A controller publishes a short first-layer privacy summary with clear links to deeper detail on purposes, rights, and transfers. How does GDPR practice generally view that design?
Select an answer to reveal the explanation.
Short Explanation
Layered notices are the "headline then details" model. A clear short overview up front with links to the deep dive helps people actually understand, as long as the essentials are not hidden or missing.
Full Explanation
Supervisory authorities and GDPR practice generally accept layered privacy notices: a short first layer with essential information and clear pathways to deeper detail on purposes, bases, recipients, transfers, retention, and rights. That design supports Article 12’s demand for concise, intelligible communication without dumping an unreadable wall of text on every screen. Municipal portals and commercial apps both serve the public better when the first layer is honest and the second layer is complete—not when complexity is used to obscure.
GDPR does not forbid summaries shorter than the full legal text; it requires that transparency be effective. A layered approach is not a derogation that removes the duty to state lawful bases—those bases must still appear in the information provided. Layering is also not limited to special-category data; it is a general UX pattern for ordinary and sensitive processing alike.
Exam caveat: layering fails if essential information is missing from reasonably accessible layers or if links are deceptive. Just-in-time notices complement, but do not replace, a durable notice people can find later.
Operational check: review the first-layer content against Article 13/14 essentials, click-test every “more information” link on mobile and desktop, ensure lawful bases and rights are reachable within one or two steps, and confirm language matches actual processing in the RoPA.