We’re all getting them: “We’ve updated our privacy policy” emails from companies left, right, and centre. But are organisations required to send them? Or are they sending them because everyone else is?

Is there a legal requirement to notify people a privacy policy has been updated due to the incoming GDPR rules? A company’s not emailed me in the past to say they’ve updated their privacy policy, so I’m just wondering what’s special about a privacy policy update off the back of GDPR? Does GDPR itself mandate customers be notified a company’s adhering to it?

1 Answer 1


There is no specific requirement in the GDPR to inform users of an update to a company's privacy policy, nor is there anything to say it must be done by email.

The GDPR requires businesses and organisations making decisions about the means and purposes of processing personal data ("controllers") to inform the people whose data they process ("data subjects") of certain things prior to or within one month of starting to process that data. Emailing data subjects is one way of informing them, but if the information is already present in a privacy policy, it may be expedient to send a link to the policy, rather than the text of the policy itself.

Prior to the coming into force of the GDPR, and in reality, for as long as organisations have taken or continue to take to bring their policies and procedures up to compliance with the GDPR, some controllers may not have informed data subjects of everything the law required them to. As such, emailing data subjects may have been the only way to inform them so as to tick that box.

In general, information to be provided to data subjects can be found in Articles 12-14.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .