Can one privacy notice cover GDPR, CCPA and the NDPR?

One privacy notice can cover the GDPR, the CCPA and Nigeria's rules, which today are the Nigeria Data Protection Act 2023 and the Commission's 2025 directive, if it is structured by section rather than by law. The shared sections carry the common content once, and the regime-specific sections, such as the lawful basis table for Europe and Nigeria or the categories and opt-out link for California, sit under their own headings so each reader finds their part.

Is a privacy notice the same as a privacy policy?

In practice, privacy notice and privacy policy are two names for the same public document. The CCPA calls it a privacy policy in Civil Code section 1798.130(a)(5); the GDPR calls the duty information to be provided, in Articles 13 and 14; Nigeria's Act calls it a privacy policy in section 27(3). PolicyDrafters drafts an external notice for the public and a separate internal data protection policy for staff, because the two have different readers.

Does the CCPA apply to a company outside California?

The CCPA can apply to a company outside California. Under Civil Code section 1798.140(d), it applies to a for-profit business that does business in California and meets one of three thresholds, wherever it is based: annual gross revenue above the inflation-adjusted statutory figure, buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or deriving 50 percent or more of annual revenue from selling or sharing personal information. The PolicyDrafters intake asks where your users are and what you collect, and the notice is drafted against the regimes that follow from your answers.

GDPR, CCPA and NDPR privacy notices: what has to be in each?

Written by PolicyDrafters. Published 4 October 2026, updated 8 November 2026.

Privacy notices under the GDPR, CCPA and Nigeria's Data Protection Act 2023 share a core: identity, data collected, purposes, recipients, retention and rights. GDPR Articles 13 and 14 add lawful basis and transfers; the CCPA adds sale or sharing and a Do Not Sell or Share link; Nigeria's Act adds lawful basis and a complaint route to its Commission.

What is a privacy notice?

A privacy notice is the public statement by which an organisation tells the people whose personal data it processes who it is, what it collects, why, who receives it, how long it is kept and what rights those people have. Each of the three regimes gives it a different name and a slightly different list, but the lists overlap far more than they diverge. That overlap is what makes one well-structured notice workable for a company with users in Europe, California and Nigeria at once. The sections below take each regime in turn and then put them side by side.

The General Data Protection Regulation sets the contents in two articles. Article 13 applies where the data is collected from the person, and the information is given at the time the data is obtained. Article 14 applies where it was obtained from somewhere else.

Under Article 13(1) the notice states the following [1]:

the identity and contact details of the controller and, where there is one, its representative and its data protection officer
the purposes of the processing and the legal basis for each
the legitimate interests pursued, where that is the basis
the recipients or categories of recipient
whether the data is transferred to a third country, with the safeguard relied on and where to find a copy of it

Article 13(2) adds:

the retention period or the criteria for setting it
the rights of access, rectification, erasure, restriction, objection and portability
the right to withdraw consent, where consent is the basis
the right to lodge a complaint with a supervisory authority
whether providing the data is a statutory or contractual requirement, and what happens if it is not provided
the existence of automated decision-making, including profiling, with meaningful information about the logic and the consequences

Article 12(1) governs the form: concise, transparent, intelligible and easily accessible, in clear and plain language.

Article 14 repeats the list for data obtained indirectly, except whether providing the data is required. It adds two items: the categories of personal data concerned (Article 14(1)(d)) and the source, including whether it came from a publicly accessible source (Article 14(2)(f)).

Article 14(3) sets the timing [1]:

within a reasonable period, and at the latest within one month
at the latest at the first communication, where the data is used to contact the person
at the latest at the first disclosure, where disclosure to another recipient is envisaged

The lawful basis is the item most notices under-state. Article 6(1) lists six bases, and the notice has to say which one applies to which purpose, not list all six and hope.

What does the CCPA require in a privacy notice?

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, works with two documents that often sit in one.

The first is the notice at collection under Civil Code section 1798.100(a). At or before the point of collection, the business tells the consumer the following [2]:

the categories of personal information and of sensitive personal information it collects
the purposes for which each category is used
whether each category is sold or shared
how long it intends to retain each category, or the criteria used to decide

The second is the privacy policy under section 1798.130(a)(5), which the business updates at least once every twelve months. It covers the following [3]:

the consumer's rights and two or more designated methods for submitting requests
the categories of personal information collected in the preceding twelve months, with the categories of sources and the purposes for collecting them
the categories sold or shared and the categories disclosed for a business purpose, with the categories of third parties involved

The rights the policy describes are:

the right to know (sections 1798.110 and 1798.115)
the right to delete (1798.105)
the right to correct (1798.106)
the right to opt out of sale or sharing (1798.120)
the right to limit the use of sensitive personal information (1798.121)
the right not to be discriminated against for exercising any of them (1798.125)

Section 1798.135(a) adds the mechanics. A business that sells or shares personal information provides a clear and conspicuous link titled "Do Not Sell or Share My Personal Information" on its homepage. Where that applies, a link titled "Limit the Use of My Sensitive Personal Information" sits there too. Neither is required if the business honours an opt-out preference signal under section 1798.135(b) and says so in the policy [4].

The California scheme has no lawful basis concept and no transfer rules. Its weight falls on categories, sale or sharing and the opt-out. That is why a notice written only for Europe reads as incomplete to a Californian reader, even when the facts are all there.

Automated decision-making technology is dealt with in the CCPA regulations rather than in the statute's notice list. The California Privacy Protection Agency revised those regulations in a package completed in September 2025 [5].

What does Nigeria require after the NDPR?

The Nigeria Data Protection Act 2023 established the Nigeria Data Protection Commission and set out the duties of controllers and processors in statute [6].

The Nigeria Data Protection Regulation 2019 that preceded it is no longer the instrument to draft against. The Commission issued its General Application and Implementation Directive 2025 on 20 March 2025. Article 3(3) of the directive states that the Commission ceases to apply the NDPR as a legal instrument, without affecting anything done under it before [7]. A notice that still cites the NDPR by regulation number names a retired rule. That is the failure this site's guide on templates warns about.

Section 27(1) of the Nigeria Data Protection Act 2023 requires a controller, before it collects personal data directly from the data subject, to give:

the identity, place of business and contact details of the controller and its representatives
the specific lawful basis and the purposes of the processing
the recipients or categories of recipient
the rights the data subject has under Part VI of the Act
the retention period
the right to lodge a complaint with the Commission
the existence of automated decision-making, including profiling, with its significance, its consequences and the right to object to it

Section 27(2) applies the same list where the data comes from another source. The exception is where the person already has the information, or providing it is impossible or disproportionate. Section 27(3) requires the information to sit in a privacy policy in clear, concise, transparent, intelligible and easily accessible form.

The right to withdraw consent is a separate duty. Section 26(4) requires the data subject to be told of it before consent is given, and section 35 lets the data subject withdraw it at any time. Cross-border transfers are governed by Part VIII of the Act rather than by the notice list. A notice that states them follows good drafting practice, not a line of the statute.

Article 27(3) of the directive then lists what the information to data subjects includes:

the name of the controller or processor
the lawful basis
the types of personal data collected
the purpose
the means of processing
access to the data by authorised third parties, and the purpose of that access
the data subject's rights
a contact for prompt internal remediation
the right to complain to the Commission

Article 27(4) adds that this information is not itself a request for consent. The lawful bases in section 25 of the Act, restated in Article 16 of the directive, are consent, contract, legal obligation, vital interests, public interest and legitimate interests. A notice drafted for Europe therefore already carries the structure the Act expects.

Two items on the directive's list, the means of processing and the internal remediation contact, do not appear in either of the other regimes. A notice intended for Nigerian users should carry them in their own paragraph. The Commission also runs a registration and compliance audit filing regime for controllers and processors of major importance (Articles 9 and 10 of the directive). The notice does not cover it, but the internal data protection policy should.

How do the three sets of requirements compare?

The table puts the three lists side by side, with the article or section that sets each item, so a drafter can see which rows are shared and which belong to one regime. Where a cell says practice, the item is not in that statute's list, but a well-drafted notice carries it anyway.

Scroll sideways for the other columns

Requirement	GDPR	CCPA/CPRA	NDPA 2023 and GAID 2025
Identity and contact details	Controller, representative, data protection officer (Art. 13(1)(a) and (b))	Two or more designated methods for submitting requests (s. 1798.130(a)(1) and (a)(5)(A))	Identity, place of business and contact details (NDPA s. 27(1)(a); GAID Art. 27(3)(a))
Categories of data	Required where data is obtained indirectly (Art. 14(1)(d))	Required, including sensitive personal information (s. 1798.100(a))	Types of personal data collected (GAID Art. 27(3)(c))
Source of the data	Source, and whether publicly accessible, for indirect collection (Art. 14(2)(f))	Categories of sources (s. 1798.130(a)(5)(B))	Not in the s. 27 list; practice
Purposes	Each purpose stated (Art. 13(1)(c))	Purpose for each category (s. 1798.100(a))	Each purpose stated (NDPA s. 27(1)(b); GAID Art. 27(3)(d))
Lawful basis	Basis for each purpose; legitimate interests named (Art. 13(1)(c) and (d))	No lawful basis concept	Specific basis for each purpose (NDPA s. 25 and s. 27(1)(b); GAID Art. 16)
Recipients and sharing	Recipients or categories of recipient (Art. 13(1)(e))	Categories disclosed, sold or shared, and the categories of third parties (s. 1798.130(a)(5)(B) and (C))	Recipients (NDPA s. 27(1)(c)); authorised third-party access and its purpose (GAID Art. 27(3)(f) and (g))
Sale or sharing and opt-out	Not a concept; objection right applies	Whether sold or shared; Do Not Sell or Share link (s. 1798.135(a))	Not a concept; withdrawal of consent applies (NDPA s. 35)
International transfers	Transfers and safeguards (Art. 13(1)(f))	Not required	Not in the s. 27 list; Part VIII of the Act governs transfers, and stating them is practice
Retention	Period or criteria (Art. 13(2)(a))	Period or criteria per category (s. 1798.100(a))	Retention period (NDPA s. 27(1)(e))
Rights	Access, rectification, erasure, restriction, objection, portability (Art. 13(2)(b))	Know, delete, correct, opt out, limit, non-discrimination (ss. 1798.105 to 1798.125)	The rights in Part VI of the Act (NDPA s. 27(1)(d); GAID Art. 27(3)(h))
Withdrawal of consent	Required where consent is the basis (Art. 13(2)(c))	Not framed as consent; opt-out instead	Told before consent is given (NDPA s. 26(4)); information is not itself a request for consent (GAID Art. 27(4))
Complaint route	Supervisory authority (Art. 13(2)(d))	Not in the statute's list; the Attorney General and the California Privacy Protection Agency enforce the Act	The Commission (NDPA s. 27(1)(f); GAID Art. 27(3)(j)); internal remediation contact (GAID Art. 27(3)(i))
Means of processing	Not in the Article 13 list	Not in the statute's list	Means of processing (GAID Art. 27(3)(e))
Whether provision is required	Statutory or contractual, and consequences (Art. 13(2)(e))	Not required	Not in the s. 27 list; practice
Automated decision-making	Existence, logic and consequences (Art. 13(2)(f))	Covered by the CCPA regulations rather than the statute's notice list	Existence, significance and consequences, and the right to object (NDPA s. 27(1)(g))
Timing and placement	At collection (Art. 13(1)), or within one month at the latest for indirect collection (Art. 14(3))	At or before collection (s. 1798.100(a)); policy updated at least every twelve months (s. 1798.130(a)(5))	Before collection (NDPA s. 27(1) and (2)); in a privacy policy (s. 27(3))

Why can one notice serve three audiences?

The temptation is to write three notices, one per law. That produces three documents that drift apart as each is edited on its own, and three places to update when a processor changes. The alternative is one notice structured by section, where each heading matches a row in the table above.

The identity section is written once. The data section lists categories, because California needs categories, and names the sources, because the GDPR needs the source for indirect collection and California asks for the categories of sources. The purposes section is a table with a column for the lawful basis, which Europe and Nigeria read and California ignores. The sharing section lists each category of recipient and states whether anything is sold or shared, which answers all three. The transfers section names the mechanism for each destination.

The rights section is split by regime under sub-headings, because the rights differ and the reader should find theirs without reading the others. The complaint section names the three routes. The California-specific items, the Do Not Sell or Share link and the twelve-month category lists, sit in a section headed for California residents. The Nigeria-specific items, the means of processing and the internal remediation contact, sit in one headed for Nigerian users.

Structured this way, the notice reads as one document to the person and carries each regime's full list for the regulator who reads it, and the facts live in one place. Each purpose row in the notice matches a line in the record of processing activities kept under GDPR Article 30, so when the record changes the drafter knows which row of the notice changes with it.

Where do privacy notices usually go wrong?

Three failures account for most of the gaps a reviewer finds in a privacy notice.

The first is the sharing paragraph that says "we may share your data with trusted partners" and stops. Every regime wants the categories of recipient. California wants to know whether it is a sale or a share. The GDPR wants the transfer mechanism where the recipient is abroad.

The second is the lawful basis listed as a block of all six bases rather than matched to each purpose. That fails the GDPR test and the Nigerian one. The third is retention stated as "as long as necessary" with no period and no criteria, where all three regimes ask for one or the other.

A notice drafted from the records of processing avoids all three, because the register already holds the recipients, the basis and the retention period for each activity.

How do we draft a privacy notice for the regimes that apply?

The privacy policy pack is drafted against the regimes that apply to your users and quoted at $1,200 to $2,500. It contains:

the external notice, structured as above
a cookie notice
the internal data protection policy
a data subject request procedure
a records of processing template

Our legal team reviews the draft before it reaches you, and the review is recorded in the revision block.

A SaaS or technology company with users in more than one of the three jurisdictions is the usual buyer. A healthcare organisation buys the same pack for its administrative data, meaning appointments, billing, staff and supplier records. Clinical procedures and clinical SOPs are out of scope.

Under the maintenance plan the notice is reissued with the changes marked when any of the three regimes moves. The CPRA regulations and the rules under the Nigeria Data Protection Act have both moved since the laws were passed.

Questions

Can one privacy notice cover GDPR, CCPA and the NDPR?: One privacy notice can cover the GDPR, the CCPA and Nigeria's rules, which today are the Nigeria Data Protection Act 2023 and the Commission's 2025 directive, if it is structured by section rather than by law. The shared sections carry the common content once, and the regime-specific sections, such as the lawful basis table for Europe and Nigeria or the categories and opt-out link for California, sit under their own headings so each reader finds their part.
Is a privacy notice the same as a privacy policy?: In practice, privacy notice and privacy policy are two names for the same public document. The CCPA calls it a privacy policy in Civil Code section 1798.130(a)(5); the GDPR calls the duty information to be provided, in Articles 13 and 14; Nigeria's Act calls it a privacy policy in section 27(3). PolicyDrafters drafts an external notice for the public and a separate internal data protection policy for staff, because the two have different readers.
Does the CCPA apply to a company outside California?: The CCPA can apply to a company outside California. Under Civil Code section 1798.140(d), it applies to a for-profit business that does business in California and meets one of three thresholds, wherever it is based: annual gross revenue above the inflation-adjusted statutory figure, buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or deriving 50 percent or more of annual revenue from selling or sharing personal information. The PolicyDrafters intake asks where your users are and what you collect, and the notice is drafted against the regimes that follow from your answers.
What does the privacy notice cover for a healthcare organisation?: For a healthcare organisation, the privacy notice PolicyDrafters drafts covers administrative data: appointments, billing, staff and supplier records. Clinical procedures and clinical SOPs are out of scope, and a notice that covers clinical records is drafted against the health privacy rules that apply to the organisation, which the intake identifies.

Sources

Regulation (EU) 2016/679 (GDPR), Articles 6, 12, 13, 14 and 30eur-lex.europa.eu
California Civil Code section 1798.100(a) (CCPA)leginfo.legislature.ca.gov
California Civil Code section 1798.130(a)(5) (CCPA)leginfo.legislature.ca.gov
California Civil Code section 1798.135 (CCPA)leginfo.legislature.ca.gov
California Privacy Protection Agency, CCPA regulationscppa.ca.gov
Nigeria Data Protection Act 2023, sections 25 to 27, 35 and Part VIIIndpc.gov.ng
NDPC, General Application and Implementation Directive 2025, Articles 3(3), 16 and 27ndpc.gov.ng

The documents this guide is about

Applies to

Privacy policy pack
A privacy policy pack is the set of public notices and internal documents that state what personal data an organisation collects, why, who receives it, how long it is kept and how people exercise their rights, drafted against each privacy law that applies, such as GDPR, the CCPA or the Nigeria Data Protection Act 2023.
$1,200 to $2,500
10 working days
Information security policy set
An information security policy set is the group of written policies and procedures that states how a company protects its systems and data: who may access what, how staff may use company devices, how incidents and outages are handled, which vendors may hold the data, and who owns each control.
$1,200 to $2,500
12 working days