A privacy notice informs data subjects about how a company or another controller processes personal data. In particular, it explains the purposes and legal bases of the processing, the retention period and the rights of data subjects. The legal requirements are set out in Articles 12 to 14 of the General Data Protection Regulation (GDPR). The aim is to ensure that data processing is transparent and understandable.
When is a privacy notice required by law?
Companies and other controllers must inform data subjects about the processing of their personal data. The information obligations arise from Articles 13 and 14 GDPR and apply regardless of the size of the company.
A privacy notice is particularly required for websites on which personal data is processed. This includes, for example, IP addresses, information submitted through contact forms, customer account data and information collected through analytics and tracking services.
However, the information obligations are not limited to websites. Controllers must also provide the information required by law when processing customer, employee or applicant data.
Article 13 GDPR governs the information obligations where personal data is collected directly from the data subject. Article 14 GDPR, by contrast, applies where the data is not collected directly from the data subject. Different requirements apply in each case with regard to the timing of the information and certain mandatory details.
What information must a privacy notice contain?
The information that must be included in a privacy notice is set out in particular in Articles 13 and 14 GDPR. The information required in each individual case depends on the processing activities actually carried out.
The key mandatory information includes:
- Controller: The name and contact details of the controller responsible for the data processing and, where applicable, its representative.
- Data protection officer: The contact details of the data protection officer, if one has been appointed.
- Purposes and legal bases of processing: Information about the purposes for which personal data is processed and the legal bases relied upon for the processing.
- Legitimate interests: A description of the legitimate interests pursued where the processing is based on Article 6(1)(f) GDPR.
- Recipients of the data: Information about the recipients or categories of recipients of personal data.
- Transfers to third countries: Information about intended transfers of data to third countries or international organisations, together with details of the safeguards applicable to those transfers.
- Retention period: Information about how long the data will be stored or the criteria used to determine the retention period.
- Data subject rights: Information in particular about the rights of access, rectification, erasure, restriction of processing, data portability and objection.
- Withdrawal of consent and right to lodge a complaint: Information about the right to withdraw consent and the right to lodge a complaint with a data protection supervisory authority.
- Other statutory information: Where applicable, information about whether the provision of personal data is a statutory or contractual requirement, whether the data subject is obliged to provide the data and the possible consequences of failing to do so, as well as information about automated decision-making, including profiling.
Where personal data is not collected directly from the data subject, Article 14 GDPR additionally requires, in particular, information about the categories of personal data processed and their source. The statutory exceptions to the information obligations, particularly those under Article 13(4) and Article 14(5) GDPR, also apply.
A privacy notice must accurately and completely describe the actual processing activities. Generic template texts therefore cannot replace an assessment of the specific data processing carried out.
How must a privacy notice be structured and made available?
Under Article 12(1) GDPR, data protection information must be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
For company websites, this means that the privacy notice must be easy to find and accessible without unnecessary barriers. In practice, it is usually made available through a clearly labelled link, for example in the website footer.
The information should be clearly structured and explain the services used and the associated data processing in an understandable way. Unclear wording, contradictory statements and overly general descriptions do not meet the transparency requirements.
A privacy notice must be distinguished from a consent declaration. It provides information about data processing and does not replace any consent that may be required, for example for certain tracking technologies. The requirements of Section 25 TDDDG must also be observed when storing information on end users' terminal equipment and accessing information already stored there.
When must data protection information be provided and updated?
Where personal data is collected directly from the data subject, the information must generally be provided at the time of collection, in accordance with Article 13 GDPR.
Where personal data is obtained from other sources, the timing is governed by Article 14(3) GDPR. As a general rule, the information must be provided within a reasonable period and no later than one month after obtaining the personal data. Specific timing requirements apply where the controller communicates with the data subject earlier or discloses the data to another recipient.
A privacy notice must also reflect the actual state of data processing. If new services are introduced, processing purposes are changed or personal data is disclosed to additional recipients, the controller must assess what changes to the data protection information are necessary.
There is no statutory requirement to update a privacy notice at fixed intervals. However, controllers must ensure that the information remains accurate and that data subjects are informed of relevant changes in good time.
What are the consequences of a missing or incorrect privacy notice?
A missing, incomplete or misleading privacy notice breaches the data protection information obligations unless a statutory exception applies.
Under Article 58 GDPR, the competent data protection supervisory authority may order measures to remedy the infringement. This includes, in particular, requiring the controller to provide data subjects with the information prescribed by law.
Infringements of the information obligations may also be subject to administrative fines under Article 83(5)(b) GDPR. The statutory maximum is EUR 20 million or, in the case of an undertaking, 4% of its total worldwide annual turnover for the preceding financial year, whichever is higher.
However, having a compliant privacy notice does not, by itself, ensure that data processing is lawful. All processing activities must also meet the other requirements of the GDPR.
Practical example: Privacy notice for an online shop
An online shop processes its customers' personal data for order fulfilment, payment processing and delivery. The company also uses a contact form and an external analytics service to analyse how its website is used.
In its privacy notice, the online shop explains which personal data is processed for each activity, the purposes of the processing and the legal bases relied upon. It also explains the retention periods, the recipients involved and the rights of data subjects.
For order fulfilment, the company relies on Article 6(1)(b) GDPR. When using the analytics service, it separately assesses the applicable data protection requirements and the requirements of Section 25 TDDDG. Where consent is required, the online shop obtains it before carrying out the relevant processing or accessing the user's terminal equipment in a way that requires consent.
If the company introduces an additional marketing service, it reviews the associated data processing activities and supplements its privacy notice with the information required.
legal data assessment: A privacy notice must provide a complete, understandable and legally accurate account of a company's actual processing activities. Standardised template texts are insufficient if they incorrectly describe the technologies used, data recipients or processing purposes. Companies should therefore tailor their data protection information to their specific processes and review it whenever their data processing activities change.
Legal bases
The key requirements for privacy notices arise from Article 12 GDPR, which governs transparent information and communication, and Articles 13 and 14 GDPR, which set out the information obligations when personal data is collected.
Other relevant provisions include Article 5(1)(a) GDPR on the principle of transparency, Article 6 GDPR on the legal bases for processing and Article 7 GDPR on the conditions for consent. Data subject rights are set out in particular in Articles 15 to 22 GDPR.
Section 25 TDDDG must also be taken into account when storing information on terminal equipment and accessing such information. Supervisory authority measures and administrative fines are governed by Articles 58 and 83 GDPR.
Frequently asked questions about privacy notices
Is a privacy notice required on every website?
A privacy notice is required where personal data is processed in connection with operating a website and the corresponding information obligations apply. This is generally the case for company websites, for example where IP addresses are processed or contact forms are used.
What is the difference between a privacy notice and consent?
A privacy notice provides information about the processing of personal data. Consent, by contrast, is one possible legal basis for processing. Providing a privacy notice does not replace consent where consent is required by law.
Can a privacy notice be copied from a template?
Templates can serve as a starting point. However, the privacy notice must be adapted to the company's actual processing activities. Incorrect or missing information can result in breaches of the statutory information obligations.
Does a privacy notice need to be updated regularly?
There is no fixed statutory update interval. However, companies must amend their privacy notices whenever relevant processing activities or the mandatory information required change.
What happens if a website does not have a privacy notice?
If personal data is processed but the required information is not provided, this constitutes an infringement of the GDPR. The data protection supervisory authority may order the infringement to be remedied and, where the statutory conditions are met, impose an administrative fine.
Related terms.
Cookies Cookies are small text files that can be stored on a user’s device when they visit a website. They can be used, for example, to save settings, recognise users during a session or analyse user behaviour. Depending on their purpose, cookies may involve the processing of personal data. Their use is governed in particular by the German Telecommunications Digital Services Data Protection Act (TDDDG) and, where applicable, the General Data Protection Regulation (GDPR). Consent management Consent management refers to the administration of consent to the processing of personal data. Companies frequently use so-called consent management platforms (CMPs) to obtain, document and manage consent. Consent management is particularly relevant when cookies and tracking technologies are used on websites. The applicable legal requirements arise in particular from the General Data Protection Regulation (GDPR) and Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). 