A single international notice should therefore avoid pretending that one law applies everywhere. It should explain the common data journey first. It should then identify the rules that apply in each country.
A medico-legal instruction may contain medical records, psychiatric history, medication details, employment information and litigation material.
That information can pass between lawyers, reporting organisations, experts, insurers and technology suppliers. Each organisation should understand its role before describing the process.
Start With the Information Everyone Needs.
Whatever the jurisdiction, people should understand who holds their information and why.
The notice should identify the organisation and provide suitable contact details. It should describe the information collected and explain where that information comes from.
The notice should also explain why the organisation uses the information. This may include assessments, record reviews, reports, appointments and complaints.
People should understand who may receive their information. Recipients may include lawyers, experts, insurers, administrators and relevant technology suppliers.
Retention also needs a meaningful explanation. The organisation should state the retention period or explain how it decides that period.
Cloud platforms may store or access information outside the organisation’s home country. The notice should explain relevant overseas disclosures or transfers.
These elements provide the common foundation. The terminology and legal requirements then change by area.
United Kingdom: UK GDPR and the ICO.
The UK version should reflect the UK GDPR and wider domestic data protection rules.
The ICO says individuals have a right to information about the collection and use of personal data. Organisations should explain purposes, retention periods and recipients.
The notice should identify the controller and provide appropriate contact details.
Medical information falls within special category data. Organisations must consider their general lawful basis and an appropriate special category condition.
Medico-legal organisations should not assume that consent always provides the correct basis. The appropriate basis depends on the activity and organisation.
Information may also arrive from another source, such as a solicitor or Medical Reporting Organisation. ICO guidance requires privacy information within one month.
The UK notice should explain individual rights and the right to complain to the ICO.
The Data (Use and Access) Act 2025 changed parts of the framework. The ICO is reviewing some detailed guidance following those changes.
South Africa: POPIA Changes the Language.
A South African version should use POPIA terminology rather than UK GDPR terminology.
POPIA uses “responsible party” where UK organisations might use “controller”. It also uses “operator” for certain processing performed for another organisation.
Section 18 requires reasonable steps to inform data subjects when personal information is collected. This includes information about indirect collection sources.
A medico-legal notice should explain identity, purposes, sources, recipients and relevant cross-border processing.
Health information needs particular attention because POPIA regulates special personal information.
The organisation should identify its Information Officer where appropriate. The Information Regulator confirms that Information Officers oversee compliance and data subject requests.
The notice should explain complaint routes, including the Information Regulator.
Simply replacing “UK GDPR” with “POPIA” will not produce an accurate notice. The concepts and terminology require their own drafting.
United States: HIPAA Is Not Universal.
A medico-legal organisation should not state that HIPAA covers every organisation handling medical information. It does not.
HHS says HIPAA applies to health plans, healthcare clearinghouses and certain healthcare providers. Certain requirements also apply to their business associates.
HHS requires most covered entities to explain permitted uses and disclosures of protected health information. They must also explain rights, duties, complaints and contact information.
HHS updated its model notices in February 2026. The revised models include information concerning certain substance use disorder records.
Business associates do not automatically need their own HIPAA Notice of Privacy Practices. Their duties differ from those of covered entities.
State privacy and health laws may also require state-specific additions.
The US section should first establish whether HIPAA applies. It should then consider other relevant federal and state rules.
Australia: Privacy Act and Australian Privacy Principles.
An Australian version should reflect the Privacy Act 1988 and Australian Privacy Principles where they apply.
APP 5 requires covered entities to take reasonable steps when collecting personal information. They must notify individuals of specified matters or ensure awareness.
Those matters include identity, collection circumstances, purposes and usual disclosures. They also include overseas disclosures and relevant countries where practicable.
Health information receives additional protection under Australia’s privacy framework. Healthcare providers should consider collection notices carefully when handling sensitive medical information.
OAIC guidance shows that a general privacy policy may not provide enough detail for a particular collection. Context-specific notices can therefore matter.
State and territory health privacy laws may add obligations in some locations. Organisations should check whether those rules apply.
One Core Notice, Four Legal Layers.
An international provider does not necessarily need four completely unrelated privacy documents.
It can create one common framework covering the actual data journey. Country-specific sections can then explain the law, terminology, rights and regulator.
That approach reduces duplication without suggesting that the legal rules are identical.
The core notice should explain what information enters the organisation and why. It should identify recipients, technology providers, retention practices and international data movements.
The district section then provides the legal layer.
For the UK, who means the UK GDPR framework and ICO. South Africa requires POPIA and Information Regulator terminology.
The United States requires a HIPAA assessment before using HIPAA language. Australia requires attention to the Privacy Act and Australian Privacy Principles.
The strongest international notice does not copy one country’s wording across four websites.
It keeps the data journey consistent while changing the legal explanation wherever the law changes.
