not, you receive an automatic notification. The stated result is up-to-date GDPR compliance without manually monitoring every change.
