Skip to content
Step 1 / –
hubThe essentials

Rule 2 of 4

You now know you are required to collect as little data as possible (rule 1). The second core rule is about being open: transparency.

groupPersonal data
  1. checkData minimisation
  2. 2Transparencythis module
  3. 3Security
  4. 4Rights of data subjects
flagIntroduction

Transparency

Communicate and raise awareness. People have the right to know which data you use about them, how, and why. And you have the duty to tell them clearly.

targetWhat you will learn in this module
  • check_circleWhy you must communicate proactively and in plain language
  • check_circleWhich documents come with this
  • check_circleWho you communicate to and how long you may retain data
menu_bookTheory · 1 of 4

Plain, human language

You must communicate in specific, understandable terms, suited to your audience.

So: no over-complex sentences and no vague, catch-all legal language. Write as you would speak to a customer.

infoRemember

If your audience does not understand your privacy notice, you do not meet the transparency rule, no matter how legally correct it is.

menu_bookTheory · 2 of 4

Be proactive

You do not wait for someone to ask, you must inform proactively. In practice:

  • A Privacy noticeThe document that sets out which personal data you process, how and why, and what rights data subjects have. Tailor it to your own business; a generic template is not enough.Writing a privacy noticearrow_forward on your website: which data, how, why, and the rights of data subjects.
  • A separate Staff privacy noticeA privacy notice specifically for your staff: it explains which data you process as an employer (pay, appraisals, attendance, …), why, how long, and which rights your employees have. Add it as an annex to the employment contract.Staff privacy notice: what you must tell employeesarrow_forward, as an annex to the employment contract.
  • A Data processing agreementAn agreement with parties that process personal data on your behalf (your processors). Required where you share data, e.g. with software suppliers.What is a data processing agreement?arrow_forward where you share data, e.g. with suppliers.
  • Internal awareness, e.g. annual GDPR training for all staff.
celebrationYou are doing great! 🎉

By taking this course you are already working on that awareness. Pass it on to your colleagues so the whole team is on board.

menu_bookTheory · 3 of 4

Transparent to whom? And how long may you keep data?

groupsAll stakeholders

Existing and future stakeholders: customers and prospects, employees and applicants, suppliers and prospective suppliers, and third parties of every kind.

scheduleRetention period

Communicate clearly how long you retain data per process, and do not keep it longer than strictly necessary. Example: unsuccessful job applications you delete after 18 months.

menu_bookTheory · 4 of 4

In practice: how to approach it

  • Provide a customer and a staff privacy notice, specific to your own business.
  • Maintain a Records-of-processing registerA simple overview that lists which personal data you use and for what. It is the foundation for being transparent and for demonstrating compliance.Records of processing: do I need one?arrow_forward of which data you use and for what.
  • Have a data processing agreement where you share data with third parties.
  • Have managers and staff complete annual GDPR awareness training.
casesExample · 1 of 2

“Did not my web developer take care of this?”

Case 1A generic privacy policy + cookie banner

“My web developer put a privacy policy and a cookie pop-up online, so I am GDPR-compliant, he said.”

check_circleNot enough. Transparency requires you to specifically document which personal data you use, and the how and why around it. A generic privacy policy and a cookie pop-up will not cut it.
casesExample · 2 of 2

“We keep everything, just in case”

Case 2Keeping job applications for years

“We keep applications from candidates we did not select ‘just in case’ for years.”

check_circleToo long. Do not retain longer than strictly necessary and communicate the retention period. Unsuccessful applications, for example, you delete after 18 months.
quizPractice · question 1 of 2
infoNot for points, choose the correct answer to continue
"My web developer put up a generic privacy policy and a cookie banner. Am I compliant with the transparency rule?"
Correct: a generic privacy notice and a cookie pop-up are not enough. Transparency requires a specific description of your processing activities, tailored to your own business.
quizPractice · question 2 of 2
"What does the GDPR say about how long you keep personal data?"
Correct: do not keep data longer than necessary for the purpose, and be transparent about the retention period for each process.
summarizeSummary

What you take away from module 4

  • boltCommunicate proactively and in plain, human language, suited to your audience.
  • boltProvide a customer and a staff privacy notice, a records-of-processing register, and data processing agreements where you share data.
  • boltInform all stakeholders: customers, prospects, employees, applicants, suppliers, and third parties.
  • boltCommunicate the retention period and do not keep data longer than strictly necessary.
workspace_premiumModule complete

Module 4 complete 🎉

You now know how to communicate transparently and which documents come with that. In module 5 we look at the third rule: security.

lock_open 4 of 8 modules

On your way to the “GDPR essentials for SMEs” practice quiz

Complete all 8 modules and try the free practice quiz. The official exam with a certificate of attendance is in the GDPRWise app’s paid plans.

check_circle Modules 1-4 completeradio_button_unchecked Modules 5-8radio_button_unchecked Final exam ≥ 70%
workspace_premium