To ease compliance and notification burdens for U.K.-based small- and medium-sized enterprises, the Information Commissioner's Office officially launched its Privacy Notice Generator 20 Aug.
The tool offers SMEs an easy step-by-step process that will create tailored privacy notices that are geared toward the business's specific role in the U.K. economy, such as finance, insurance, law, education, childcare, retail and manufacturing, as well as for the nonprofit sector. It creates two different types of notices; one for organizations to display on their website and external communications for customers, and the other for internal communications geared toward staff members and volunteers.
The Privacy Notice Generator is one component of the agency's ICO25 Strategic Plan to streamline some of its key services, according to Senior Engagement and Policy Officer Sharice Griffiths.
"We wanted to provide more regulatory certainty," Griffiths said in an interview with the IAPP. "We speak with SMEs quite regularly and we know that they often lack the time and resources (to dedicate to data governance obligations). SMEs have absolutely been at the heart of the development of this tool, and we've asked for their feedback every step of the way."
The generator replaces the previous word document-based template, which Griffiths said was made available for SMEs so they could properly inform data subjects as to how their personal data was utilized. `
"Our role is to translate data protection law into easy-to-understand tools and resources for SMEs," Griffiths said. "What we found was that (SMEs filing out the prior template) would still ask us questions about how to comply with the right to be informed."
Private beta testing began in the spring with approximately 40 SMEs taking part in the soft launch of the tool. Griffiths added that around 5,000 entities took interest in the beta testing after its first month, which demonstrated "there was real interest in this tool,” she said.
So far, the reaction among stakeholders utilizing the Privacy Notice Generator has been positive.
"The fact that this service is free is mind-blowing. It generated the privacy policy in no time, and I was able to seamlessly integrate it into my website," said artist and small business owner Bob Iles in a statement. "Legal jargon can be tricky to navigate, but it seems like this generator covers all the necessary elements."
U.K. Federation of Small Businesses Policy Chair Tina McKenzie said in a statement that the ICO's new tool will give SMEs a major boost by "reducing small businesses' cost of compliance, and the associated stress" that comes with dedicating employees' time and energy toward meeting such obligations.
The new tool arrives as anticipated U.K. data protection reform takes a new shape following the 2024 national election. All of the ICO's resources for SMEs will be updated to reflect any changes in data protection law, according to Griffiths.
"The ICO is here to help," she said. "We have a range of resources on our website to help SMEs if they are struggling. We are here to help organizations get data protection right."
Alex LaCasse is a staff writer for the IAPP.
