When you need one

Any time your initiative collects personal information from an individual, you’re required to let them know what you’re doing with it. Your privacy expert can help you determine whether your initiative needs a privacy notice and review your content. Always make sure an individual has access to read or hear a privacy notice before providing you with their personal information.

What’s required

Your privacy notice must include:

• why you're collecting an individual's personal information
• your legal authority to collect and use it
• whether the information will be shared with any other parties
• the consequences of not providing information. For example, if the individual doesn't complete an application form with their personal information, then they can't receive the benefit
• the individual's right to access and correct any personal information they provide
• the relevant Personal Information Bank number they can use to exercise that right
• the individual's right to file a complaint with the Office of the Privacy Commissioner if they aren't satisfied with the way their information is handled

General process

• once you’ve drafted your notice, share it with your privacy expert for their review
• depending on your institution, various approvals may be needed

When to update and review

If there are any changes to the way your initiative collects or uses personal information, you’ll need to update your privacy notice accordingly. You may also want to schedule a regular review of the notice to ensure it remains accurate. If there are any changes required to the Privacy Impact Assessment, that’s also a great time to update your notice.