The 9 Steps to DPA Heaven : Step 6 - Update Privacy Notices

Audio

Welcome to Step 6 of The Nine Steps to Data Protection Heaven , our serialised article that covers the key steps needed to ensure compliance with this important security and reputational set of controls. In Step 1 we covered : Implementing a data protection policy. Step 2: Carrying out a data protection impact assessment, Step 3 looked at "Appointing a Data Protection Officer", and in Step 4 we covered Making sure our staff understand their obligations. In the previous podcast we looked at Step 5, Ensuring valid consent for processing.

In Step 6, we will look at Privacy Notices, and how to update them to ensure they provide the guidance and information needed.

Links

• You can listen to this Step 6 as a podcast here, or
• the complete audio (parts1-9) here.
• The complete article is available here.
• If you have missed any part or would like to start from the beginning, you can find links to all sections at the bottom of this article.

A roadmap to effectively safeguard personal data, ensure regulatory compliance, and build lasting trust with stakeholders.

Here is a summary of the 9-Step process, that you can follow as we walk through each step.

Step 6: Update Privacy Notices

Your organisation's privacy notices serve as a cornerstone of transparency and trust with individuals whose personal data you process. They provide critical information about how you handle personal data and what rights individuals have. Therefore, ensuring these notices meet all Data Protection Act (DPA) and General Data Protection Regulation (GDPR) requirements is essential.

Key Activities

Begin by reviewing your existing privacy notices. Check for clarity, completeness, and compliance with data protection legislation. This includes ensuring the notice provides adequate information about what personal data you collect, how and why you use it, who you share it with, how long you keep it, and what rights individuals have in relation to their data.

Next, make any necessary updates or changes. This could involve rewriting parts for clarity, adding missing information, or updating outdated sections. The language used should be straightforward and accessible to a non-expert audience.

After making these updates, communicate the changes to the individuals whose data you process. You might do this by email, through your website, or via other means appropriate to your context. Make sure the updated privacy notices are easy to find and read.

Key Roles and Stakeholder Engagement

The Data Protection Officer (DPO) or designated data protection lead typically spearheads the privacy notice update. It's also beneficial to involve legal counsel to ensure that the privacy notice meets regulatory requirements. The stakeholders in this case are all individuals whose personal data you process, as they need to be informed about the contents of the privacy notice.

Outputs

The key output from this step is an updated privacy notice that fully meets DPA and GDPR requirements. You should also keep a record of the versions of your privacy notice and when updates were made.

Summary

Ensure your privacy notice is easy to understand. Avoid jargon and legalistic language; the goal is to inform, not confuse.

Make sure you clearly explain the legal basis for processing personal data, whether it's consent, a contractual requirement, or a legitimate interest. And don't forget to detail individuals' rights regarding their data, such as the right to access, rectify, or erase their data, and how they can exercise these rights.

Another tip is to use layered notices or just-in-time notices to provide information to individuals when they need it. For example, you might provide a brief notice when you first collect data, with a link to a more detailed notice.

And remember, updating privacy notices isn't a one-time task. It's something you should revisit regularly, especially if there are changes in how you process data.

Maintaining clear, accurate, and up-to-date privacy notices is not just a regulatory requirement. It's also an opportunity to enhance trust and transparency with individuals and show them that you respect their privacy and data rights.

In Step 7, we will cover the area of Technical Controls or those counter measures needed to secure your data, like controlling access, storing securely and having the right tools to limit both accidental and intentional leaks.

---

Navigation

• The next part, "Step 7: Implement Technical Measures" is available here.
• Step 7 Audio podcast available here
• Links to the complete list of audio podcasts for this series are available here: Part 1, Part 2, Part 3, Part 4, Part 5, Part 6, Part 7, Part 8, Part 9, Parts1-9/Complete
• Links to each Section: Step 1, Step 2, Step 3, Step 4, Step 5, Step 6, Step 7, Step 8. Step 9.

If you like this content, find it useful or are looking for further assistance, you can contact us via info@riskmanage.io, webchat or via our website using the links provide.