This code is aimed at all organisations that collect information about people, whether directly or indirectly. It applies to activities such as:

  • asking people to fill in their names, addresses and health information on an official form, either online or in paper form;
  • collecting information about shoppers from their loyalty card transactions; or
  • recording and retaining the calls customers make to a call centre.

It also applies to situations where it may be less obvious that data is being collected, such as when people are observed by smart devices or when information is inferred from how an individual behaves online. For example:

  • using an individual’s location data on their smart phone to inform them of events going on in their area; or
  • analysing what an individual views or shares on social media and marketing them with offers on related products and services.

This code does not apply to collection of information that does not identify people, for example, anonymised or statistical information. However, if you anonymise information once you have collected it then it is best to inform people that you do so. You should also make sure that you explain that if you are anonymising personal data, then you are undertaking processing of personal data in order to anonymise it.

This code of practice is designed as a good practice document to help you collect and use personal information fairly and transparently and give individuals appropriate control and choice over their data, including in a digital context. It focuses on drafting and communicating clear privacy notices that ensure that individuals know how information about them will be used, and that they understand the impact it will have on them.

You can use this code in several different ways, depending on the sort of information you collect and how you do it, for example:

  • to produce a new privacy notice;
  • to develop an existing privacy notice; or
  • to evaluate an existing privacy notice.

It includes examples to show how the different approaches we are recommending can work in practice.