Writing a good privacy statement - 4 things to consider 

There has been controversy over the collection and processing of personal data for some time. Generally, people are unsure why all this information about them is needed and where it goes - it is in some ways even a sacred subject, where a company needs to be extremely careful and aware of what it is doing.

The data subject must be informed of the processing of their data and the purpose. What elements should a privacy notice contain? How can you draft one? Here are the latest tips from Kubla’s team!

What is a privacy statement?

As we noted, the public is interested in how their data is used. According to law, communication between a company and its customers should be clear, open, and transparent. 

The best way to inform consumers about how their personal data is being processed is to publish a privacy statement, also known as a privacy notice. It informs data subjects that the company will treat the personal information they provide with respect.

The Privacy Statement aims to be clear so that the average citizen can fully understand how their personal data will be collected and processed. The privacy statement also allows the data subject to monitor the integrity of the promises made by the organization and gives them the right to influence.

What makes a good privacy statement?

A good privacy notice is short and to the point. It does not need to be a comprehensive collection of many pages, as some corporate privacy statements in the USA seem to be. 

In cases where it only has one task - to ensure that the data subject understands the processing of their personal data - it is not justified to use vague and incomprehensible sentences.

You should highlight the essential points, and the information that is actually unnecessary to the data subject should be left out.

Once the privacy statement is in place, the company should decide and document how personal data will be collected and processed. Obviously, a privacy statement is far more than a piece of paper in a drawer. After the design phase, the privacy statement is put into practice and documented.

It is an open document, the existence of which is communicated to data subjects. It is just one aspect, but a very important one, of mandatory data protection work.

Four things to consider when drafting a privacy statement

Do you find it cumbersome to draft a privacy statement? It shouldn’t be! A data protection statement can be easily compiled from the customer and employee records of your company’s customers and employees.

Once a company has a clear understanding of how its customers’ personal data, among other things, are processed, it is not a difficult task to draft a document. The situation is different if the company has not legally drawn up a plan for collecting and processing this data.

1. A good document must be well-structured

The GDPR’s information requirements provide clear guidance on the structure that a proper privacy notice should follow. A good privacy notice needs a clear structure that goes through the following points:

• Contact information for the contact person
• Name of the register
• Purpose of the processing of personal data
• Information content of the register
• Regular sources of information
• Recipients of information
• Data transmission outside the USA
• Registry security principles
• Data retention period
• General rights of the data subject
• Other rights of the data subject

2. A clear privacy notice is brief and to the point

By emphasizing unnecessary points in the privacy notice, the most important aspects of the notice are overlooked, and the data subject may end up not knowing that their personal data is being processed. This is not what a good privacy policy does. 

A privacy statement should also be clear enough so that you do not have to search for information in it but that the most important points are clearly set out.

The privacy notice can be more than just a bunch of text: you can use pictures, icons, or even colors to make it easier to understand. A good privacy statement does not leave the subject in the dark with “we can/we will” style statements but is transparent about how the company will use the data.

3. A privacy statement should not have meaningless words

It makes no sense to hide a privacy statement ten clicks away somewhere that no one will find, at least on the assumption that no one will read it. Yes, they do. 

And even if for some reason they don’t, it has to be there. The privacy statement is full of helpful information that needs to be openly communicated. For example, it can be lurking behind the “Privacy Notice” link at the bottom of every page, where it is easily visible.

4. The privacy policy must be kept up to date

Personal data is rapidly changing and must be kept up to date. There may also be changes in the processing of personal data, which the privacy statement must inform about and make loudly known to data subjects in the company’s communications. We should, however, keep the privacy policy simple and maintain it by not making a lot of changes to it.

For a privacy statement to be successful and straightforward to draft, the company itself needs to know what data is collected, how it is processed and how it is stored. A privacy statement is a standard, important part of the data protection process, but there are other ways of informing people about how their personal data is processed. 

You should also look into the legal requirements in your state since privacy policies are usually mandated by law there. It can be viewed as insurance. Mishandling your users’ information could lead to a lawsuit.

Contact us