Data Processing Notice Template for England and Wales

A Data Processing Notice is a fundamental document required under England and Wales data protection law that informs individuals about how their personal data is collected, used, and protected. This transparency document ensures your organization complies with the UK GDPR and Data Protection Act 2018 by providing clear information to data subjects about your data processing activities.

When do you need this document?

You must provide a Data Processing Notice whenever you collect personal data from individuals, whether directly or indirectly. This applies when customers fill out forms on your website, employees provide personal information during recruitment, clients sign contracts that involve data processing, or when you obtain personal data from third-party sources. The notice must be provided at the point of data collection or within one month if data is obtained from other sources. Without this notice, your organization risks significant ICO fines and enforcement action for failing to meet transparency obligations.

Key legal considerations

Your Data Processing Notice must contain specific information required by Articles 13 and 14 of the UK GDPR. This includes your identity as data controller, the types of personal data being processed, the purposes and legal bases for processing, data retention periods, and information about data subject rights. You must also disclose any third-party recipients of the data, international transfers, and your contact details. The notice should be written in plain English, easily accessible, and provided free of charge. If you change your processing activities, you must update the notice and inform affected data subjects. Consider including information about automated decision-making, profiling activities, and the source of data if not collected directly from individuals.

Legal requirements in England and Wales

Under the UK GDPR and Data Protection Act 2018, Data Processing Notices must comply with strict transparency requirements enforced by the Information Commissioner's Office (ICO). The notice must be provided before or at the time of data collection, with specific timeframes for indirect collection scenarios. Your organization must ensure the information is presented in a concise, transparent, and easily understandable format, using clear and plain language appropriate for your audience. The ICO's guidance emphasizes layered privacy notices for complex processing activities, allowing individuals to access detailed information when needed. Failure to provide adequate transparency information can result in administrative fines of up to 4% of annual global turnover or £17.5 million, whichever is higher, plus potential enforcement orders and reputational damage.