What privacy information should we provide?

A representative is an organisation that represents you if you are based outside the UK, but you monitor or offer services to people in the UK.

There are many different reasons for using personal data, you will know best the particular reasons why you use data. Typical purposes could include marketing, order processing and staff administration.

These are the interests pursued by your organisation, or a third party, if you are relying on the lawful basis for processing under Article 6(1)(f) of the UK GDPR.

Say whether the transfer is made on the basis of an adequacy decision by the European Commission under Article 45 of the UK GDPR.

If the transfer is not made on the basis of an adequacy decision, give people brief information on the safeguards put in place in accordance with Article 46, 47 or 49 of the UK GDPR. You must also tell people how to get a copy of the safeguards.

The rights will differ depending on the lawful basis for processing – make sure what you tell people accurately reflects this.

The right to object must be explicitly brought to people’s attention clearly and separately from any other information.

Each EU Member State has a designated data protection supervisory authority.

Individuals have the right to raise a complaint with the supervisory authority in the Member State where they live, where they work, or where the infringement took place.

It is good practice to provide the name and contact details of the supervisory authority that individuals are most likely to complain to if they have a problem. In practice, if you are based in the UK, or you regularly collect the personal data of people that live in the UK, you should inform people that they can complain to the ICO and provide our contact details.

Whilst this type of processing may be complex, you should use simple, understandable terms to explain the rationale behind your decisions and how they might affect individuals. Tell people what information you use, why it is relevant and what the likely impact is going to be.

A representative is an organisation that represents you if you are based outside the EU, but you monitor or offer services to people in the EU.

There are many different reasons for using personal data, you will know best the particular reasons why you use data. Typical purposes could include marketing, order processing and staff administration.

These are the interests pursued by your organisation, or a third party, if you are relying on the lawful basis for processing under Article 6(1)(f) of the GDPR.

This includes anyone that processes the personal data on your behalf, as well all other organisations.

You can tell people the names of the organisations or the categories that they fall within.

Be as specific as possible if you only tell people the categories of organisations.

If you don’t have a specific retention period then you need to tell people the criteria you use to decide how long you will keep their information.

Consent must be as easy to withdraw as it is to give. Tell people how they can do this.

Be as specific as possible and name the individual source(s) the personal data was obtained from. If you can’t do this because you don’t know the specific source, you should provide more general information.