Newport Thomson

A good privacy policy should:

1. explain how the organization safeguards your information,
2. including details about third-party involvement, or
3. direct you to relevant pages for more information.

Almost all data protection and privacy laws require you to explain, concisely and using plain language (no legal speak), why you collect this data, who you share it with and why and when you delete it. Transparency and choice are the foundations of a good Privacy Statement (some list it as Privacy Policy on their website).

Your privacy policy must cover the following information.

1. Identity and contact details of the Privacy lead, including 2 ways to easily reach that person.
2. Contact details of the Data Protection Officer (if required or appointed)
3. How the organization uses specific fields of data and their purposes (this includes any processing activity, not only through third-party services like newsletters, customer information, invoice data, and social media)
4. Legal basis of the processing and the reasoning behind it
5. Information about special categories of personal data (like handling of children’s data and sensitive data)
6. Recipients of data
7. Information about data transfers to third countries and the suitable safeguards
8. Period for which data will be retained
9. How to make use of data subject rights
10. Option to change or withdraw consent
11. Option to complain or appeal to supervisory authorities
12. Existence of automated decision-making and its uses