The obligation on your homepage
Everything else in the GDPR happens behind the scenes; transparency is the part the public sees. It is also the cheapest to get materially wrong, because most privacy notices were written to look like everyone else's rather than to satisfy Articles 13 and 14. The good news: the required content is a finite list. Once you have the checklist, auditing any notice - yours or a vendor's - takes minutes.
What you must tell people 7 min live
Two articles, one checklist. Article 13 covers data you collect directly from the person; Article 14 covers data you get from somewhere else. The content overlaps heavily.
LiveThe content checklist3 min▶
A compliant notice tells the person, in clear and plain language:
- Who the controller is and how to contact them (and the DPO, if you have one).
- The purposes and the lawful basis for each (and the legitimate interest, if you rely on it).
- Who receives the data (recipients or categories of them).
- Any international transfers and the safeguard used.
- The retention period (or how it is decided).
- Their rights (access, rectification, erasure, restriction, portability, object) and the right to withdraw consent.
- The right to complain to a supervisory authority.
LiveDirect vs indirect, and timing3 min▶
- Article 13 applies when you collect data from the person - the notice must be there at the time of collection (the signup form, the checkout).
- Article 14 applies when you get data from somewhere else (a data provider, a partner) - you must inform the person within a reasonable period, at the latest one month, or at first contact.
- Article 14 adds one item: you must tell the person the source of the data, since they did not give it to you directly.
Make it readable 8 min live
A notice can contain everything required and still fail transparency if nobody can read it. Article 12 demands clear, plain language - which is why the layered notice exists.
LiveClear language + the layered pattern3 min▶
- Article 12: the information must be concise, transparent, intelligible, and in clear and plain language - especially for anything aimed at children.
- The layered notice resolves the tension between "complete" and "readable": a short top layer (who, why, your rights, a link) over a full second layer with every required item.
- Put it where the data is collected: a link at the signup form and checkout, not buried three clicks deep.
Lumina rewrites its notice. Lumina's old notice listed cookies and "we value your privacy" but never named a lawful basis, a retention period, or the right to complain. The rebuild added those, split into a short summary plus a full version, and put the link on the signup form. Same company, a notice that now matches Articles 13 and 12.
Self-studyThe notice as the front door to the rights2 min read▶
It is easy to treat the privacy notice as a legal formality, but it is really the front door to every right you learned in the leader track. The notice is where a person first learns they can ask for access, erasure, or portability, and where they find the channel to do it and the authority to complain to. A notice that omits the rights (or hides the contact) does not just breach Article 13 - it suppresses the rights downstream, because people cannot exercise what they do not know they have. So when you audit a notice, do not only check that the items are present; check that a real person could read it and know, concretely, what they can ask for and how. That readability test is the difference between a compliant document and an honest one.
Audit a real notice ★ 10 min · pen and paper
Run the checklist against a notice you actually use.
Open your own (or your company's) privacy notice. Tick each checklist item present: controller + contact, purposes, lawful basis, recipients, transfers, retention, rights, withdraw consent, right to complain.
Circle the missing ones. The three most commonly absent: lawful basis, retention period, and the right to complain to an authority.
Check readability: could a non-lawyer skim the top and know who has their data, why, and what they can ask for?
Check timing: is the notice actually shown at collection (the form, the checkout), or hidden in a footer?
Before session b4 ◐ 40 min total
- Audit your live privacy notice against the Article 13 checklist and list the missing items.
- Draft a short "layer 1" summary for your notice - who, why, rights, and a link to the full version.
- Check every form that collects personal data actually links the notice at the point of collection.
- Read: GDPR Articles 13 and 12 - the content list and the plain-language rule.
Official sources covered
Taught from the GDPR text. This page covers ~80% of the working content on transparency.
Three questions before you go 🎯 ◐ 90 seconds
1 · Which is commonly MISSING from a non-compliant privacy notice but REQUIRED by Article 13?
Most notices list purposes but omit the lawful basis, the retention period, and the right to lodge a complaint - all required by Article 13.
2 · When you obtain personal data from a third party (not the person), Article 14 adds the duty to tell them...
Article 14 (indirect collection) mirrors Article 13 but adds the source of the data, since the person did not provide it to you directly.
3 · The "layered notice" pattern exists to...
Article 12 demands clear, plain language while Article 13 demands completeness. A short readable top layer over a full second layer satisfies both.