The year the authorities read the privacy notice: CEF 2026 on transparency

The reason this action is more uncomfortable than the previous ones has nothing to do with how severe the authorities are. It has to do with transparency being the only obligation in the regulation that is assessed by reading, from the reader's side. A register of processing is judged on the completeness of its fields; a security measure is judged on what it prevents; a privacy notice is judged on whether an ordinary person, having read it, knows what happens to their data. That is a check that needs no visit to the premises: the text is already public, and has been for years.

It is worth keeping the three articles apart, because they are cited together and treated as one. Article 12 is about form: information that is concise, transparent, intelligible, easily accessible, in clear and plain language. Article 13 is about content when you collect the data from the person. Article 14 is about content when the data reaches you from someone else. In practice the first two almost always exist in some form; the third, in the large majority of cases, does not exist at all.

• «For as long as necessary for the purposes indicated» is not a retention period: it is the question restated as an answer. Article 13(2)(a) asks for the period, or the criteria used to determine it.
• «Our partners», «selected suppliers», «group companies» are not categories of recipients. A category is recognisable because the reader understands who is meant.
• The legal basis must be stated for each purpose, not once at the bottom for all of them. When there are five purposes and three bases, the pairing has to be readable.
• A transfer outside the Union must be declared with the instrument that supports it, and with where to obtain a copy of it.
• The Article 14 notice must be given within one month of obtaining the data, or at the first communication with the data subject if that comes sooner.

How to prepare, without waiting for the report. The first exercise is to read your own notice the way a customer would, that is once and reluctantly. The second is to put it next to the register of processing and compare line by line: purposes, bases, recipients, periods, transfers. If the notice declares four purposes and the register lists nine, one of the two is false, and it does not matter which — the inconsistency between the two documents is itself the finding, because it shows that one of them does not describe reality.

On the questionnaire, if one arrives, a note on method. The temptation is to answer by describing the organisation as we would like it to be. It is a mistake that costs twice: the authority compares the answers with the documents, and the divergence between what you wrote in the questionnaire and what is in the register is a finding in its own right, additional to the original one. The useful answer says what exists, what is missing, and by what date it will be closed. The second part is not a weakness: Article 24 asks for measures that are appropriate and kept up to date, not for perfection already achieved.

A note on the calendar, because it determines what is reasonable to do now. The aggregation of national results is expected in the second half of 2026 and the summary report will follow. Waiting for it before moving is the least sensible choice of all: the report will say which defects the authorities found in notices that are already published, which includes yours. Rereading it beforehand costs an afternoon; rereading it after a questionnaire costs the same, with a deadline attached.