data processing notice

in English: privacy policy (privacy notice)

basicwidespread

This is the document in which a company or service describes what personal data it collects about you, how it uses it, to whom it discloses it, and what rights you have.

In plain terms

A data processing notice is like a medicine package leaflet: it is neither an advertisement nor a contract, but a mandatory description of what happens to what you "take". Here, what you provide about yourself. It tells you who processes your data, for what purpose, for how long, and whom to turn to if you are unhappy with something.

In the European Union, this is not courtesy but obligation: the General Data Protection Regulation (GDPR) requires that anyone processing personal data must inform you about this in an understandable way. This applies to you even if you do not have to sign or accept anything.

In the case of AI tools, the privacy notice is particularly important because it reveals whether conversations you type into a chatbot are used to train the model and whether you can disable this. It also shows how long they are retained and whether humans can view them. If an AI agent has access to your emails, calendar, or files, the notice must address this as well.

How it works

The provider assesses what personal data it collects: what you provide (name, email, entered text) and what the system records automatically (IP address, device, usage habits).
For every data processing activity, it specifies the purpose and the legal basis, meaning what authorizes it: for example, your consent, contract performance, or the company's legitimate interest.
It describes to whom data is transferred (for example, to a cloud provider or the AI model developer), whether it leaves the EU, and how long it is retained.
It lists your rights: you can request a copy of your data, ask for its correction or deletion, object, and file a complaint with the authority (in Hungary, the NAIH).
The notice is published in an easily accessible location and updated if data processing changes. Such a change could be, for example, if conversations are now also used for model training.

An everyday example

You register for an AI chatbot, and at the bottom of the screen is the link: 'Privacy notice'. If you click it, you learn that by default, the questions you type in may be used to develop the model, but you can turn this off in the settings. After that, you can decide more consciously whether to type in your boss's name or your medical report.

Who is affected

everyoneEvery application, online store and AI tool processes data about you, and this document tells you exactly what data and why.

entrepreneur, executiveIf your company processes customer or employee data, it must provide an accurate privacy notice. If a new AI tool changes what data is processed and how, you must update that notice too.

employeeBefore entering corporate or customer data into an AI tool, the notice reveals where it goes and who can see it. → Work & HR

developerWhat your application or agent actually does with the data must match what the disclosure states. → Code

A common misconception

MythIf there is a data processing notice, my data is safe, and the company does not share any of it with others.

In realityThe notice only describes what the company does with your data, and this can easily include sharing or training models. Protection does not come from the document's existence, but from its content and enforcement.

Limits and risks

Privacy notices are often long and written in legal language, so most people move on without reading them. It is worth checking at least the purposes, the onward transfer of data, and the retention period.
The text is a promise, not proof: you cannot externally verify whether the company actually acts as described; this is subject to authority investigation.
The information may be modified over time, and what was not included yesterday (for example, use for training) may be included today.
GDPR applies to companies outside the EU if they offer services to people living in the EU. However, enforcing your rights against them may be more difficult in practice.

Similar, but not the same

general terms and conditions – The Terms of Service set out the rules for using the service and must be accepted, whereas the privacy notice is a unilateral statement about what happens to your data.
consent – Consent is your decision regarding a specific data processing activity, while the information notice is the information on which you can make that decision.
cookie notice – The cookie notice concerns only cookies placed in your browser and similar tracking, whereas the privacy policy covers the service's entire data processing.

Related concepts

Broader

data protection, General Data Protection Regulation, transparency

Narrower

cookie notice, retention period, opt-out from model training

On the edge

personal data, consent, data controller, general terms and conditions, training data

A brief history

Online privacy notices spread in the late 1990s alongside e-commerce. The European Union's 1995 Data Protection Directive already required informing data subjects. The GDPR, adopted in 2016 and applicable from May 25, 2018, turned this into a detailed obligation that is directly applicable in all member states.

Where things stand

By the end of 2026, almost every serious website, application, and AI service has a data processing notice. The focus of debates is how clearly they describe model training and agents' data access.

Status: 2026 November

In the news

Appears in 3 Agent Age stories; the curve shows weekly occurrence in the news magazine.

Google privacy update: data from connected apps may shape AI Mode adsOct 26, 2026 · Marketing
Google changes privacy policy to allow AI search data to be used for targeted adsOct 24, 2026 · Jog
Google tests AI Mode ads that can draw on Gmail and Photos dataOct 19, 2026 · Marketing

Also known as

data processing notice · privacy notice · privacy statement · Data protection guidelines · privacy policy · privacy notice · privacy statement

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.