Make your privacy notice reflect your real data use.

Review what you tell people about their information

A privacy notice should explain your organisation's actual handling of personal information. Yudey helps review the selected notice against the business facts you provide, identifying gaps and wording that no longer matches the service. The starting point is the audience: customers, prospective customers, staff, applicants or another defined group. One notice should not be assumed to explain every relationship equally well.

The engagement can cover a focused document review, agreed revisions and a practical list of facts still requiring confirmation. It does not automatically include a complete data protection audit of the business. We define the activities, systems and notices within scope before work begins, so you can understand what the final output addresses and where wider work may still be needed.

Establish the processing facts before changing the wording

We ask what information is collected, where it comes from and what the organisation does with it. Different teams may use the same customer record for service delivery, accounting and marketing, with different supporting arrangements. The review can identify vague descriptions that combine these purposes without explaining them clearly. Your team needs to confirm the practice before the notice can accurately describe it.

The Information Commissioner's Office explains the categories of privacy information organisations need to consider, including purposes, lawful basis, recipients, retention and individual rights. ^[1] We use that framework to organise the review questions. We do not invent a lawful basis, retention period or overseas transfer arrangement simply because a template contains a space for one.

Make recipients and retention understandable

A business may share information with hosting providers, payment services, advisers or operational suppliers. We ask which relationships are relevant to the notice and what facts are available about their roles. A general phrase about trusted partners may leave the reader without a useful explanation. The review can identify where greater clarity is needed and which supplier details require further investigation.

Retention wording should connect with a policy the business can actually follow. We can flag an unsupported promise to delete information immediately or an indefinite period with no explanation. Deciding and implementing a retention schedule can require additional operational and legal work. The notice review records that dependency rather than claiming that changing a paragraph has changed how every system stores or deletes records.

Present the information at the right point

The agreed review can consider where people encounter the notice, including enquiry forms, account creation and recruitment steps described in the scope. We identify whether brief collection-point wording should be considered alongside a fuller notice. The objective is to help people understand the relevant information when it matters, without relying on a long document that is disconnected from the activity.

We also look at language, structure and consistency with other materials. A notice aimed at customers should not unexpectedly refer to an internal employment process or a service the business does not provide. Where children or other audiences with particular needs are involved, tell us early. The engagement may require a more specialised assessment rather than a routine small-business notice revision.

Separate transparency from the underlying controls

Clear wording does not itself make every processing activity appropriate. The review can identify questions about consent, marketing, security, supplier contracts or international transfers that need separate attention. We distinguish those questions from the notice amendments, so the business can assign the necessary actions. A privacy notice is one part of a wider approach to handling information responsibly.

Technical changes, staff training, breach response and individual rights requests are not automatically covered by this service. If a complaint, incident or regulatory enquiry already exists, disclose it when requesting support. Those circumstances may change the urgency and scope. We do not describe a revised notice as certification, regulatory approval or a guarantee against complaints or enforcement.

Receive a practical revision and action list

The agreed handover can include comments or a revised notice, a list of factual assumptions and unresolved questions, and publication notes for your team. We identify who should approve the business facts and what related documents may need attention. Website implementation and testing are separate unless specifically included. Publication should follow approval of the actual practices described, not merely completion of a writing exercise.

Fees depend on the audiences, activities, document versions and depth of fact gathering. The written GBP quotation states applicable VAT and the included revision rounds. Start with the notice type, principal data uses and reason for the review. We will agree a proportionate information request and suitable document handling, without asking you to submit customer records through the initial enquiry form.