1798.130(a)(5) — Privacy policy content and annual update

high privacy-notice

Requirement

The online privacy policy describes consumers' rights and how to exercise them, the categories of personal information collected, sources, purposes, categories disclosed, sold or shared and to whom, and retention — and is updated at least once every 12 months.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of

privacy policyprivacy noticeprivacy statement

Required element 2 — any one of

every 12 monthsat least once every 12 monthsannual…each yearevery yearwithin the last 12 monthsupdated annuallyreviewed annually

Required element 3 — any one of

rightscategorieshow to exercisesourcespurposes

Supporting terms — specificity signals

1798.130(a)(5)regs 7011last updatedeffective date

Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

no privacy policy

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

Framework	Control	Title	Shared topics
GDPR	Art.13	Information when data is collected from the data subject	privacy-notice
GLBA	Reg P 1016.4-1016.6	Initial and annual privacy notices	privacy-notice
NDPA 2023	s.27	Information to be provided to data subjects	privacy-notice
GDPR	Art.5(1)(a)	Lawfulness, fairness and transparency	privacy-notice
GDPR	Art.12	Transparent communication and handling of rights requests	privacy-notice
GDPR	Art.14	Information when data is not obtained from the data subject	privacy-notice
SOC 2	CC2.3	External communication	privacy-notice
SOC 2	P1.1	Notice and communication of privacy commitments	privacy-notice