Privacy notices: what should a business understand before drafting one?

Before drafting a privacy notice, a business should identify which personal data it obtains, why it uses that information, where it keeps it and who can access it. This map helps the notice reflect actual processes. Copying another organization's text can overlook tools, providers or purposes that form part of the company's own operations.

Follow information through the business

A contact form is only one entry point. Recruitment applications, customer databases, access records and third-party platforms may create additional data flows. Follow each flow from collection through retention or deletion, recording the people and systems involved along the way.

Mexico's current federal law governing personal data held by private parties addresses privacy notices, individual rights and protective measures. It identifies the Secretariat of Anti-Corruption and Good Governance as the authority in this area. Older materials referring to INAI should therefore be reviewed before reuse.

The first discussion should involve sales, human resources and technology teams. Each may understand one part of the journey without knowing what happens when the information moves into a different platform. Bringing those perspectives together can reveal gaps that drafting alone would miss.

Build a working inventory

• Record each form, document or channel requesting information and the person responsible for operating it.
• Distinguish data needed to handle a request from information collected simply because it has always been requested.
• Describe each purpose through a specific activity, such as answering enquiries or managing an employment application.
• Identify systems, providers and people receiving or viewing information, including cloud-based services.
• Explain how requests from individuals are handled and who verifies identity in a proportionate way.
• Review access permissions, retention and deletion, identifying practices still needing a clear decision.

The inventory may reveal duplicate records or shared accounts. Documenting these findings supports operational improvements as well as changes to the notice. The information map should also be updated when the company changes a provider or introduces an additional purpose for using personal data.

Align the notice with the digital experience

Imagine a website offering to answer an enquiry but subsequently adding the submitted email address to marketing campaigns. The review should identify both uses and assess how they are communicated and what requirements apply. A statement beside the form does not, by itself, resolve every aspect of subsequent processing.

Check that links work, the rights-request channel receives messages and someone can follow them through. A privacy notice works alongside access controls, supplier arrangements and internal procedures; it does not replace those measures.

Before activating a new tool, conduct a short review of the information it receives, the tasks it will perform and any changes needed in existing processes. This helps reduce differences between what the company tells people and what its systems actually do.

Frequently asked questions

Is a privacy notice in the website footer enough?

Placement is only one element. The review must consider how people are informed through each channel, the actual processing and applicable requirements. A standalone link does not establish comprehensive compliance.

Does using an external platform transfer every responsibility?

That should not be assumed. The roles, agreements and actual processing need examination. A business should understand what happens to information it supplies to the tools used in its operation.

Next step: prepare a privacy and information discussion with an inventory of forms and systems. This guide organizes the questions; the final notice must reflect the particular processing activities.