GDPR Privacy Notice Template (Articles 13 and 14)

Article 13 Core Elements (Template Outline)

• Controller identity and contact details (+ DPO if any)
• Purposes and lawful bases
• Legitimate interests (when Art 6(1)(f) used)
• Recipients or categories of recipients
• Transfers and safeguards
• Retention period or criteria
• Rights (access, erasure, objection, etc.) and complaint to a SA
• Whether provision is statutory/contractual requirement
• Automated decision-making / profiling (if applicable)

Article 14 Extras

When data were not obtained from the data subject, also state categories of personal data and the source (public/private). Provide information within timescales in Art 14(3).

How CyberSilo Helps

• Keep notice content aligned to live RoPA purposes in CSA
• Track versions for accountability

Frequently Asked Questions

Do employees need a privacy notice?

Yes. Workforce processing still needs transparent information under Articles 13/14.

Is a cookie banner the privacy notice?

No. Banners address consent/ePrivacy UX; the privacy notice covers broader Art 13/14 content.

How often should notices be updated?

Whenever purposes, vendors, transfers, or rights processes change materially.

Related GDPR Resources

GDPR hub · RoPA · Cookies · CSA