Duty to inform

What it means

The duty to inform is the controller’s obligation under GDPR to tell people whose personal data it processes the essential facts about that processing. It is done when the data are collected, or within a month if the data did not come directly from the person.

The information covers who the controller is and how to contact it, for what purpose and on what legal basis the data are processed, who receives them, whether they leave the EU, how long they are kept and what rights the person has, such as the right of access, rectification or erasure.

The information must be concise, intelligible and easy to find. It is most often provided through a privacy notice on the website, an information sheet for employees, a sign at a CCTV camera or a link in an email footer.

How it works in practice

For companies we prepare the information separately for different groups: customers, website visitors, job applicants and employees. Each group involves different purposes and legal bases, and one generic document for everyone is usually inaccurate.

For employees, information on processing their data for payroll, contributions, attendance or benefits is part of onboarding. If the company relies on legitimate interest, for monitoring for example, it must say so expressly.

The information must be updated with every change: a new software supplier, a new purpose, data moved to a cloud outside the EU. An outdated privacy notice is a frequent finding in inspections and complaints.

What to watch out for

A common mistake is copying someone else’s privacy notice without adapting it. It then lists purposes and tools the company does not use and omits the real ones. In an inspection such a document serves more as evidence of carelessness.

The duty to inform is not consent. A company that merely tells people what it does while processing data without a proper legal basis breaches GDPR even with a perfect notice. The legal basis comes first, informing about it second.