People

Careers

Corporate

Commercial

Employment

News & Insights

Blog

News

Videos

Who we are

Environment & Sustainability

Diversity, Equity & Inclusion

WONDER Foundation

Home

Resources

Registered in England &amp; Wales at 73 Shelton Street, Covent Garden, London, WC2H 9JQ
<a href="tel:+442081596000">Tel: +44 (0)20 8159 6000</a>
Company Nr: 15894546
ICO Registration Nr:  ZB842887
VAT Registration Nr: 484 5226 73
Linnear Legal is an unregulated legal services provider, meaning the firm itself is not regulated by the Solicitors Regulation Authority (SRA). However, the solicitors employed by the firm are individually regulated by the SRA. Please see our Terms and Conditions for further information on our regulatory status, complaints procedure and insurance arrangements.

Terms & Conditions

Cookie Policy

Privacy Policy

Services

Insights

About

We are driven by doing things differently, from every angle. 

Taking our Carbon Neutral Certified  status seriously.  

Putting equity and inclusion at the heart of everything we do.

Supporting sustainable employment and gender equality with WONDER. 

WONDER foundation

Contact us

Since the EU <a href="https://gdpr-info.eu/" target="_blank" rel="noopener">General Data Protection Regulation</a> (GDPR) took effect in 2018 – the GDPR was retained in UK law alongside the amended <a href="https://www.legislation.gov.uk/ukpga/2018/12/contents" target="_blank" rel="noopener">UK Data Protection Act</a> following Brexit – organisations have been required to provide information to individuals about how their personal data is collected and used. The retained version is now referred to as the UK GPDR.
A data privacy notice, also known as a privacy statement or occasionally a privacy policy on websites, is a document that sets out key information about who the organisation is and how they will collect, store and process (use) individuals’ data. Typically, privacy notices are found at the footer of an organisation’s website – but they can also be provided via a pre-recorded voice message, if data is being recorded over the phone, or as a separate pop-up window.
<h3>What is personal data under the GDPR?</h3>
Personal data refers to any information that can identify a living individual directly or indirectly. This includes names, addresses, phone numbers, email addresses, identification numbers, and online identifiers such as IP addresses or cookie identifiers.
There are also sensitive categories of personal data, such as health records, racial or ethnic origin, or political opinions, which are subject to stricter obligations.
<h3>Does every organisation need a data privacy notice?</h3>
If an organisation is not collecting personal data, it does not need to have a privacy statement. However, it is highly unlikely an organisation will not be processing personal data in some way or another.
It is often the case that organisations collect personal data without even realising it, such as by using Google Analytics. It is also worth noting that any business that sells goods or services over the internet (e-commerce businesses) must process customer personal data to facilitate purchases. Individuals often do not realise the extent to which their personal data is used. Downloading apps, posting on social media, making purchases online, storing images on the cloud, even sending SMS messages – all these actions may leave a digital footprint, inevitably processed by organisations. This includes by cookies on websites, and is the reason that you are asked to confirm consent to the use of cookies each time you visit a website.
<h4>Collecting employee data</h4>
Employers also collect personal data on their employees. Even if this data is being collected under the ‘contractual necessity’ or legitimate interests legal bases (i.e. the processing does not need consent), employers still need to provide privacy notices to staff to ensure employees are aware of how their data is being used and processed fairly and transparently. Read on for more information on legal bases for processing data.
<h3>What are the legal bases for processing personal data?</h3>
As set out in article 6 of the UK GDPR, there are six legal bases for processing personal data:
<ul>
<li>Consent: where the individual has given clear consent for their data to be processed for a specific purpose</li>
<li>Contract: where a contract exists between an individual and a data processor</li>
<li>Legal obligation: where the processing is necessary for complying with the law</li>
<li>Vital interests: where the processing is necessary to protect an individual’s life</li>
<li>Public task: where the processing is necessary for the data processor to perform a task in the public interest or to fulfil an official function</li>
<li>Legitimate interests: where the processing is necessary for the legitimate interests of the data processor or a third party, unless there is cause to protect the individual’s data that overrides these legitimate interests</li>
</ul>
<h3>What is the penalty for not having a privacy notice?</h3>
If an organisation does not provide a privacy notice to individuals, it will likely be in breach of its obligations under the UK GDPR and may be fined by the Information Commissioner’s Office (ICO). This is because a privacy notice is essential for informing individuals that their personal data is being processed by the organisation and how their personal data is being used and processed, regardless of whether consent is required as the basis for processing.
If an organisation does not have a privacy notice, individuals are unable to know what their data is being used for, how it is being used, and why it is being used, which undermines their rights under data protection laws. It may also show that the organisation has not properly considered how and why it is processing personal data, which may risk unlawful processing of data.
As an example, if an organisation does not have a privacy notice but does process personal data, it could be doing so without a lawful basis, which may result in complaints from individuals and enforcement action from the ICO.
By the same token, an inadequately drafted data privacy notice that does not make it clear how personal data is being processed would mean individuals will not fully understand what they are consenting to.
For serious violations, an organisation could be fined up to £17.5 million or 4% of its global turnover (whichever is higher). Further, when the ICO takes action against a business, this information is public and may attract negative media interest. The resulting reputational damage from non-compliance can alienate customers and erode trust. It may even be more detrimental to a business in the long term than immediate financial penalties.
<h3>GDPR compliance for SMEs</h3>
While GDPR-related fines that make the headlines often relate to large companies such as Meta (with the largest GDPR fine recorded at €1.2 billion), TikTok (fined €345 million for misusing children’s data), or H&amp;M (fined €35 million for secretly monitoring employees), they are likely to have a more devastating impact on smaller and medium-sized businesses (SMEs).
Data from <a href="https://www.skillcast.com/blog/fines-close-small-business" target="_blank" rel="noopener">Skillcast</a> revealed in 2023 that in the period between 2020 and 2023 when 75 fines were imposed by the ICO and the Financial Conduct Authority (FCA), over a quarter of micro and small business fined went into liquidation. A further 2% went into administration.
Among notable cases relating to medium-sized companies are that of Brexit campaign group Leave.EU and insurance company Eldon Insurance Services Ltd. Both owned by British businessman Aaron Banks, these companies were <a href="https://www.theguardian.com/uk-news/2018/nov/06/arron-banks-firm-and-leave-eu-face-135k-fine-over-data-misuse" target="_blank" rel="noopener">fined £135,000 in 2018 </a> for breaching the law concerning e-marketing, including sending unsolicited emails without proper consent. This included sending 300,000 emails containing a Leave.EU newsletter to Eldon customers.
In 2024, the ICO <a href="https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/04/ico-fines-two-companies-a-total-of-340-000-for-making-aggressive-and-unwanted-marketing-calls/#:~:text=The%20Information%20Commissioner's%20Office%20(ICO,Telephone%20Preference%20Service%20(TPS)." target="_blank" rel="noopener">issued a fine of £340,000</a> to Cardiff-based Outsource Strategies Ltd and London-based Dr Telemarketing Ltd for making calls to people on the UK’s ‘do not call’ register.
<h3>What should be included in a privacy notice</h3>
In the first instance, an organisation should carry out a data protection impact assessment, which should consider:
<ul>
<li>What personal data the organisation will process</li>
<li>How it will do so, and</li>
<li>What legal bases it will rely on to carry out the processing</li>
</ul>
This will provide the information that it needs to prepare a privacy notice, tailored to the requirements of its organisation.
It can then use that information to prepare a privacy notice. This should include – among other things – information about who the data controller is, how to contact the data controller, and how the organisation will be handling personal data. It should also provide the legal basis for processing individuals’ data so that individuals are aware of why their data is being processed.
More generally, it should:
<ul>
<li>Detail the rights of individuals whose data will be processed</li>
<li>Explain what data will be processed and how (including the legal bases for processing), and</li>
<li>Include the right to opt out, if relevant</li>
</ul>
Any third parties the organisation shares relevant personal data with should be disclosed.
The privacy notice should be written in clear, plain language that is easy to understand and appropriate to the intended audience.
<h3>Seek professional guidance for data privacy matters</h3>
Data privacy is a complex and multifaceted area of law, and it can be easy for a business to overlook how they may process individuals’ data. We always recommend a tailored approach to suit an organisation’s specific needs.
Businesses with clear and comprehensive privacy notices will be well placed to avoid confusion and any associated risks, as well as set up to thrive in an ever-evolving business landscape.
<a href="https://www.linnearlegal.co.uk/get-in-touch/" target="_blank" rel="noopener">Speak to a lawyer at Linnear Legal today</a> for advice on drafting a data privacy notice, as well as for other issues related to data privacy.
&nbsp;

What is a data privacy notice and why is it important?

Understanding data privacy notices is essential for GDPR compliance. Learn why businesses must provide clear privacy statements, what legal bases justify data processing, and the consequences of non-compliance. Discover best practices for drafting a privacy notice that protects your business and ensures transparency. Read more at Linnear Legal.

What is a data privacy notice and why is it important? | Linnear Legal

https://linnearcms.wpenginepowered.com/wp-content/uploads/2025/02/shutterstock_2475089501.jpg

Linnear Legal

https://linnearcms.wpenginepowered.com/wp-content/uploads/2025/01/Linnear-Legal-logo.png

https://secure.gravatar.com/avatar/557c7f891380b6950d58942a774782ca?s=96&d=mm&r=g