Just In Time Privacy Notice Template for England and Wales

A Just In Time Privacy Notice is a context-specific data protection document that appears at the exact moment you collect personal data from individuals. Unlike comprehensive privacy policies, these targeted notices provide immediate, relevant information about specific data processing activities when users are most engaged and likely to read them. Under England and Wales law, you must ensure transparency in data collection, and Just In Time Privacy Notices help you meet this obligation by delivering the right information at the right time.

When do you need this document?

You need a Just In Time Privacy Notice whenever you collect personal data in situations where your general privacy policy might not provide sufficient context-specific information. This includes when you're collecting email addresses for newsletters, requesting location data through mobile apps, gathering customer feedback through surveys, or capturing biometric data for security purposes. The notice is particularly important for online forms, mobile applications, and any interactive digital service where data collection occurs at specific touchpoints. You should also use these notices when introducing new data processing activities or when collecting sensitive personal data that requires additional explanation beyond your standard privacy policy.

Key legal considerations

Your Just In Time Privacy Notice must clearly identify you as the data controller and provide your contact details, including your Data Protection Officer's information if applicable. You need to explain the specific purpose for collecting the data and cannot use vague language like "business purposes" or "operational needs." The notice must specify your legal basis under UK GDPR, whether it's consent, legitimate interests, contractual necessity, or another lawful ground. You must include information about data retention periods, explaining how long you'll keep the specific data being collected and your rationale for that timeframe. The notice should also inform individuals about their rights, including access, rectification, erasure, and the right to object to processing. If you're transferring data internationally, you must explain the safeguards in place to protect the data.

Legal requirements in England and Wales

Under the UK GDPR and Data Protection Act 2018, you must provide information about data processing in a concise, transparent, and easily accessible manner, using clear and plain language. The Information Commissioner's Office emphasizes that privacy information should be layered, with Just In Time Privacy Notices forming part of your overall transparency approach. You must ensure the notice appears before or at the point of data collection, not afterward. The Privacy and Electronic Communications Regulations 2003 impose additional requirements if you're collecting data through electronic communications, including specific rules about cookies and electronic marketing. If you're dealing with consumers, the Consumer Rights Act 2015 requires that your notices are fair and not misleading. The ICO expects you to regularly review and update your Just In Time Privacy Notices to ensure they remain accurate and reflect current processing activities.