The Content of the Policy — What Must Be Written
A privacy policy is not legal literature but the fulfilment of a statutory list of information. Under Article 24, where data are collected directly from the data subject, the controller is obliged, before collection or at its start, to provide at least the following: the identity and contact information of the controller, its representative or the processor; the purposes and the legal basis of the processing; whether the provision of data is mandatory and the consequences of refusal; the significant legitimate interests; the identity of the data protection officer, where one exists; the recipient or categories of recipients; the planned transfer to another state; the storage period or the criteria for determining it; and the subject's rights.
This list is precisely the skeleton on which a good policy is written: each point must be tailored to the real practice of the business and formulated in simple, understandable language — the law emphasizes simple language especially where the subject is a minor.
Where Data Are Obtained from Another Source
Where data are not collected directly from the subject, under Article 25 the controller is obliged to provide the information of Article 24 and to notify which data are processed and their source — including whether they were obtained from a publicly available source. This information must be provided within a reasonable period, or — where the data are used to contact the subject — at the first communication, and where disclosure is planned, before the disclosure, but no later than 10 working days from obtaining the data.
The obligation has exceptions: providing the information is not required where the subject already possesses it, where the collection is established by law, or where provision is impossible or requires disproportionate effort and would harm the lawful purpose — in these cases the controller must take appropriate measures, including placing general information publicly.