Which entity must provide a privacy notice?

Editorial team Published on

Under the HIPAA Privacy Rule, covered entities—which include health plans, health care clearinghouses, and most health care providers that transmit health information electronically—must provide a Notice of Privacy Practices. Additionally, under federal and state consumer laws like the California Consumer Privacy Act (CCPA), for-profit Financial Institutions and qualifying businesses must provide privacy notices to consumers.

Healthcare Entities (HIPAA)

  • Health Plans: Health insurance companies, HMOs, and employer-sponsored self-insured health plans must provide notices.
  • Health Care Providers: Doctors, clinics, hospitals, pharmacies, and dentists who conduct electronic transactions must provide a notice.
  • Health Care Clearinghouses: Entities that process nonstandard health information into standard formats must provide a notice.

Financial and Commercial Entities (GLBA & State Laws)

  • Financial Institutions: Banks, credit unions, mortgage lenders, and insurance companies must give annual privacy notices to customers under the Consumer Financial Protection Bureau rules.
  • For-Profit Businesses (CCPA): Businesses operating in California that meet revenue thresholds or handle data for over 100,000 residents must provide a notice at collection.

What entities must provide a privacy notice?

Under major privacy and healthcare laws like HIPAA and comprehensive state data privacy laws (such as the CCPA), specific organizations that collect personal or protected health data must provide a privacy notice.

HIPAA Covered Entities (Health Data)

Under the Department of Health and Human Services HIPAA Privacy Rule, the following covered entities must provide a Notice of Privacy Practices (NPP):

  • Health Plans: Including health insurance companies, HMOs, company health plans, and government programs like Medicare.
  • Health Care Clearinghouses: Entities that process nonstandard health information into standard formats.
  • Health Care Providers: Doctors, clinics, hospitals, pharmacies, and psychologists who transmit any health information electronically in connection with standard HIPAA transactions.

Businesses under Consumer Privacy Laws (General Data)

Under state laws like the California Consumer Privacy Act (CCPA), for-profit businesses that collect consumers' personal information and meet specific thresholds must provide an online privacy policy or notice. This applies if the business:

  • Has gross annual revenues exceeding $25 million.
  • Buys, sells, or shares the personal information of 100,000 or more consumers or households.
  • Derives 50% or more of its annual revenue from selling or sharing consumers' personal information.

Organizations under the GDPR (Global/EU Data)

Under the General Data Protection Regulation (GDPR), any controller—meaning any organization, business, or non-profit that determines the purposes and means of processing personal data of individuals in the EU—must provide a clear privacy notice at the time data is collected.

Who is entitled to receive a privacy notice?

Consumers, customers, and individuals whose personal data is actively collected by an organization are entitled to receive a privacy notice.

Who is Entitled to Receive Notices

  • Consumers and Customers: Under financial regulations like the Consumer Financial Protection Bureau rules, anyone who applies for or obtains a financial product or service is a consumer entitled to an initial notice before nonpublic personal information is shared. Ongoing customers receive annual notices.
  • Website Visitors and Users: Under privacy laws like the GDPR and state laws like the Texas Data Privacy And Security Act, individuals visiting a site or having data collected at a point-of-collection are entitled to transparent disclosures.
  • Job Applicants and Employees: Many modern frameworks require separate workforce or applicant privacy notices explaining how internal data, biometrics, or recruiting information is handled.

Which of the following must provide a privacy notice?

Any organization or business that collects and processes personal data from individuals requires a privacy notice under data protection laws like the UK GDPR and EU GDPR.

When is it Required?

  • Direct Collection: When you collect personal data directly from an individual (such as names, phone numbers, or email addresses via a website form or sign-up sheet), you must provide the privacy notice at the time of collection.
  • Indirect Collection: When you obtain personal data from a third party or another source, you must provide the notice within a month of getting the data, at the first communication with the individual, or before disclosing the data to someone else.

What Triggers the Need?

  • Websites and Apps: Operating a site that tracks users, collects contact details, or handles newsletter sign-ups.
  • Employers: Collecting data from job applicants, workers, contractors, and permanent employees.
  • Customer Transactions: Selling products or services where financial, delivery, or identity details are logged.

You can use the ICO Privacy Notice Guidance to help draft a compliant document for your specific activities.

Is a privacy notice mandatory?

Yes, a privacy notice is mandatory if your business collects personal information and falls under specific regional or industry privacy laws.

When a Privacy Notice is Required

  • Under the GDPR (Europe): Any organization processing personal data for residents of the European Union must provide a clear privacy notice at the time data is collected, unless an explicit exemption applies.
  • Under U.S. State Laws (like California's CCPA/CPRA): Businesses that meet specific revenue or data-processing thresholds must provide a California Consumer Privacy Act (CCPA) notice at or before the point of collecting personal information. Other states with comprehensive data privacy laws (such as Virginia, Colorado, and Connecticut) have similar transparency and disclosure requirements.
  • Under Federal Industry Rules: Financial institutions are strictly required by the Gramm-Leach-Bliley Act (GLBA) to provide initial and annual privacy notices to their customers. Websites collecting data from children under 13 must comply with the Children's Online Privacy Protection Act (COPPA), which requires a direct privacy notice.

General Rule of Thumb

Even in jurisdictions without a broad overarching federal privacy law (like the United States broadly), operating a website that collects names, emails, or IP addresses typically triggers requirements under state online protection acts, or via third-party service agreements (such as app stores and analytics tools) that mandate a public privacy disclosure.
Furthermore, users on LinkedIn agree that a privacy notice is an informational transparency tool and is legally distinct from getting active user consent.

Duties of Covered Entities to Provide Notice | Texas HB300 Training

9 related questions found

What must not be included in a privacy notice?

A privacy notice must not contain confusing legal jargon, vague language, or hidden processing activities that mislead users about how their data is used.

What to Avoid in a Privacy Notice

  • Vague or ambiguous terms: Do not use unclear words like "may" or "might" when describing data sharing or collection, as transparency laws require specific and clear facts.
  • Hidden processing purposes: Do not collect data for one reason and use it for a completely new purpose without updating the notice and informing the user first.
  • Complex legal jargon: Avoid long, hard-to-read sentences or dense walls of text that the average person cannot easily understand.
  • Outdated information: Do not leave old contact details, dead links, or inactive retention periods in the document.
  • Missing core rights: Do not omit how users can contact you, withdraw consent, or file a complaint with an official data protection authority.

For official rules and writing guidelines, you can review the advice provided by the Information Commissioner's Office (ICO).

When to provide a privacy notice?

You must provide a privacy notice at or before the point of collecting personal data directly from an individual.

Direct Collection

  • Give the notice at or before the exact moment you ask for personal information (such as names, emails, or phone numbers).
  • This applies whether you collect the data via a website form, an app, or in person.

Indirect Collection (Third Party)

  • Provide the notice in a timely manner if you get data from someone else.
  • Under many rules (like GDPR), you must do this within one month of getting the data, or sooner if you plan to use the data to contact the person or share it with others.

Ongoing Relationships

  • Send an annual notice if required by specific industry rules (like financial services under the Gramm-Leach-Bliley Act).
  • Update and re-share the notice whenever your privacy practices change significantly.

Does every company need a DPO?

No, not every organisation needs to appoint a Data Protection Officer (DPO). Under the UK GDPR and EU GDPR, a DPO is only mandatory for specific types of organisations and activities.

You can check specific rules and guidance directly through the Information Commissioner's Office.

When a DPO is Mandatory

An organisation must appoint a DPO if it meets any of these three criteria:

  • Public authorities or bodies: This includes government agencies, state schools, and local public services (excluding courts acting in a judicial capacity).
  • Large-scale, regular, and systematic monitoring: The core activities of the organisation require tracking individuals on a large scale (such as via CCTV surveillance, online behavioral tracking, or location apps).
  • Large-scale processing of sensitive data: The core activities involve processing special category data (such as health records, ethnicity, or religious beliefs) or criminal conviction and offence data on a large scale.

What If You Do Not Meet These Criteria?

If your organisation does not fit into these mandatory groups, you do not legally need a DPO. However, many companies choose to appoint one voluntarily to demonstrate good practice and accountability. If you do not have a DPO, responsibility for data protection compliance still rests with your management and staff.

Which items belong in the privacy notice?

A privacy notice tells people how an organization collects, uses, shares, and protects their personal data.

You can review a guide on compliance via GDPR.eu or look at small business steps on the ICO Privacy Notice Guide to understand standard requirements.

Key Information Included

  • Who You Are: The name and contact details of the organization.
  • Data Collected: The types of personal data gathered (like names, emails, financial details, or location).
  • Collection Method: How the data is gathered (such as direct forms, cookies, or third-party sources).
  • Purpose: Why the data is collected and how it is used (like fulfilling orders or sending newsletters).
  • Legal Basis: The legal or lawful reason for processing the information.
  • Data Sharing: The categories of third parties or partners with whom the data is shared.
  • Data Storage and Retention: How long the data is kept and how it is kept secure.
  • User Rights: How individuals can access, correct, delete, or limit the use of their data, plus how to opt out.
  • Updates: The effective date and how changes to the notice will be communicated.

Which of the following would not form part of a privacy notice?

An internal employee data handling instruction or an exhaustive step-by-step IT security disaster recovery procedure would not form part of a public-facing privacy notice.

What a Privacy Notice Contains

Under data protection laws like the ICO Guidance on Privacy Notices, a privacy notice is an external communication meant for customers, website users, or clients. It must include:

  • Identity and contact details of the organization and Data Protection Officer (DPO).
  • Purposes and lawful bases for processing personal data.
  • Categories of personal data collected.
  • Recipients or categories of third parties with whom data is shared.
  • Retention periods or criteria used to determine how long data is kept.
  • Individual rights (such as the right to access, erase, or rectify data).

What is Excluded

  • Internal Privacy Policies: Internal documents that instruct employees or staff on day-to-day data governance, storage protocols, or backend password management are internal guidelines, not external privacy notices.
  • Technical System Vulnerabilities: Specific backend server configurations, firewall setups, or IT security incident response plans are operational details kept out of consumer-facing transparency notices.