MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
In a privacy statement, you tell data subjects what you do with their personal data. The GDPR sets minimum requirements for the content: including who you are, which data you process for what purpose, on what legal basis, with whom you share it, how long you retain it, and what rights data subjects have.
Why a privacy statement?
If you process personal data, you have an obligation to inform: data subjects have the right to know what you do with their data and why. You do not have to inform them every time, but you must make the legally required information clearly and accessibly available, usually via a privacy statement.
What must it contain at a minimum?
The GDPR (Articles 13 and 14) requires, among other things: your identity and contact details, the purposes and legal basis of the processing, the categories of data, the recipients, any transfer outside the EU, the retention periods, and the rights of data subjects, such as access, correction, and deletion. It should also include a reference to the right to lodge a complaint with the Dutch Data Protection Authority.
Clear and understandable
The information must be provided in clear, simple language. A privacy statement full of legal jargon fails to serve the purpose: the data subject must truly understand what happens to their data.
Keep it up to date
If your processing activities change, for example due to a new service or supplier, update your privacy statement accordingly. An outdated statement does not reflect reality and does not comply with the GDPR.
Frequently Asked Questions
Am I required to have a privacy statement?
As soon as you process personal data, yes. The duty to inform stems from the GDPR.
What is the minimum requirement?
Including your identity, the purposes and legal basis, the recipients, the retention periods and the rights of data subjects (Articles 13 and 14 GDPR).
May I use a standard model?
As a basis, but it must align with what you actually process. A model that does not match your practice is unsuitable.
An accurate privacy statement?
Our legal experts draft your privacy statement and perform a privacy scan. View our privacyteam or schedule a free consultation.
