Before you begin to write your privacy notice (sometimes known as a privacy policy), you’ll need to have several key pieces of information to hand:

• your full contact details;
• the types of personal data you collect;
• where you got people’s data from, if it wasn’t from them;
• why you have people’s information and what you’re doing with it;
• your lawful basis and your legitimate interests where relevant;
• who you share people’s information with; and
• how long you hold people’s information for before getting rid of it securely.

You’ll need to be able to explain these points in writing in a way that’s easy for people to understand.

Your privacy notice needs to include people’s information rights, including the right to withdraw consent, where that’s your lawful basis. Also tell people how they can complain if they’ve got concerns about the way you’re using their information.