The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

How should I tell people about how we’re processing personal data during the pandemic?

Where possible, organisations should have clear and accessible privacy information in place before processing begins. However, we recognise that in this exceptional period, this may not always be possible.

Organisations should ensure that privacy notices are in place and updated as soon as reasonably practical. More details of what they should include can be found on our website, where there is also a simplified version that may be helpful to organisations.

The sort of information that they ought to include might be (but isn’t limited to):

  • An organisation’s name and contact details (email and telephone number),
  • The data held and the reasons why,
  • Where this data was obtained,
  • The length of time it will be retained for, and
  • How people can request it be erased.

Where possible, organisations should make this information as accessible as possible, consider the different circumstances and factors that will impact upon this, and communicate accordingly.