Privacy notices and consent design

What the engagement delivers

We review collection points, purposes and user journeys, then draft or revise notices and consent language for the agreed channels. The handover connects each statement to an operational owner and implementation requirement.

1. Inventory the collection points and the uses described by the business.
2. Trace each use to the relevant system, recipient and operational owner.
3. Prepare the agreed notice text and choice-design instructions.
4. Hand over implementation questions and a record of versions covered.

Keep the assessment tied to the actual user journey. A general website notice may need different supporting text at a particular collection point; the scope identifies the channels and screens being addressed.

Information to organise

• Screens and forms
• collected fields
• purpose descriptions
• marketing flows
• withdrawal process
• language needs
• existing notices.

Describe optional and required fields, the effect of declining a choice and how existing preferences are applied. Provide screenshots or a walkthrough using example data. Identify statements about retention or sharing that the business has not yet confirmed rather than inserting an unsupported promise.

A design or evidence issue to resolve

A checkbox cannot make an inaccurate purpose statement useful. If a support form also feeds marketing, identify that separate use and its legal basis before designing the choice.

For example, a user may withdraw a marketing preference in an account screen while an exported contact list remains with a campaign supplier. The handover should identify the downstream process and responsible owner needed to make the stated choice work across that flow.

Boundaries and next steps

Copy and legal review are distinct from UI development. Consent records, withdrawal propagation and downstream integrations require implementation by the responsible team.

The written scope identifies products, entities, jurisdictions, deliverables and fees. Share an initial description rather than confidential source code or personal datasets through the public enquiry form.

The deliverables can include notice drafts, screen-level wording and an issue register for product, marketing and operations teams. Translation, accessibility implementation and verification of recorded choices are included only where specified. Later changes to purposes or recipients should trigger a review of the affected statements.