The final notice must identify:
- The legal data controller and contact details
- Categories of people and personal data processed
- Purposes and lawful bases for each activity
- The Article 9 condition used for health or social-care information
- Recipients and processors, including website, email, cloud and form providers
- International transfers and safeguards
- Retention periods or clear retention criteria
- Data-subject rights and how to exercise them
- The right to complain to the Data Protection Commission
- Whether information is required by law or contract
- Any automated decision-making
- Effective date and review history
Separate privacy information may be required for service users, job applicants, workers and business contacts.