“Personal data” is defined in Article 4(1) of the GDPR:
“(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to
an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural
concerning methods of obtaining such consent is included on the Information Commissioner’s website (http://www.ico.gov.uk).
Article 13(1) of the GDPR provides that:
“(1) Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: … (c) the
purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or
by a third party”.
Article 6(1)(f) of the GDPR provides that:
“(1) Processing shall be lawful only if and to the extent that at least one of the following applies: … (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except
where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”
Article 14 of the GDPR, which applies where personal information is not obtained from the data subject, provides that information about “the categories of personal data concerned” must be supplied to data subjects.
Article 13 of the GDPR, which applies where personal information is obtained from the data subject, does not include an equivalent provision.
Nonetheless, we have included references to general categories of data in this document, because this facilitates the identification of particular purposes of processing and the legal bases of processing – information which does
need to be provided under Article 13.
Optional element. Use this form of provision to identify and provide relevant information about other categories of personal data that you may process.
Article 13(2)(f) of the GDPR provides that:
“(2) In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and
transparent processing: … (f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the
significance and the envisaged consequences of such processing for the data subject.”
Profiling is defined in Article 4(4) of the GDPR:
“(4) ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects
concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements”.
Article 13(1)(e) of the GDPR requires that where personal data are collected from the data subject, the data controller must provide the data subject with information about “the recipients or categories of recipients of the personal
Equivalent rules for data collected from someone other than the data subject are in Article 14(1)(e).
Article 13(1)(f) of the GDPR requires that data controllers disclose to data subjects “where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the
existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 [transfers subject to appropriate safeguards] or 47 [binding corporate rules], or the second subparagraph of
Article 49(1) [limited transfers for compelling legitimate interests], reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available”.
Optional element. Will users have the opportunity to publish personal information on the website?
Article 5(1)(e) of the GDPR sets out the storage limitation, one of the fundamental rules of the regime:
“Personal data shall be: … kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods
insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of
the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject … “.
There is an obligation upon data controllers to process personal data securely.
Optional element. Will you contact users to notify them of changes to the document?
How will users be notified of changes to the document?
Article 13(2) of the GDPR provides that, where personal data is collected from a data subject, certain information about data subject rights must be provided:
“In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent
processing: … (b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the
right to data portability; (c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based
on consent before its withdrawal; …”.
Similar provisions are set out in Article 14 in relation to personal data which is not collected from the relevant data subject.
The right to access is set out in Article 15 of the GDPR.
The right to rectification is set out in Article 16 of the GDPR.
The right to erasure (or right to be forgotten) is set out in Article 17 of the GDPR, and must be notified to data subjects under Articles 13(2)(b), 14(2)(c) and 15(1)(e) of the GDPR.
Consider modifying the highlighted circumstances and exclusions, depending upon what will be most relevant to your processing.
Article 18(1) of the GDPR states:
“The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: (a) the accuracy of the personal data is contested by the data subject, for a period enabling the
controller to verify the accuracy of the personal data; (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; (c) the controller no longer
needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; (d) the data subject has objected to processing pursuant to Article
21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
The right to object to processing is detailed in Article 21 of the GDPR, and must be notified to data subjects under Articles 21(4), 13(2)(b) and 14(2)(c).
Article 21(3) of the GDPR states:
“Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.”
This right is set out in Article 21(6) of the GDPR.
The right to data portability is set out in full in Article 20 of the GDPR, and must be notified to data subjects under Articles 13(2)(b) and 14(2)(c).
The right to lodge a complaint with a supervisory authority is set out in Article 77 of the GDPR, and must be notified to data subjects under Articles 13(2)(d), 14(2)(e) and 15(1)(f).
Article 7(3) of the GDPR sets out the right of withdrawal. The right must be notified to data subjects under Articles 13(2)(c) and 14(2)(d). See also Article 17(1)(b).
Does the website serve any third party cookies, analytics cookies or tracking cookies to users?
Optional element. Will Google AdSense advertisements be published on the website?
This provision should be included if you publish Google AdSense interest-based advertisements on your website. Additional disclosures will be required if you have not opted out of third-party ad serving.
If the website sets any other cookies to users’ machines that track behaviour, information about those cookies will also need to be disclosed.
Optional element. Will the blocking of cookies have a negative effect upon the use of the website from a user perspective?
Are there any cookie preference management facilities available to users on the website?
Identify the web page users should visit to manage their cookie preferences.
UK companies must provide their corporate names, their registration numbers, their place of registration and their registered office address on their websites (although not necessarily in this document).
Sole traders and partnerships that carry on a business in the UK under a “business name” (i.e. a name which is not the name of the trader/names of the partners or certain other specified classes of name) must also make certain
website disclosures: (i) in the case of a sole trader, the individual’s name; (ii) in the case of a partnership, the name of each member of the partnership; and (iii) in either case, in relation to each person named, an address in
the UK at which service of any document relating in any way to the business will be effective. All websites covered by the Electronic Commerce (EC Directive) Regulations 2002 must provide a geographic address (not a PO Box number)
and an email address. All website operators covered by the Provision of Services Regulations 2009 must also provide a telephone number.
What is the name of the company, partnership, individual or other legal person or entity that owns and operates the website?
Optional element. Is the relevant person a company?
In what jurisdiction is the company registered?
What is the company’s registration number or equivalent?
Where is the company’s registered address?
Where is the relevant person’s head office or principal place of business?
By what means may the relevant person be contacted?
Where is the relevant person’s postal address published?
Either specify a telephone number or give details of where the relevant number may be found.
Either specify an email address or give details of where the relevant email address may be found.
What is the website operator’s data protection registration number?
Article 3(2) of the GDPR provides that:
“(2) This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of
goods or services, irrespective of whether a payment of the data subject is required, to such datasubjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.”
Article 27(1) of the GDPR provides that:
“(1) Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.”
There are however some exceptions here. Article 27(2) of the GDPR provides that:
“(2) The obligation laid down in paragraph 1 of this Article shall not apply to: (a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referredto in Article 9(1) or
processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope
and purposes of the processing; or (b) a public authority or body.”
Where a representative has been appointed, Article 13(1)(a) of the GDPR provides that:
“(1) Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (a) the
identity and the contact details of the controller and, where applicable, of the controller’s representative”.
Some data controllers and data processors will have an obligation to appoint a data protection officer (DPO). The basic obligation is set out in Article 37(1) of the GDPR:
“(1) The controller and the processor shall designate a data protection officer in any case where: (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; (b) the core
activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or (c)
the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article
Article 13(1)(b) of the GDPR provides that:
“(1) Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information … (b) the
contact details of the data protection officer, where applicable”.
See also Article 14(1)(b).
Insert contact details of the appointed data protection officer (if any).