Demonstrating your compliance with privacy notices

To be informed is to be empowered. The privacy notice is how you communicate your data processing and data protection legal compliance to your data subjects. Since these data subjects are real people, the notice needs to be both accurate and easy to understand.

It must be available to the data subject whenever you are collecting their personal data and, if you are not collecting it directly from them then you must provide it to them no later than one month after you have received their personal data.

What goes into your privacy notices?

One of the beauties of CCH GDPR Compliance is that the work you have done during set-up and data mapping is used to draft your privacy notice. The privacy notice you see in the governance documents section is unique to your organisation. You can provide it to your legal and copywriting teams for improvement or customise it further from within the editor. It can be published and shared using a unique link and any changes you make will automatically update to that link.

Examples of when to notify data subjects:

• Personal data is being collected from the individual or within 1 month if it was obtained from a third party.
• Communicating with data subjects about their rights.
• A data breach occurs.
• There is a material change to the processing.