Privacy and Data Protection Law Editing and Proofreading Services

A privacy notice is one of the few legal documents graded on whether ordinary people can read it. Most legal writing is judged by other lawyers, and difficulty carries no penalty beyond irritation. Here a regulator can look at a paragraph, conclude that the person it was written for would not understand it, and treat that as a shortfall in the obligation rather than a matter of style. Clarity stops being a courtesy and becomes part of what the document has to do.

Privacy notices and consent language make up most of the work that reaches us in this field. Data processing agreements arrive with them, along with records of processing, impact assessments, and breach notifications addressed to regulators and to affected individuals. Cross-border transfer documentation, cookie and tracking disclosures, and internal handling procedures come through the same files.

Both of the regimes our clients write under say so directly. Information given to a person about their own data must be provided "in a concise, transparent, intelligible and easily accessible form, using clear and plain language",¹ and disclosures to consumers "shall use plain, straightforward language and avoid technical or legal jargon."² The California rules go on to require a format that is readable on smaller screens and notices that follow recognized accessibility standards.² None of that describes a preference about tone. It describes a document that has to work when it is read once, on a phone, by somebody who did not want to read it.

The interesting difficulty is that plain language and accurate language pull apart under pressure. "We may share your information with service providers" is vague, and the instinct is to tighten it. But "we share your information with service providers" is a different statement, and "we may" was possibly load-bearing. Turning a nominalization into a verb usually helps; turning a hedge into a commitment changes what the business has promised. So the work runs in two directions at once: sentences carrying three obligations get broken into three, passive constructions that hide who is acting get an actor, and defined terms get used consistently instead of drifting into synonyms. Where making a sentence clearer would also make it say something new, it comes back as a question rather than as an edit.

Vagueness of a particular kind is worth naming because it is so common. A notice says information may be shared with third parties, and never says which, or why. It says data is kept for as long as necessary, without saying necessary for what. It says appropriate safeguards are in place. Each of these is grammatical, readable, and tells the reader nothing they can act on. An editor cannot supply the missing answer, because the answer is a fact about the business. What an editor can do is mark every place the document promises specificity and then withholds it, so somebody who knows can decide whether to fill it in.

Breach notifications ask for something different again. The regulator's copy is on a clock: notification is due "without undue delay and, where feasible, not later than 72 hours after having become aware of it", and where it is later than that, the notice must carry the reasons for the delay.³ The same article sets out what it must contain, including the nature of the breach with the categories and approximate numbers involved, a named contact point, the likely consequences, and the measures taken or proposed.³ Those four elements make a natural structure, and a draft that buries one of them inside a paragraph about something else is harder to check under time pressure than it needs to be.

The letter to the affected person is a separate act of writing. It must describe the breach "in clear and plain language",⁴ and it is read quickly, by someone who is worried, usually on a phone, and often before the organization has finished finding out what happened. It should say what occurred, what information was involved, what is being done, and what the reader should do now, in that order and without the hedging that reads as evasion. Sentences written to be legally unassailable frequently read as though something is being concealed, which is the opposite of what the letter is for. We do not remove qualifications that carry meaning. We do point out where a qualification has been added out of habit and is costing the document the reader's trust.

Consistency across the file matters as much as any single document. The retention period in the notice, the period in the processing agreement, and the period in the records of processing are three statements about one practice, and they are usually drafted at different times by different people. The same is true of the categories of data, the list of sub-processors, and the description of what a cookie banner does. We read these against each other and report the differences. Which version is correct is not ours to choose.

We do not assess legal sufficiency. Whether a lawful basis is made out, whether a transfer mechanism holds, whether a breach is notifiable, and whether a notice meets the standard in a given jurisdiction are decisions for counsel and the privacy team, and they reach us made. We do not add a purpose, narrow a disclosure, or resolve a contradiction between two documents by keeping the one that reads better.

Everything sent to us is treated as confidential, including live incident material, unpublished notices, and the internal procedures behind them.