GDPR – How to inform data subjects?

STARTUPS — LEARN HOW TO INFORM YOUR USERS!

Informing data subjects is mandatory if your startup processes personal data. The GDPR requires information to be provided in a clear and precise manner. How should you inform the individuals whose personal data you process? What information must be provided?

1. WHAT OBLIGATION DOES THE GDPR IMPOSE?

Under Articles 13 (direct collection) and 14 (indirect collection) of the GDPR, the data controller is required to inform data subjects of the processing carried out on their personal data, whether the data is collected directly from the data subject or indirectly (for example: publicly available data or data from social networks).

2. WHAT INFORMATION MUST THE COMPANY PROVIDE TO DATA SUBJECTS?

Under the GDPR, the following information must appear in an information notice:

• Identity and contact details of the data controller
• Where applicable, identity and contact details of the data controller's representative
• Where applicable, contact details of the Data Protection Officer ("DPO")
• Purposes of the processing
• Legal basis for the processing (consent, performance of a contract, compliance with a legal obligation, etc.)
• Whether the provision of personal data is mandatory or optional, and the consequences for the individual of not providing the data
• Where applicable, the legitimate interests pursued by the data controller or a third party, if the processing is necessary for those legitimate interests
• Recipients or categories of recipients of the personal data, where they exist
• Details of transfers of data to third countries and the associated safeguards
• Retention period for the personal data, or the criteria used to determine that period
• Reference to each of the rights of data subjects (access, rectification, erasure, restriction of processing, objection, portability, etc.)
• Reference to the right to withdraw consent at any time, where applicable
• Reference to the right to lodge a complaint with a supervisory authority
• Reference to the existence of automated decision-making, where it exists, including profiling
• In the case of indirect collection: categories and sources of the data collected

This information notice, often displayed below contact forms on websites, must specify:

• whether responses are mandatory or optional;
• the identity of the data controller and, where applicable, their representative;
• the purpose(s) of the processing for which the data is intended;
• the rights available to data subjects (e.g., the right of access, rectification and deletion of their personal data).

3. WHAT FORM CAN THIS INFORMATION NOTICE TAKE?

While the GDPR does not prescribe a specific format for the information notice, it must be readable, easily accessible, clear and understandable. For employees, it may take the form of a clause in the employment contract, an email sent individually to each employee, a notice displayed on employee information boards, or an information sheet on the company's intranet or a folder accessible to all staff.

For partners, service providers and shareholders, it may take the form of a notice included in contracts, at the bottom of emails, correspondence or collection forms addressed to them.

This information may therefore take the form of:

• a Privacy Policy for personal data processing carried out via a website;
• an internal policy for employees;
• information notices at the bottom of forms, quotes or emails;
• a personal data protection clause in employment, client or service provider/supplier contracts.

4. OUR RECOMMENDATIONS

Our recommendations:

• Avoid copying existing privacy policies that are not tailored to the personal data processing activities carried out by your startup and that are sometimes out of date;
• Prioritize a readable, understandable and easily accessible format;
• Use simple and clear language;
• Provide information at different stages of the user journey;
• Prioritize key information and communicate it to the data subject at the time of account creation, directly on the registration page;
• On that same page, link to a comprehensive information notice via a hyperlink (e.g., a link to a Privacy Policy);
• Keep information notices up to date.

5. WHAT SANCTIONS APPLY?

Personal data protection authorities can carry out remote inspections and therefore sanction a startup if its website does not properly inform data subjects!

The sanctions provided for under the GDPR for failure to inform data subjects are 4% of the startup's total annual worldwide turnover or a fine of €20 million — whichever is higher.

References

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;
• Guidelines, recommendations and best practices published by the European Data Protection Board (EDPB);
• Guidelines of the Article 29 Working Party (WP29) endorsed by the EDPB.

By completing this contact form, African Legal Factory collects and processes your personal data as data controller in order to respond to your enquiries. You have the right to access, rectify, object to, erase, restrict, port your data, and to provide instructions regarding its handling after your death.

For more information on the processing of your personal data, please consult our Privacy Policy.