GDPR privacy notice requirements: what to include and when

What a GDPR privacy notice must contain and when it must be given

A privacy notice must contain the Article 13 items when data come from the individual and the Article 14 items when they do not, and it must reach the person on the deadlines those articles set. Article 13 requires the information at the time the data are obtained, covering the controller's identity and contact details, the DPO's contact details, purposes and legal basis, recipients, any third-country transfer and its safeguards, the retention period, the individual's rights and any automated decision-making. Article 14 adds the categories of personal data concerned and the source, including whether the data came from publicly accessible sources. Where data come from a third party, the notice must be given within a reasonable period and at the latest within one month, at the first communication with the person, or when the data are first disclosed to another recipient.

The exact content depends on your processing, recipients, transfers and automated decisions, so the notice is only as accurate as the inventory behind it. Before drafting, confirm which activities collect data directly, which receive it from others, every processor and recipient category, every transfer outside the EEA, and every decision made without human involvement. The Dutch DPA's fine on Uber, reported by the EDPB on 8 October 2026, included a finding that drivers were not sufficiently informed about automated decision-making under Article 13, which shows that gaps in this area draw enforcement. The EDPB's 2026 coordinated enforcement action, launched on 19 March 2026, also examines Articles 12, 13 and 14, so expect a regulator to compare the published text with actual practice.

The organization owns the notice and its accuracy. A DPO or counsel should review it against the processing inventory, and your engineering team should confirm that the systems behave as described. An implementation partner can help prepare the processing inventory, the system documentation and the evidence of change control, but no partner or auditor issues a certificate for a privacy notice, because the GDPR requires no audit, attestation or certificate for this purpose. Ask any vendor who offers a notice 'certification' what it actually covers, and confirm with your DPO which parts of the notice rely on decisions that only your organization can make.

Which items Article 13 requires in the notice

Article 13 applies when personal data are collected directly from the individual, and the notice must be given at the moment of collection. The six components below, plus rights and automated decisions, are the items an assessor will check first, and each one should match what your own records say.

Controller identity and contact details

State the legal entity that decides why and how data are processed, and give a contact route a person can actually use. A shared mailbox that nobody monitors fails the purpose of the notice. Check that the name matches the controller recorded in your record of processing activities, including group companies that act as separate controllers.

DPO contact details

Where you have designated a data protection officer, publish the DPO's contact details in the notice. If you have no DPO, the notice should still say how privacy questions reach the team responsible for them. Confirm that the address routes to someone with authority to respond, not only to a general support queue.

Purposes and legal basis

For each purpose, state what you do with the data and the lawful basis that covers it, so a reader can see the link between the two. Generic phrases such as improving services rarely satisfy an assessor. Compare every purpose against your record of processing and your legitimate interest assessments, and remove any purpose the systems no longer serve.

Recipients

Name the categories of parties that receive the data, such as payment processors, hosting providers or affiliates. Where your processors are many, a category description is usually enough, but the list must reflect the actual flows in your systems. Check the notice against your processor contracts and integration inventory so that a newly connected tool does not appear in production without a notice update.

Third-country transfers and safeguards

If any data leave the EEA, the notice must say so and identify the safeguard relied on, such as an adequacy decision, standard contractual clauses or an approved derogation. Support staff who access data remotely from outside the EEA count as a transfer. Confirm each destination against your transfer mapping before publishing.

Retention period

State how long each category of data is kept, or the criteria used to decide that period. A retention schedule that the notice does not reflect is a common finding. Check every stated period against the schedule and confirm that backups and logs follow the same rule, since deletion gaps in those systems are where audits often find mismatches.

Data subject rights and automated decisions

List the rights individuals hold, how to exercise them, and their right to lodge a complaint with a supervisory authority. If any decision is made solely by automated means with legal or similarly significant effects, the notice must explain the logic involved and the consequences. The Dutch DPA's 2026 fine on Uber cited insufficient information on automated decisions, so verify that every automated decision in your systems is described.

How Article 14 changes the notice when data come from third parties

Article 14 adds two items to the Article 13 set: the categories of personal data concerned and the source of the data, including whether the data came from publicly accessible sources. A notice that covers Article 13 but says nothing about where the data came from does not meet Article 14 when the controller did not collect the data from the person directly. The source must be named at the level of a category that a reader can understand, such as a data broker, a credit reference agency, a public register or another group company. Vague wording like 'third parties' or 'our partners' is the kind of gap a supervisory authority will test.

Consider an illustrative fraud-screening dataset bought from a broker. The organization scores new customers against it, and the people scored never filled in a form with that organization. The privacy notice must still name the broker category as the source, list the categories of data the broker supplies, and state the timing rule in Article 14(3). Confirm with your DPO or counsel how the timing applies to your flows, because the one-month outer limit, the first communication with the person and the first disclosure to another recipient each can trigger the notice first.

Organizations miss this because they design notices around sign-up forms and checkout screens, where Article 13 information is collected at the point of entry. Data bought, enriched or inferred from other systems never passes through those screens, so it falls outside the notice by default. Build an inventory that flags every dataset whose origin is not the individual, including scores, enrichment feeds and derived attributes, and assign each one a source category and a notice owner before it enters production. Re-check the inventory whenever a new vendor feed or internal model is added.

When the notice must reach the person: deadlines for third-party data

This sequence tells the team which event starts the Article 14 clock, which limit applies first, and what record proves the notice went out on time. Working through it in order keeps the privacy notice ahead of any processing that depends on it.

Record the date personal data were received
When personal data arrive from a source other than the individual, the team that receives them logs the date of receipt, the supplying organization or source, and the data categories received. The data protection lead or privacy owner confirms the entry in the record of processing. The step is complete when every third-party data set in the inventory has a receipt date that can be traced to a file, feed or contract.
Identify the source and public availability
Article 14 requires the notice to state where the data came from, including whether they came from publicly accessible sources. The privacy owner records the source name, the collection route and whether the data were taken from a public register, a website or a commercial data broker. The check is done when each source entry in the notice draft matches the source record kept by the data owner.
Set the reasonable period from receipt
Article 14(3) asks for information within a reasonable period after the data are obtained, taking account of the specific circumstances of the processing. The team documents what it considers reasonable for each data flow and why, and the privacy owner approves that position. The output is a short note per flow stating the planned notice date and the reasoning behind it, which an assessor can read alongside the notice itself.
Track the one-month outer limit
The one-month period in Article 14(3) is the latest point for giving the information, not a target to aim for. The team sets a tracking date one calendar month after receipt in the case register, and the privacy owner reviews open items against it. The step closes when every third-party data set has a recorded latest date and a notice status, so no flow can drift past the limit unnoticed.
Check for earlier first contact
If the team will communicate with the individual before the outer limit, the notice must be given at the latest at that first communication. Account managers, marketing, support and collections staff confirm whether they plan any contact, and the privacy owner moves the trigger date forward where needed. The output is a contact check per data set, signed off before the first outreach takes place.
Check for earlier first disclosure
Article 14(3) also requires the notice no later than the first time the data are disclosed to another recipient. Engineering and data sharing owners list every transfer, export, API call or partner feed that could carry the data, and the privacy owner compares each planned date with the notice date. The step is complete when the earliest disclosure date for each data set is written in the register next to the other triggers.
Apply the earliest trigger and record the notice date
The earliest applicable trigger governs, whether it is the reasonable period, the one-month limit, first contact or first disclosure. The privacy owner records which trigger applied, the date the notice was actually delivered and the channel used, such as a direct message or a layered notice link. The closed entry, kept with the record of processing, shows that the notice was timely for that data set.

Layered privacy information: first layer and second layer

The first layer is the short summary a person sees before or as they provide data. The EDPB's guide for small businesses recommends that it state the controller's identity, the purposes of processing, the recipients, the source of the data where it was not collected directly, and the individual's rights. It should sit in a visible place, such as a banner, a pop-up at the point of collection or a clearly labelled link on a form, so the person does not have to search for it.

Controller identity: the organization's name and a contact route that reaches a person, not only a generic inbox.
Purposes: each purpose in plain language, matched to the data collected at that point.
Recipients: the categories of recipient, including processors and any transfer outside the EEA.
Source: where the data came from when it was not obtained from the person.
Rights: a clear pointer to access, erasure, objection and the right to complain.

Check that a tester who starts from the form or screen can reach the first layer in one click, and that every field or event that triggers collection is covered by the summary text.

Notifying changes before they take effect

This table compares four kinds of processing change, what the individual must be told about each, and when. Read the timing column as the latest acceptable point: the more substantial the change, the earlier people should be told. The main takeaway is that a privacy notice is not a one-time document, so each planned change needs a notice update step before it goes live.

Type of change	What must be communicated	When the individual must be told
New recipient	The new recipient or category of recipient, and why data are now shared with it	Before the change takes effect, so people can object or exercise their rights in time
Compatible new purpose	The new purpose, its legal basis, and how it relates to the original purpose	Before the new processing starts, with enough notice for the individual to understand the change
Transfer outside the EEA	The destination country, the transfer safeguard relied on, and how to obtain a copy of it	Before the transfer begins, since the change moves data outside the EEA
New automated decision affecting individuals	The logic involved, the significance and likely consequences for the person, and their rights to contest or seek human review	Before the decision system is used on individuals, so the explanation reaches people before outcomes affect them
Substantial change of any type	All details of the change, including how it differs from current practice	As early as possible before the change takes effect, with more lead time for larger changes

Why transparency is an enforcement focus in 2026

Transparency is under direct regulatory scrutiny right now. On 19 March 2026 the EDPB launched a coordinated enforcement action with 25 data protection authorities that examines whether controllers meet the transparency and information obligations in Articles 12, 13 and 14. Coordinated actions mean several authorities ask the same questions of many organizations in the same window, so a notice that has never been challenged may still be examined. The EDPB's announcement of the action is the starting point for understanding the scope.

The clearest signal so far is the Dutch DPA's decision to fine Uber EUR 824,990,000, announced on 8 October 2026. Besides finding a breach of Article 22 on automated decision-making, the authority found that Uber did not sufficiently inform drivers about that automated decision-making as Article 13 requires. Uber has appealed, so the fine is not final. The lesson for other controllers is that a notice can fail on its own, even when the processing itself is the main subject of the case. Under Article 83(5), infringements of the rights and transparency-related provisions can carry fines of up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher. This is a single case against one company, and it does not set a rule that every organization with automated processing will face the same outcome.

Treat the Uber finding as a checklist rather than a verdict. Take your current notices and ask the questions an authority would ask: can a data subject find the first layer without searching, does it name the automated decisions and the logic behind them, does it state the source of data obtained from third parties, and was it updated before the processing changed. Confirm each answer against the live product, not the policy document. Your DPO or privacy lead should own this review and record the results, because the record is what you will show if an authority asks.

What usually makes privacy notices fail review

Privacy notices rarely fail because of missing paragraphs. They fail because the text drifts away from what the organization actually does with personal data. The cards below cover the gaps assessors and regulators most often find, and the checks that close them before publication.

Purposes missing from the record

A notice lists purposes that no processing activity in the record of processing supports, or the record contains activities the notice never mentions. Either gap makes the notice unreliable as Article 13 or 14 information. Before publication, reconcile each stated purpose with its entry in the record, including its legal basis and recipients. Assign one owner to sign off the match whenever a new activity is added.

Missing Article 14 sources

When data come from a third party, such as a data broker, a credit reference agency or a partner platform, Article 14 requires the notice to name the categories of data and the source, including whether it came from publicly accessible sources. Notices often say only that data are collected from partners. Name the source type for each data category and check the one-month outer limit in Article 14(3) against the first contact or first disclosure date.

No update after new recipients

Adding a new processor, a new compatible purpose or a transfer outside the EEA is a change the notice must reflect before it takes effect. Teams often sign the contract and launch the feature, then update the notice weeks later. The EDPB's small business guide says the more substantial the change, the earlier people should be told. Make notice updates a release gate for vendor onboarding and new features, and record the date each change was communicated.

Vague automated decision descriptions

Where decisions are made or materially shaped by automated processing, the notice must explain the logic involved, the significance and the likely consequences in plain terms. Phrases such as 'we may use automation to improve our services' do not meet that test. The Dutch DPA's fine on Uber found insufficient information about automated decision-making under Article 13, among other findings, and Uber has appealed. Have engineering describe the actual decision inputs and outcomes, and have legal check that the description matches the production model.

First layers without rights or identity

The EDPB's layered approach puts the controller's identity, purposes, recipients, source and rights in the first layer, shown where people see it or in a pop-up. Many first layers name the company but omit how to exercise rights or how to reach the DPO. Check the first layer against a list of required items on each release, and confirm that the rights link works for logged-out visitors as well as account holders.

Notices that drift from retention

The notice states retention periods that differ from what systems, backups and logs actually keep. This is one of the transparency gaps that the EDPB's 2026 coordinated enforcement action examines alongside Articles 12, 13 and 14. Compare each stated period with the retention schedule and with deletion job logs before publication. Assign a named owner to rerun this comparison whenever a system, backup or data store changes.

Questions buyers ask about GDPR privacy notices

Who has to write a GDPR privacy notice and who approves it?

The controller, meaning the organization that decides why and how the personal data are processed, is responsible for the notice and for its accuracy. In practice the work is drafted by the team that owns the processing, such as product, HR or marketing, reviewed by legal or privacy staff, and checked by the data protection officer where one has been designated. Approval sits with someone who can commit the organization to the statements, usually the privacy lead or a senior business owner. A partner can prepare the drafts and the system-level facts behind them, but the organization must own and sign off the final text.

Can one privacy notice cover several products or websites?

Yes, if the processing described is genuinely the same controller's processing for the same purposes. A single notice often works for a group of related services, but each separate controller, purpose set or data flow must be identifiable in it. Where products collect different categories of data, use different recipients or transfer data to different countries, the notice needs product-specific sections or a separate notice. A useful test is whether a data subject reading the notice could tell which information applies to them.

Does a privacy notice need a certificate or an audit?

No. The GDPR does not require an audit, attestation or certificate for a privacy notice, and certification under Article 42 is voluntary. Compliance is shown by the notice itself, the records behind it and the way it is kept accurate. Any certification is issued by an accredited body or supervisory authority, and it does not reduce the controller's responsibility. Independent reviews by auditors can add assurance for a customer or board, but they are a choice, not a legal requirement for the notice.

What does the work need from internal staff?

The biggest input is accurate knowledge of the processing, which sits with engineers, product owners, HR and vendor managers rather than with legal alone. Staff need to confirm which personal data are collected, where they come from, who receives them, where they are transferred, how long they are kept and whether any automated decisions are made. Each of these maps to a required element of Article 13 or 14, so gaps tend to show up as questions the notice cannot yet answer. Plan for interviews, a review of data flows and sign-off time from the business owners.

Can an implementation partner handle the privacy notice work?

An implementation partner can help with the technical and operational side, such as mapping systems and data flows, documenting retention and recipients in a form the notice can draw on, and maintaining the evidence that the stated practices are true. DeployOpen prepares systems, controls and evidence for compliance assessments and does not write legal conclusions on the organization's behalf or issue any attestation. The legal wording, lawful basis decisions and final approval remain the organization's responsibility, so agree that split in writing before work starts.

What drives the cost and effort of a privacy notice project?

The main drivers are the number of processing activities, the number of systems that hold personal data, how many third-party recipients and transfers need to be described, and whether automated decision-making or special category data is involved. Costs recur when products change, new vendors are added or a new purpose is introduced, because each change may require the notice to be updated before it takes effect. Ask any quote to break the work into the initial inventory, drafting, technical verification, approvals and ongoing updates, and to state which parts are one-time and which recur.

How often should a privacy notice be reviewed?

Review the notice whenever the processing it describes changes, and build that trigger into product and vendor change processes instead of relying on an annual calendar alone. Changes such as a new recipient, a compatible new purpose or a transfer outside the EEA should be communicated before they take effect, and the more substantial the change, the earlier people should be told. The European Data Protection Board also expects the information to stay accurate in practice, so a scheduled check of the notice against actual data flows is a sensible addition.

How DeployOpen prepares systems and evidence for privacy notices

DeployOpen helps organizations that run self-hosted open-source platforms prepare the systems, data flows and written evidence behind their GDPR privacy notices. We map what each platform collects and where it goes, then help the controller write and maintain notices that match real processing. The controller owns its notices, and an independent auditor or supervisory authority is the party that assesses them.

How we scope

Written scope agreed before work starts, listing the platforms, data flows and notice layers covered
Inventory of personal data categories, sources and recipients for each in-scope platform
Identification of third-country transfers, automated decisions and changes planned before go-live

How we build

Draft first-layer summaries and second-layer notice content mapped to the Article 13 and 14 items
Configure consent screens, links and notice placement in the platforms the client controls
Test that notice text matches actual collection, retention settings and recipient lists in each system

How we hand over

Delivery of notice drafts, data flow maps and a change log linked to each processing purpose
Written procedure for notifying data subjects before a new recipient, purpose or transfer takes effect
Documented handover so the client's privacy and legal owners can approve and maintain the notices

How we support

Ongoing support and upgrades available as a retainer, covering notice updates after platform changes
Periodic review of notices against system configuration, with the client deciding each change
Preparation of evidence for an assessor, while the assessor, not DeployOpen, issues any findings