Data Processing or Privacy Notices

Summary

This ODPA guidance explains the requirement for organisations that collect personal data to provide clear, relevant and accurate data processing or privacy notices to individuals at the point of collection, whether online or offline. It notes that the Data Protection Law sets out a comprehensive list of information that must be given, and points users to the ODPA's own notice as a possible model.

• Clarity required: Notices must clearly explain how personal data will be used, however it is collected (online, offline, directly or indirectly).
• Naming flexibility: Notices may be called data processing notices, privacy notices, data protection notices, or similar, provided the purpose is clear.
• Comprehensive information: The Law requires a specific, comprehensive list of information to be provided, and this must be easily accessible at all data collection points.
• Templates: Organisations may use templates or the ODPA's example notice as a starting point but must tailor them to their own specific processing activities.
• Law Enforcement Ordinance: Where personal data is processed for a law enforcement purpose under the Law Enforcement Ordinance, different information requirements apply under section 12 of that Ordinance.

Key obligations

• Organisations must provide clear, relevant and accurate information about how personal data will be used at all points where personal data is collected, whether online or offline.
• Organisations must ensure the comprehensive list of information required by the Law is easily accessible at all personal data collection points.
• Organisations must tailor any template privacy or data processing notice to reflect their own specific data processing activities rather than using it unmodified.
• When processing personal data for a law enforcement purpose under the Law Enforcement Ordinance, organisations must follow the differing information requirements set out in section 12 of that Ordinance instead of the Law's requirements.

Applies to

organisations that collect or process personal data, data controllers