A privacy notice should identify who the data controller is, with contact details for its Data Protection Officer. It should also explain the purposes for which personal data are collected and used, how the data are used and disclosed, how long it is kept, and the controller's legal basis for processing.

To write a privacy notice, clearly describe the types of personal data collected, purposes and method of processing, legal basis, data retention periods, data subject rights, security measures, and contact information of the organization and other concerned authorities required by the relevant law.

The purpose of a Privacy Notice Data controller - The organisation who (either alone or in common with other people) determine the purpose for which, and the way data are processed. Data Subject – the person about who you are processing data.

You must provide individuals with information including: your purposes for processing their personal data, your retention periods for that personal data, and who it will be shared with. We call this 'privacy information'.