# Privacy notice

URL: /systems/trust-and-governance/controls/privacy-notice · Id: `control:privacy-notice`

> Each Startup publishes a privacy notice that lists every Purpose it processes personal data for.

Each [Startup](/business/nouns/startup) publishes a privacy notice that lists every [Purpose](/business/nouns/purpose) it processes personal data for.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 P1.1](/systems/trust-and-governance/criteria/soc2/p1-1) | The entity notifies data subjects about its privacy practices. |
| [GDPR Art.13](/systems/trust-and-governance/criteria/gdpr/art-13) | A controller tells data subjects its identity, purposes, legal basis, recipients, retention and their rights at collection. |

## Implemented by
- [Contracting](/workflows/processes/contracting)
- [Publish terms](/workflows/processes/contracting/publish-terms)
- [Privacy](/systems/privacy)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every Purpose in force during the report period. |
| Assert | Each appears in the privacy notice Version published at that time. |

## Owner
[Legal Lead](/agents/legal/legal-lead), [Legal Team](/agents/legal).

## Example
A tutoring marketplace adds a progress-report Purpose. The privacy notice [Version](/business/nouns/version) published that day lists it, before the first report goes out.