Many such templates are also available online. We recommend that readers consult the ICO's website aimed at small-to-medium-size enterprises. The web page includes background information to GDPR, together with a suggested template privacy notice, which can be downloaded and then amended to suit a particular organisation's requirements.

Privacy Notices, often called Privacy Policies or Statements, must be used by every organisation and written in clear and plain language. They should be concise, and easily accessible. The purpose of a Privacy Notice is to inform a data subject of his/her rights regarding the processing of his/her data. Privacy notices may be displayed in many different places, for example, in forms, in contracts, websites, or on notice boards. It is an externally facing explanation of how you manage personal data responsibly and with respect.

If personal data is being provided by a data subject, your privacy notice or a link to it should be provided at the time that the data is collected. Here are some useful links:

• ◆ See https://ico.org.uk/for-organisations/guide-to-the-general-dataprotection- regulation-gdpr for general guidance.

• ◆ Department or Education model privacy notice: www.gov.uk/government/publications/data-protection-and-privacyprivacy- notices.

• ◆ Also see www.nationalarchives.gov.uk/informationmanagement/ legislation/data-protection for guidance on archiving personal data.