What is a privacy policy?

In plain English

A privacy notice tells people what happens to their personal information. Websites often call it a privacy policy, although the important point is the information it communicates. A useful notice describes the organisation’s real activity, rather than presenting a generic collection of impressive legal phrases.

For a Jersey organisation, the JOIC’s privacy-notice checklist identifies information relevant to Article 12 of the Data Protection (Jersey) Law 2018. This includes identity and contacts, information categories, purposes and bases, sharing, relevant transfers, retention and rights. The checklist also stresses clear language and an accessible format.

The notice is a communication tool within a wider data-handling process. It cannot make a poorly managed activity appropriate merely by describing it. A website may explain one practice while a form integration actually performs another, so the wording and the working system need to be reviewed together.

Why it matters for a Jersey business

A local business website may send enquiry details to a mailbox, booking system or CRM. The owner needs to understand that journey before explaining it to customers. A template that mentions suppliers the business does not use, or omits a real connection, can create an inaccurate picture.

The Data Protection (Jersey) Law 2018 provides the local framework. A business’s activities and audience may require further consideration, but a copied reference to UK GDPR does not by itself explain its Jersey responsibilities. Review the actual activity and the applicable requirements with suitable support.

A realistic Jersey example

Imagine a Jersey maintenance business changing its enquiry form to send requests into a shared customer system. This is a hypothetical example. Before switching the connection, staff document the necessary fields, who receives the enquiry and how the record is managed after the job ends.

They review the privacy information against that workflow, including the new supplier arrangement where relevant. They also test the form with fictional information. The review connects the website wording to a real operational change, instead of treating the notice as a footer page that never needs attention.

How to prepare a useful review

Map collection points. Include forms, account registration, purchases and any other relevant website features. For each activity, identify what information is requested and why. Walk through the customer’s journey and compare it with what staff actually receive, because a field label alone does not describe the entire process.

Trace the information. Record the services receiving it, the accounts controlling them and the people with access. Ask the developer to explain integrations in language the owner understands. Keep unnecessary technical secrets out of public information while retaining an appropriate internal record of the workflow.

Review purposes and retention. The business should be able to explain how it decides what is needed and how long it is kept. Avoid inventing a standard number simply to complete a template. A defensible arrangement starts with the actual purpose and the applicable requirements for that activity.

Check the notice against official guidance. Use the JOIC checklist to identify missing or unclear information, then review the wording for the intended audience. Explain unfamiliar terms or remove them where plain language works. Contact details should direct a person to somebody who can handle the request in practice.

Put the information where it helps. A footer link can support discovery, while a collection point may also need relevant information available at the right moment. Test the route from a phone and check that it remains readable without requiring the visitor to decipher a difficult layout.

Assign ownership. Record who updates the notice when forms, suppliers or purposes change. Include it in relevant website-release reviews. Keeping a dated draft and the reason for an update helps staff understand which actual change the wording reflects, instead of repeatedly replacing dates without reviewing the substance.

Common myths

A copied template matches any business. Data journeys and purposes vary.

Publishing a notice fixes the underlying process. Collection and handling still need appropriate decisions.

A footer link ends the review. Accuracy and accessibility also matter.

Our take

Jersey Web’s view is to start with the real information journey. Use current Jersey guidance to review the notice, keep the language understandable and connect updates to actual operational changes. The owner should recognise their business in the explanation they publish.