Privacy policy against privacy notice

The two obligations do different work

The policy is about the organisation and is written once. It answers the question of how this business handles personal information in general, and it has to be available free of charge to anybody who wants it, usually as a page on the website. The notice is about a moment. It answers the question of what is happening to me, right now, as I fill this in, and it belongs next to the fields being completed rather than behind a link. That difference explains why a notice can be six lines long while a policy runs to several pages. It also explains why they cannot substitute for each other: a person filling in a patient intake form is not going to read a policy, and a person researching a business is not helped by a notice written for one form.

What a collection notice has to tell somebody

Under the Australian Privacy Principles the notice covers who is collecting, how to contact them, what is being collected and why, whether the collection is required by law, who the information will usually be disclosed to, whether it will go overseas and roughly where, and how the person can access it or complain. That reads like a lot for a short notice, and the way through is plain sentences in the order the reader cares about. What you are giving, what it is for, who else sees it, and what to do if you are unhappy. Anything the person would be surprised by belongs near the top, particularly overseas disclosure and any secondary use such as marketing.

Where organisations get caught out

The most common failure is a policy that describes an organisation from three years ago, listing systems that were replaced and omitting the analytics, the chat tool and the offshore support desk that have since been added. The second is a notice that only exists on the web form, while the same information is also collected by phone and on paper with nothing said. The third is a policy that promises more than the organisation does, such as a deletion commitment nobody has implemented. Health information carries extra obligations and a lower tolerance for vagueness, so a clinic reusing a generic retail policy is taking a real risk. Review both documents on a set date each year and after any change to a system that touches personal information.

Writing them so somebody reads them

The legal tests in Australia, the EU and the UK all use the same language about clarity: the material has to be clearly expressed, concise and intelligible. In practice that means short sentences, headings phrased as the questions people actually ask, and no defined terms unless they are unavoidable. Put the specifics in rather than hedging with words like may and including but not limited to, because a document that could describe any organisation tells the reader nothing about this one. A table of what is collected, why, and who receives it is often the clearest way to present the core of a policy, and it makes the annual review much faster because the gaps are visible.

Building both as documents

A privacy policy is a long structured document with numbered sections, a running header and a version date, and at that scale it can carry a table of contents whose headings match the sections exactly. Tables carry the collection and disclosure summary, and callouts have four variants, which is enough to mark the notifiable breach process and the complaints path without inventing extra styles. A collection notice is a single short block, so it gets no cover and no letterhead. Documents never print citations, so any reference to a statute or a principle is written into the body as content.

Keeping the two documents in step

The two drift apart the moment either one is edited alone. A practical control is a single register of collection points, listing every form, phone script and paper document that gathers personal information, what each one collects and which notice sits on it. When the policy is reviewed, the register is the checklist, and any collection point without a notice is visible immediately. It also solves the reverse problem, which is a notice promising something the policy does not support. Keep one owner for both documents, usually whoever is accountable for privacy rather than whoever built the form, and put the review date on the face of each. Where a service is delivered through a third party, such as an online booking tool, the register should record whose notice the customer actually sees, because it is often not the one the business thinks.

Questions people ask