The privacy notice is the one GDPR document every visitor to a software company's website sees, and the one most often written as prose about caring for privacy. The Regulation does not ask for prose. Article 13 lists the information a controller provides when personal data are collected from the data subject, at the time they are obtained; Article 14 lists the information provided when the data have not been obtained from the data subject, within a month. Both are lists of pieces, each with its own point, and a notice is complete when every piece the company's processing engages has an answer. This article reads the two lists against the catalogue StandardOS keeps of the Regulation and the free page that writes the notice from the answers, one input per piece.
Article 13: twelve pieces at the point of collection
Article 13(1) names six pieces given in every case: (a) the identity and contact details of the controller and, where applicable, of its representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing and the legal basis for each; (d) where the basis is legitimate interests under Article 6(1)(f), the interests pursued; (e) the recipients or categories of recipients; (f) where applicable, the fact that the controller intends to transfer the data to a third country or an international organisation, with the adequacy decision or the safeguards and where to obtain a copy of them. Article 13(2) names six further pieces necessary to ensure fair and transparent processing: (a) the retention period or the criteria used to determine it; (b) the existence of the rights of access, rectification, erasure, restriction, objection and portability; (c) where the basis is consent, the right to withdraw it; (d) the right to lodge a complaint with a supervisory authority; (e) whether providing the data is a statutory or contractual requirement, or a requirement to enter into a contract, and the consequences of not providing them; (f) the existence of automated decision-making, including profiling, with meaningful information about the logic and the consequences. Article 13(3) adds that a further purpose is announced before that further processing begins, and Article 13(4) removes the duty where the data subject already has the information.
Article 14: thirteen pieces, one month, four exemptions
Article 14(1) names six pieces: the controller and its representative, the data protection officer, the purposes and the legal basis, the categories of personal data concerned, the recipients, and the transfers with their safeguards; Article 14(2) names seven further ones: the retention period, the legitimate interests where that is the basis, the rights, the right to withdraw consent, the right to complain, the source of the data and whether it came from publicly accessible sources, and the automated decision-making. The moment is Article 14(3): within a reasonable period after obtaining the data and at the latest within one month, or at the time of the first communication with the data subject if the data are used to communicate with them, or when the data are first disclosed to another recipient if a disclosure is envisaged, whichever comes first. Article 14(5) removes the duty in four cases: the data subject already has the information; providing it proves impossible or would involve a disproportionate effort, in particular for archiving, research or statistics, with the measures the controller takes instead; obtaining or disclosing the data is expressly laid down by law with appropriate measures; or the data are subject to professional secrecy. A software company that enriches a signup with data bought from a provider, receives a customer's user list, or scrapes a public profile is under Article 14 for that data, and the "already has the information" exemption does not apply to a person who has never heard of the company.
Seven of the pieces are the record of processing
A software company that has written its record of processing has already answered seven of the pieces: the controller's name and contact details (Article 30(1)(a)), the purposes (30(1)(b)), the categories of personal data (30(1)(c)), the recipients (30(1)(d)), the transfers and their safeguards (30(1)(e)), the retention periods (30(1)(f)), and the representative and the officer where they exist (30(1)(a)). The legal basis per purpose is the column the record does not have and the notice does, and it is the one that fails most often: a notice that names "legitimate interests" for everything without naming the interest has not answered Article 13(1)(d). The rights are the same in every notice and are read from Articles 15 to 22; the complaint is Article 77; the withdrawal of consent is Article 7(3). The order that works is the record first and the notice copied from it, which is what the free page is built to do: every piece as the Regulation words it, an answer under each, and the notice written with the piece as its heading, so that nothing is claimed by silence and an unanswered piece is written as not stated.
Form, language and the moment
Article 12(1) sets the form: concise, transparent, intelligible and easily accessible, in clear and plain language, in writing or by other means including electronic means. A notice that runs to fifteen pages of prose fails the first word; a notice that is a list of the twelve pieces with a sentence under each passes all of them. The moment is the point of collection: the signup form links to the notice before the button is pressed, the cookie banner names the purposes before the consent, the job application page names the retention period before the upload. For Article 14 data the moment is the first message to the person or the month, whichever comes first, so the enrichment provider's data are announced in the first email that uses them. The transfers tool supplies the answer to the transfer piece for each recipient outside the EEA, and the duties determination says whether the company has a representative or an officer to name.
What to do with it
Write the record, then answer the pieces from it, then put the notice where the data are collected. For each form on the site and each screen in the product that collects personal data, name the piece of the notice that covers it and check it is reachable from there. For each source of personal data that is not the person, name the first message or the month and send the Article 14 notice by then. Keep the version of the notice a person saw on the day they saw it, because a change of purpose restarts the duty and the authority asks which version applied. StandardOS writes the notice from the record and keeps the versions; the free page writes the first one.