Personal Data Notice Template for England and Wales

A Personal Data Notice is a legally required document that informs individuals about how their personal data will be collected, used, and protected by your organization. Under UK data protection law, you must provide clear and transparent information to data subjects before or at the time of collecting their personal information, making this notice an essential compliance requirement for any organization processing personal data in England and Wales.

When do you need this document?

You need a Personal Data Notice whenever your organization collects personal information from individuals. This includes situations such as collecting employee details during recruitment, gathering customer information for service provision, obtaining marketing consent from website visitors, or processing patient data in healthcare settings. The notice is required whether you collect data directly from individuals through forms, applications, or surveys, or indirectly through third parties, CCTV systems, or automated processes. Any organization that processes personal data, from small businesses to large corporations and public bodies, must provide this transparency document to comply with UK data protection law.

Key legal considerations

Your Personal Data Notice must contain specific mandatory information required by UK GDPR. This includes your organization's identity and contact details, the types of personal data you collect, your purposes for processing, and the legal basis for each processing activity. You must clearly explain data subjects' rights, including their right to access, rectify, erase, or restrict processing of their data, and their right to data portability where applicable. The notice should specify how long you will retain personal data and outline any automated decision-making or profiling activities. You must also detail any international transfers of data and provide information about your Data Protection Officer if you have appointed one. Crucially, the information must be presented in clear, plain language that is easily accessible and understandable to the average person, avoiding legal jargon that could confuse data subjects.

Legal requirements in England and Wales

Under the UK GDPR and Data Protection Act 2018, which govern data protection in England and Wales, you must provide the Personal Data Notice at the time of data collection or within one month if data is obtained from third parties. The Information Commissioner's Office (ICO) enforces these requirements and can impose significant fines for non-compliance, with maximum penalties reaching £17.5 million or 4% of annual global turnover. Your notice must comply with the transparency principle, requiring information to be concise, easily accessible, and provided free of charge. If you process special category data such as health information, criminal records, or biometric data, you must clearly explain the additional legal conditions that justify this processing. The notice must be regularly reviewed and updated to reflect changes in your processing activities, and you must inform data subjects of any material changes that affect their rights or the use of their data.