What information must a GDPR privacy notice include?

A privacy notice is not a formality you copy from another site. Under the GDPR it is a legal obligation with a defined content list, and the article that governs it depends on one question: did the data come straight from the person, or from somewhere else? Get that wrong and the notice is missing information a regulator expects to see.

What must a privacy notice contain?

Article 13 sets the core list for data you collect directly. You must give people your identity and contact details and, where relevant, those of your representative and your data protection officer; the purposes of the processing and the lawful basis for each; where you rely on legitimate interests, what those interests are; the recipients or categories of recipient; and any intention to transfer the data to a country outside the UK or EU, with the safeguards that apply. Article 13(2) adds the information needed for fair and transparent processing: the retention period or the criteria for setting it, the individual's rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent, the right to complain to a supervisory authority, whether providing the data is a statutory or contractual requirement, and any automated decision-making.

Article 13 or Article 14: where did the data come from?

The two articles carry almost the same content list, and differ mainly in timing and two extra items. Article 13 applies when you collect personal data directly from the individual, for example through a signup form, so you provide the notice at the moment of collection. Article 14 applies when you obtain the data from another source, such as a data broker, a partner, or a public register. It requires two things Article 13 does not: the categories of personal data you hold, and the source the data came from. On timing, Article 14 gives you a reasonable period and at the latest one month after you obtain the data. If you use the data to contact the person, you must inform them by the first communication; if you plan to disclose it to someone else, by the time of that first disclosure at the latest. Both notices must meet the Article 6 lawful basis transparency the GDPR expects.

When Article 14 does not apply

Article 14 lists narrow exceptions. You do not need to provide the information where the person already has it; where providing it proves impossible or would take disproportionate effort, which most often arises in archiving, research or statistics; where obtaining or disclosing the data is expressly laid down by law; or where the data must stay confidential under a professional secrecy obligation. These are limited, and you should document why one applies rather than assume it. The notice you give also supports data subject access requests, because people can only exercise rights they have been told about.

Next step

If you are unsure whether your notice covers everything Articles 13 and 14 require, the free 2-minute Obligation Scan checks whether the GDPR applies to you and flags the transparency duties you still owe. The GDPR compliance hub sets out the wider obligations, and GDPR for SaaS covers when the regulation reaches a business outside Europe.