What a GDPR Privacy Policy Must Contain: Articles 13 and 14 Checklist

How it must be written

Article 12(1) requires the information to be concise, transparent, intelligible and easily accessible, in clear and plain language, especially when addressed to children. A wall of legal text that nobody can follow does not meet that standard, however complete it is. Use headings, short sentences and a summary at the top.

The checklist

Article 13 applies when you collect data from the person; Article 14 when you obtain it elsewhere. Most items are the same:

You must tell people	Art. 13	Art. 14
Your identity and contact details, and your EU representative if you have one	13(1)(a)	14(1)(a)
Contact details of your data protection officer, where you have one	13(1)(b)	14(1)(b)
The purposes of processing and the legal basis for each	13(1)(c)	14(1)(c)
The legitimate interests you pursue, where you rely on legitimate interests	13(1)(d)	14(2)(b)
The categories of personal data concerned	—	14(1)(d)
Recipients or categories of recipients	13(1)(e)	14(1)(e)
Transfers outside the EEA: whether there is an adequacy decision, or which safeguards apply and how to get a copy	13(1)(f)	14(1)(f)
How long you keep the data, or the criteria used to decide	13(2)(a)	14(2)(a)
The rights of access, rectification, erasure, restriction, objection and portability	13(2)(b)	14(2)(c)
The right to withdraw consent at any time, where you rely on consent	13(2)(c)	14(2)(d)
The right to complain to a supervisory authority	13(2)(d)	14(2)(e)
Whether providing the data is a statutory or contractual requirement, whether people must provide it, and what happens if they do not	13(2)(e)	—
The source of the data, and whether it came from publicly accessible sources	—	14(2)(f)
Automated decision-making, including profiling, with meaningful information about the logic, significance and consequences	13(2)(f)	14(2)(g)

Draft yours in minutes: our free Privacy Policy Generator builds a draft around these items, including optional sections on automated decisions, other sources and whether data is required.

The items most policies miss

A legal basis per purpose. "We process data in accordance with GDPR" is not a legal basis. Name it for each purpose: contract, legal obligation, legitimate interests or consent.
The actual legitimate interests. If you rely on legitimate interests, say what they are, for example fraud prevention or improving the service.
Retention periods. "As long as necessary" is not enough. Give a period or the criteria, such as "3 years after your last order".
Whether people must provide data. Article 13(2)(e) is easy to forget: say which data is needed for the contract or by law, and what happens without it.
How to get a copy of transfer safeguards, when you rely on Standard Contractual Clauses.
Automated decisions. If you make decisions solely by automated means with legal or similarly significant effects, you must explain them; if you do not, saying so is good practice.

When to provide it

Data collected from the person: at the time you obtain it (Article 13(1)), for example on the sign-up form, with a link to the full notice.
Data from other sources: within a reasonable period and at the latest within one month; at the latest at your first communication with the person if you use the data to contact them; or at the latest when you first disclose it to another recipient (Article 14(3)).
New purposes: before you process data for a purpose other than the original one, you must provide information on that new purpose (Articles 13(3) and 14(4)).

When you do not have to

Under Article 13(4), you need not repeat information the person already has. Article 14(5) adds further exceptions for data obtained elsewhere, for example where providing the information proves impossible or would involve a disproportionate effort, in which case you must take other measures such as making the information publicly available, or where the law expressly provides for obtaining or disclosing the data.

Keep it true

A privacy notice is a statement of fact about your processing. Review it whenever you add a tool that touches personal data, change providers, start a new purpose, or move data to a new country, and record the review date at the top.

Need the records behind the notice? The GDPR Records of Processing (RoPA) Kit helps you document purposes, legal bases, recipients, transfers and retention, the facts your privacy notice must reflect.

Sources

Regulation (EU) 2016/679 (GDPR), Articles 12, 13 and 14, EUR-Lex

Related tools

Privacy Policy Generator

A draft notice built around Articles 13 and 14.

Data Mapping Tool

Map the data flows your notice must describe.