Data Collection Notice Template for England and Wales

A Data Collection Notice is your legal obligation under UK data protection law whenever you collect personal information from individuals. This essential document serves as a transparency tool, informing data subjects about how you will process their personal data and ensuring your compliance with the UK GDPR and Data Protection Act 2018.

When do you need this document?

You must provide a Data Collection Notice at the point of data collection, whether collecting information directly from individuals through forms, websites, or applications, or when obtaining personal data from third parties. This applies to all sectors including healthcare providers collecting patient information, employers gathering staff details, retailers processing customer data, and schools collecting student records. The notice must be provided before or at the time of collection, and you cannot rely on retrospective notifications except in very limited circumstances defined by law.

Key legal considerations

Your Data Collection Notice must include several mandatory elements to satisfy UK GDPR requirements. You must clearly identify yourself as the data controller, specify the types of personal data you're collecting, and explain your lawful basis for processing under Article 6 of UK GDPR. The notice should detail all purposes for which you'll use the data, including any secondary processing activities, and identify any third parties with whom you may share the information. Data retention periods must be specified, along with information about individuals' rights including access, rectification, erasure, and the right to object to processing. You must also provide your contact details and those of your Data Protection Officer if applicable, plus information about the right to lodge complaints with the Information Commissioner's Office.

Legal requirements in England and Wales

Under English and Welsh law, the UK GDPR and Data Protection Act 2018 establish strict transparency obligations that differ from EU requirements in several key areas. The Information Commissioner's Office provides specific guidance on drafting compliant notices, emphasizing the need for clear, plain English that avoids legal jargon. Your notice must be easily accessible and prominently displayed, particularly for online data collection where it should be available through clear links. For special category data such as health information or criminal convictions, additional legal bases and safeguards must be explained. The Privacy and Electronic Communications Regulations 2003 impose additional requirements for electronic marketing and cookie notices that may need integration with your data collection notice. Failure to provide adequate transparency can result in ICO enforcement action, including fines up to £17.5 million or 4% of annual global turnover, whichever is higher.