Organisation website section “Personal Data Protection”
The section “Personal Data Protection” published on an organisation website is an important part of the information, helping residents clearly understand how the organisation processes their personal data. This is especially relevant for municipalities, schools, preschools, libraries, museums, arts centres and other public-sector organisations that every day collect, store and use various data about residents, employees, pupils, parents or visitors. Properly prepared and easy to find, this website section increases trust in the organisation, helps ensure transparency and contributes to compliance with legal requirements.
In this section, information must be presented clearly, understandably and accessibly. It is important not only to publish documents, but also to ensure that they are easy to find and adapted for different users, including people with disabilities. It is therefore recommended to publish documents not only in PDF format, but also as website content that is convenient to read using screen readers or mobile devices.
What information should be published?
- Personal data processing rules.
This document explains what personal data the organisation collects, for what purposes it processes it, what legal basis it relies on and how long the data is stored. For example, a school may process pupils’ and their parents’ data for the purposes of organising education, while a library may process readers’ data for managing the issuing of publications.
It is important for a resident to clearly understand what information is collected about them and why. The rules should therefore be written not only in legal language, but also in simple language so that every website visitor can understand them.
- Rules for processing video personal data.
If the organisation uses video surveillance, separate information about the processing of video data should be published on the website. This is especially relevant for local authority administrations, schools, museums or libraries, where video cameras may be used to protect property, ensure visitor safety or maintain public order.
This information must clearly state where surveillance is carried out, for what purpose it is carried out, how long the recordings are stored and to whom they may be provided. It is important to ensure that video surveillance is proportionate and complies with GDPR and the requirements of other legislation.
- Description of the procedure for exercising the data subject’s rights.
Individuals have the right to know how they can exercise their rights: to access the data being processed, request rectification, erasure, restriction of processing or to object. The organisation website must therefore clearly explain how such requests are received, examined and within what period they are answered.
For public-sector organisations, it is important to present this information clearly and consistently so that residents do not need to look for additional explanations. The clearer the procedure, the fewer uncertainties there are both for residents and for the organisation itself.
- Forms for data subjects’ requests.
It is convenient when the website provides ready-made request forms that a person can download or complete electronically. This helps standardise the process and ensures that the organisation receives all the information needed to examine the request.
If possible, it is worth providing the option to submit forms by electronic means, while complying with security requirements. Such solutions are especially useful for local authority organisations and educational organisations that serve a large number of residents.
- Contact details of the data protection officer.
If the organisation has appointed a data protection officer, their contact details must be clearly stated. Usually the name and surname, telephone number and/or e-mail address are published so that residents can conveniently contact them with questions of interest to them.
This information is especially important when a person wants to clarify the exercise of their rights or the circumstances of data processing. The contact details should be easy to find, not hidden among other documents or general website sections.
- Other relevant information on personal data processing matters.
Depending on the nature of the organisation’s activities, this section may publish additional explanations about the use of cookies, the provision of electronic services, registration forms, surveys or the provision of data to third parties. For example, a museum may provide information about visitor registration for educational activities, while a school may provide information about data processed in remote learning platforms.
It is important that all information is regularly reviewed and updated. If responsible persons, processes or systems used change, the website content must also be adjusted accordingly.
Clarity, accessibility and compliance
When publishing information about personal data protection, it is important to follow not only the requirements of GDPR, but also the general principles of transparency and accessibility in the public sector. Website content must be understandable to various target groups – from pupils’ parents to senior citizens or people who rarely use digital services.
It is also necessary to take account of website accessibility requirements. Document titles must be clear, links understandable, and the content structured with headings and lists. In this way, the information becomes more accessible to all users, and the organisation shows a responsible approach to the right to receive information.
A properly prepared section “Personal Data Protection” is not just a formality. It is a practical tool that helps the organisation comply with legal requirements, and residents to clearly understand their rights and the organisation’s responsibility when processing personal data.