Is a Personal Information Notice legally required?

It depends. Federal law does not mandate a single unified notice, but sectoral laws and state privacy statutes frequently require disclosures. Consumer privacy laws such as California’s CCPA/CPRA, Virginia’s CDPA, and similar statutes impose specific notice requirements in covered contexts.

When must the notice be provided?

Provide the notice at or before the point of collection of personal data. If processing changes material purposes, update and reissue the notice before new processing begins.

Can the notice be delivered electronically and signed?

Yes. Electronic delivery and acknowledgments are generally valid under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted, provided intent to sign, consent to electronic records, attribution, and retention are satisfied.

What happens if the notice is incorrect?

An incorrect or missing notice can lead to enforcement actions, private claims under state laws, or regulatory penalties. Maintain versioned records and correct notices promptly to reduce risk.

How long should delivery and consent records be kept?

Keep delivery, consent, and audit records for at least the period required by applicable rules—commonly a minimum of three years and longer for HIPAA-regulated records (six years).

How do individuals correct or withdraw consent?

Provide a clear method in the notice for submitting correction or withdrawal requests and maintain an internal process to log and process those requests within the timeframes required by law.

Electronic Signature
Templates
Personal
Personal Information Notice

Personal Information Notice

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

PERSONAL INFORMATION NOTICE

This Personal Information Notice describes the categories of personal information that will be collected, the purposes for which that information will be used and disclosed, retention practices, the rights of the individual, and how to contact the organization responsible for the information. By signing below you acknowledge receipt of this notice and indicate whether you consent to the collection, use and disclosure described herein.

Recipient Information

Recipient Name: Recipient Address:

Recipient Email:

Recipient Phone:

Organization / Information Controller: Contact Person for Privacy Inquiries:

Purpose and Effective Date

Purpose: The personal information described in this notice will be collected and used to perform administrative functions, to fulfill contractual obligations, to meet legal and compliance requirements, and for the following specific purposes as checked below.

Effective Date of this Notice:

Types of Personal Information Collected

The organization may collect one or more of the following categories of personal information:

Name
Contact details (address, email, phone)
Government identification numbers (e.g., SSN, ID)
Financial information (bank account, payment history)
Employment, education, or professional information
Health or medical information (if applicable)
Photographs or video recordings
Other

If Other, describe:

Use and Disclosure

Personal information collected will be used and disclosed for the purposes described in this notice. Disclosures may be made to third-party service providers, professional advisors, regulators, or other parties as authorized or required by law.

Operational administration and account management
Billing, collections, and payment processing
Marketing and promotional communications
Aggregated research and analytics
Compliance with legal or regulatory obligations
Other permitted uses

If Other, describe permitted uses:

Retention and Disposal

Personal information will be retained only as long as necessary to satisfy the purposes set out in this notice or as required by law. After that time information will be securely destroyed or de-identified.

Retention period (describe duration): Retain until individual requests deletion or correction

Your Rights

Subject to applicable law, individuals have the right to access their personal information, request correction or deletion, restrict or object to certain processing, and request a copy of data in a portable format. Requests will be processed in accordance with legal requirements and may be subject to verification.

To exercise your rights contact (name):

Contact Email:

Contact Phone:

Withdrawal of Consent and Consequences

You may withdraw any consent to the collection, use or disclosure of your personal information at any time by contacting the person listed above. Withdrawal of consent may affect the organization's ability to provide goods, services, or comply with contractual obligations.

If you wish to withdraw consent, describe preferred method of contact:

Security and Third-Party Processors

The organization implements reasonable administrative, technical and physical safeguards to protect personal information. Personal information may be disclosed to third-party processors for limited purposes under written agreements that require appropriate safeguards.

Describe material security measures or processors (optional):

Acknowledgement and Consent

By checking the boxes below and signing, I acknowledge that I have received this Personal Information Notice, I understand the purposes for which my personal information may be collected, used and disclosed, and I indicate my consent as specified.

I acknowledge receipt of this Personal Information Notice.
I consent to the collection, use and disclosure of my personal information as described above.
I request a copy of this notice be provided to me in paper or electronic form.

Warning: Providing false information or attempting to interfere with lawful information handling may have legal consequences or affect services provided.

Printed Name:

Signature:

Date:

If signing on behalf of the recipient, state relationship or authority:

What a Personal Information Notice covers

A Personal Information Notice is a written disclosure that explains what personal data an organization collects, the purposes for which it is used, how it is shared, and how long it is retained. In the United States this notice is used to meet consumer-privacy and sectoral transparency obligations, to document consent or lawful basis for processing, and to inform individuals about their access, correction, and deletion rights. The notice is typically provided at or before the point of collection and is tailored to the industry and the applicable state or federal privacy requirements.

Why this notice matters for compliance and trust

A clear Personal Information Notice reduces regulatory risk, helps satisfy disclosure obligations under ESIGN and state privacy laws, and supports lawful processing. Maintain a notice to demonstrate transparency, record consent where required, and provide a fixed reference for data subjects and regulators.

Who prepares and receives a Personal Information Notice

Personal Information Notices are prepared by organizations that collect personal data and delivered to individuals whose data is collected.

Consumers and customers who provide personal data for a transaction, enrollment, or application
Employees, contractors, or applicants when personal data is collected for HR or payroll purposes
Vendors and third parties during onboarding or when processing identification or payment data

Tailor the notice language to the recipient audience and the processing activity to ensure clarity and legal sufficiency.

Primary signers and responsible roles

Individual — Data Subject

The person whose personal information is collected. They must receive the notice and, where required, give informed consent or an acknowledgment. The individual may exercise access, correction, or deletion rights under applicable privacy laws.

Company — Privacy Officer

The organizational owner responsible for drafting and maintaining the notice, ensuring legal compliance, documenting consent records, and responding to requests. The Privacy Officer coordinates retention and security practices with legal and IT teams.

Essential elements to include in a professional notice

A complete Personal Information Notice organizes required details so recipients can understand what is collected, why, and what rights they have under applicable law.

Purpose

Explain the specific reason(s) for collecting the personal information and how the organization will use those data elements.

Categories Collected

List the categories of personal information collected, such as identifiers, contact, financial, or health-related categories when applicable.

Third-Party Sharing

Describe categories of recipients or service providers with whom data is shared and the general purpose of those disclosures.

Retention

State how long the organization retains the information or the criteria used to determine retention periods.

Individual Rights

Summarize rights available to the individual — access, correction, deletion, and how to submit requests.

Contact Details

Provide the office or person to contact for privacy questions, including an email or phone number for inquiries and requests.

Key data elements the notice should reference

Personal Identifiers: Name, SSN, driver’s license

Contact Information: Street address, email, phone

Financial Data: Bank account, payment card

Health Data: Medical history, PHI

Employment Data: Job title, payroll data

Usage Data: IP address, device identifiers

Step-by-step: preparing and issuing the notice

Follow these sequential steps to ensure the notice is accurate, accessible, and delivered at the correct time.

01

Determine scope: Identify the processing activities and data categories to disclose.
02

Draft language: Write concise statements of purpose, recipients, and retention.
03

Add contact info: Include a named privacy contact and method for requests.
04

Distribute: Provide notice at collection and keep a record of delivery.

Configuring an online delivery workflow

Set up an electronic workflow that records delivery, consent, and any acknowledgments for auditability.

Field	Configuration
Delivery trigger	At point of collection
Authentication	Email or SMS code
Acknowledgment	Checkbox with timestamp
Audit record	Store delivery log and IP

Where to file, send, or retain the notice

Identify the physical and electronic destinations for the notice and supporting records to ensure retrieval and compliance.

Point of collection: Provide notice on forms, web pages, or intake kiosks.
Signed acknowledgment: Store the signed copy in the individual’s record.
Central repository: Keep master notices in a central document-management system.
Backup archives: Retain audit logs and prior versions securely offsite

Digital delivery and eSubmission considerations

Choose a platform that captures consent, preserves an audit trail, and retains records in accessible formats.

Formats supported: PDF, DOCX, HTML
Integrations: Salesforce, Microsoft 365, NetSuite
Authentication options: Email, SMS, KBA

Ensure the platform supports secure storage (AES-256), transport encryption (TLS 1.2/1.3), and exportable audit trails for legal review.

Timelines for issuing and updating notices

Maintain a schedule for initial delivery, updates, and retention milestones so recipients receive current disclosures as practices change.

At collection:

Provide the notice when personal information is first collected.

When practices change:

Update and reissue the notice before new uses take effect.

Upon request:

Respond to access or correction requests within the timeframe required by applicable law.

Periodic review:

Review notices annually or when processing changes.

Record retention:

Keep delivery and consent records per retention policy.

Common mistakes to avoid when preparing the notice

Using vague language that fails to identify specific purposes or categories of data collection, creating regulatory interpretation risk.
Failing to provide a clear opt-out or withdrawal mechanism when required by consumer privacy laws, which can trigger enforcement actions.
Not recording delivery or consent events, leaving the organization unable to prove disclosure or obtainion of lawful consent.
Overlooking state privacy requirements like California’s consumer notice obligations, resulting in inconsistent or insufficient disclosures.

Penalties and risks from incomplete or incorrect notices

Regulatory fines: Administrative penalties possible

Consumer claims: Private lawsuits possible

Breach escalation: Greater enforcement scrutiny

Reputational harm: Loss of trust and customers

Tax consequences: Incorrect reporting penalties

Recordkeeping violations: Sanctions or corrective orders

Select eSignature vendor comparison for delivering notices

Compare common vendor criteria relevant to issuing and retaining Personal Information Notices and signed acknowledgments; signNow appears first for parity in comparison.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	No	No	Yes, limited	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Real-world examples of notice delivery

These customer examples show how organizations deliver notices and document consent in practice.

Optica Ventures — COO

Optica used a simplified online notice to improve customer clarity and reduce follow-up questions.

The interface emphasized key data uses and contact info.
As a result, the team experienced fewer support inquiries and clearer consent records, making privacy responses faster while preserving a customer-friendly experience.

Martin Properties — Founder

Martin Properties centralized tenant notices in a digital workflow to ensure delivery at application.

Tenants acknowledged the notice online during lease signing.
This approach created a searchable audit trail, reduced paper handling, and ensured consistent disclosures across multiple properties and mobile signings.

Frequently asked questions about Personal Information Notices

Answers to common questions on legal validity, timing, format, and storage for Personal Information Notices used in the United States.

Need help? Contact support

Is a Personal Information Notice legally required?
It depends. Federal law does not mandate a single unified notice, but sectoral laws and state privacy statutes frequently require disclosures. Consumer privacy laws such as California’s CCPA/CPRA, Virginia’s CDPA, and similar statutes impose specific notice requirements in covered contexts.
When must the notice be provided?
Provide the notice at or before the point of collection of personal data. If processing changes material purposes, update and reissue the notice before new processing begins.
Can the notice be delivered electronically and signed?
Yes. Electronic delivery and acknowledgments are generally valid under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted, provided intent to sign, consent to electronic records, attribution, and retention are satisfied.
What happens if the notice is incorrect?
An incorrect or missing notice can lead to enforcement actions, private claims under state laws, or regulatory penalties. Maintain versioned records and correct notices promptly to reduce risk.
How long should delivery and consent records be kept?
Keep delivery, consent, and audit records for at least the period required by applicable rules—commonly a minimum of three years and longer for HIPAA-regulated records (six years).
How do individuals correct or withdraw consent?
Provide a clear method in the notice for submitting correction or withdrawal requests and maintain an internal process to log and process those requests within the timeframes required by law.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now