What it asks for. When personal data are collected directly from individuals, the controller must tell them, at the time of collection, who the controller is, the contact details of any data protection officer, the purposes and lawful basis, recipients, any international transfers, the retention period and their rights, among other items. Information about whether providing the data is a requirement and about automated decision-making must also be given where relevant.
In practice. Organisations maintain layered privacy notices that are accurate for each collection point, such as web forms, apps, recruitment and customer service. Notices are reviewed when processing changes. Evidence includes current notices, version history, a mapping from notice content to the record of processing activities and screenshots showing notices presented at collection.
Common gaps. Notices are often generic, out of date or inconsistent with actual processing. Retention periods and recipients are commonly described vaguely rather than specifically.