Privacy and terms: customer letters by post

A privacy letter informs customers about data processing. A change to terms may instead be a contract amendment requiring agreement. Separate the two purposes and never treat delivery as automatic consent.

Information, consent or contract amendment?

Purpose	What the letter does	What it does not automatically do
Privacy information	Explains processing and rights under GDPR Articles 12–14	Does not provide blanket consent to new purposes
Consent request	Requests a freely given, informed and unambiguous decision	Silence is not consent
Terms or contract amendment	Explains changes or proposes an amendment	Delivery alone does not amend an existing contract

What privacy information must cover

GDPR Article 13 covers data collected directly from the person; Article 14 applies to other sources. Depending on the circumstances, include:

Controller's identity and contact details, and data protection officer where applicable.
Purposes and legal bases, including the interests relied upon where relevant.
Recipients or recipient categories, and any third-country transfers and safeguards.
Retention period or criteria used to determine it.
Access, rectification, erasure, restriction and, where applicable, portability and objection rights.
Withdrawal rights for consent and the right to complain to a supervisory authority.
Other case-specific details such as data source under Article 14 or automated decisions.

Information must be concise, understandable and accessible. A brief covering letter with complete information attached may work; a bare web link is not sufficient in every situation. Timing and delivery depend on how the data is collected.

Office worker checking old and new customer information versions — Record the version, effective date and specific changes; separate privacy information from the contract.

New purposes and information deadlines

If processing for another purpose is planned, additional information must generally be supplied beforehand under Article 13(3) or 14(4). Also assess the legal basis and compatibility: information alone does not make processing lawful.

For data from other sources, Article 14(3) generally requires information within a reasonable period, at most one month. If communicating earlier, provide it by that first communication; if disclosing earlier, by the first disclosure. Statutory exceptions require case-specific assessment.

Changing terms: do not assume agreement

Amending existing contracts requires a valid basis or agreement. Broad standard clauses permitting far-reaching changes through silence are problematic. The German Federal Court of Justice ruled on such a bank clause on 27 April 2021, XI ZR 26/20. This is not a universal answer for every contract: the scope, sector and clause require individual review.

Compare old and new provisions understandably, explain the consequences and provide a real agreement channel if agreement is needed. Describe any statutory or contractual cancellation right accurately. Do not invent a universal response period or special cancellation right.

Sample: covering letter for privacy information

Subject: Updated privacy information, version [date]

Dear [name],
we are informing you about [specific reason]. Complete privacy information is enclosed. Changes concern particularly [areas].
This letter is informational and does not request blanket consent or agreement to contract amendments. For questions and to exercise your rights, contact [controller/contact].
Yours sincerely,
[Business]

Sample: proposing a terms amendment requiring agreement

For your contract [reference], we propose the changes described in the attachment. [Specific change and consequences]. With your express agreement they are intended to apply from [date]. Please communicate your decision through [appropriate channel]. We do not treat silence as agreement. [Legally reviewed explanation of what happens if agreement is not given].

Hands placing customer information in an envelope without exposed personal data — Use only necessary customer details and check attachments are matched to the right recipient.

Sending and documentation

Check addresses, data minimisation and recipient matching. If using service providers, clarify roles and any processor agreement under GDPR Article 28. Record letter version, attachments, recipients and dispatch; record required agreements separately. Delivery evidence is not evidence of consent.

Create individual letters in the letter editor. For lists and personalisation, see creating and sending mail merge letters. For customer rights, read GDPR access, erasure and marketing objections. Avoid mixing necessary privacy notices with advertising.

Official sources

GDPR, especially Articles 5–7, 12–14 and 28 · § 305 BGB · § 307 BGB · Federal Court of Justice on changes through silence, XI ZR 26/20

Note: General guidance on German law, not legal advice. Full privacy texts and contract amendments must fit the business and its actual processing.