GDPR Article 12 turns individual rights into a communication process that people can actually use. A privacy notice must be understandable, a request must reach someone who can act, and the answer must arrive within the applicable deadline. A complete legal analysis achieves little if the person receives an unexplained export or cannot get past an identity check.
This guide addresses the EU GDPR as checked on 28 September 2026. It focuses on how to communicate and handle requests. The substantive conditions for access, erasure, portability and other rights remain separate: Article 12 does not make every request automatically successful, but it governs how the controller facilitates, assesses and explains the outcome.
What Article 12 covers
Article 12(1) concerns information under Articles 13 and 14 and communications under Articles 15 to 22 and 34. Those include collection notices, answers to individual rights requests and communications about high-risk personal-data breaches. It requires concise, transparent, intelligible and easily accessible information in clear and plain language, particularly where information is addressed to a child. These are practical standards, not a prescribed maximum word count.
The remaining paragraphs deal with facilitating rights, response timing, reasons for not acting, charges, identity verification and standardised icons. Read them alongside the relevant right and the transparency principle in Article 5. The official GDPR text provides the binding requirements; the EDPB’s transparency guidance explains their application to real communications.
Article 12 does not require every commercial email to repeat a complete privacy notice. It does require the specified information and rights communications to meet its standard. A service message that introduces a new processing purpose may therefore require a carefully timed explanation even though an ordinary appointment reminder does not need the whole notice attached.
Make the notice answer the reader’s questions
A useful notice tells a person who uses their data, for what purposes, on which bases, with whom it is shared and how long it is kept. The content comes from Articles 13 or 14; Article 12 governs its presentation. The guide to GDPR information notices can help assemble the required content without turning the notice into a list of disconnected statutory references.
Terms such as legitimate interests and international transfers need context. Explain the interest actually pursued and the processing it supports. If a transfer relies on standard contractual clauses, identify the relevant safeguards and explain how the person can obtain information about them. Naming a legal mechanism without connecting it to the person’s data does not make the explanation useful.
Layering can reconcile concision with completeness. A short first layer can highlight the controller, main purposes, significant or unexpected effects and where to find the rest. Detailed information must remain easy to reach. Hiding a material disclosure behind several unrelated settings pages defeats that purpose. A layered notice also needs consistent wording: the summary cannot promise that information stays inside the organisation while the detail describes external advertising use.
The appropriate language depends on the intended audience. Technical terms may be familiar to specialist customers but obscure to patients, applicants or children. Test the explanation against a concrete decision: could the person understand why a document is requested and what happens if they decline an optional use? This is a recommended editorial check, not a statutory readability score.
Accept requests without unnecessary formalities
People do not have to cite the GDPR, use a lawyer or complete the controller’s preferred form to exercise a right. Staff should recognise requests from their substance. A message asking for a copy of account notes may be an access request; an instruction to stop advertising messages may exercise the right to object. Train staff to forward them promptly through a defined internal route.
A dedicated address or portal can help, but should facilitate rather than obstruct. The EDPB’s final Guidelines 01/2022 on access distinguish appropriate official channels from addresses a person could not reasonably expect to handle rights requests. Controllers should not treat every message anywhere as a formal request, nor insist that a clear request received through a normal customer channel be resubmitted from scratch.
At intake, record receipt, the request itself, the relevant account and the likely rights involved. A single message can contain several requests with different substantive tests. For example, someone may seek access, dispute accuracy and object to marketing. Assigning one case owner helps coordination, while separate decisions avoid incorrectly treating the entire message as a request for deletion.
An acknowledgement is useful because it confirms receipt and explains the next step. It does not fulfil the request by itself. Avoid asking people to provide the same details repeatedly merely because different departments use separate systems. The controller remains responsible for making the internal handover work.
Calculate one calendar month accurately
Article 12(3) requires information on action taken without undue delay and in any event within one month of receiving a request under Articles 15 to 22. A calendar month is not invariably 30 days. The EDPB applies the EU rules for periods and deadlines: a request received on 5 March ordinarily has an outer deadline of 5 April; if received on 31 August, the corresponding deadline is 30 September. A deadline falling on a weekend or public holiday moves to the next working day under that calculation.
The outer deadline is not permission to delay an answer that can reasonably be provided sooner. Nor does the clock normally start only when the privacy team opens the message. The EDPB identifies receipt through an official channel as the relevant starting point for access requests, subject to applicable rules on receipt. A shared inbox left unattended is an organisational problem, not a fresh deadline.
An extension of up to two further months is possible where necessary, taking account of the complexity and number of requests. The person must be told about the extension and its reasons within the initial month. Explain the actual difficulty, such as reviewing intertwined records to protect other people, rather than sending an automatic statement that all requests take three months. Routine workload should be reflected in normal staffing and processes.
Clarification requires particular care. The EDPB recognises that timing may be suspended for prompt, necessary identity clarification, and for asking someone to specify processing under the conditions in Recital 63. This is not a general pause whenever the controller asks any question. For access, a broad request for all data remains meaningful; asking the person to narrow it must not become a way to avoid responding when they want the full scope. Record why any suspension applies and calculate the remaining period consistently.
Verify identity in proportion to the risk
Article 12(6) permits additional information necessary to confirm identity when the controller has reasonable doubts. Begin with information and authentication methods already available. A person signed into an appropriately secured account may be identifiable without sending a passport. Conversely, an email claiming to represent an employee might need further checking before sensitive employment records are released.
The verification method should reflect both the risk of wrongful disclosure and the burden placed on the requester. A familiar email address is not proof against account compromise, but neither does every request justify a full identity-document copy. Explain which uncertainty needs resolving and why the requested evidence addresses it. Where a document is necessary, identify fields that can be obscured and avoid retaining excess information after the verification purpose ends.
A photograph on a document is not automatically special-category biometric data. That classification depends on the relevant technical processing and purpose of uniquely identifying someone. The simpler operational point is that the controller should not collect document fields or images it does not need. The same principle applies to representatives: confirm authority and scope without assuming that every representative needs a notarised mandate.
Article 11 also matters where the controller is genuinely unable to identify the person. The GDPR does not require acquiring extra identifying information solely to comply with the Regulation. But the controller must be able to demonstrate that it cannot identify the requester, and should consider additional information the person supplies that enables identification. This is a specific route, not an excuse for poorly organised records.
Produce an answer suited to the right
For access under Article 15, distinguish the copy of personal data from the accompanying information about processing. A generic privacy notice is not a substitute for the individual’s actual data. An unexplained export full of internal codes may also need a glossary or contextual explanation so the data can be understood. Protecting another person’s information may require proportionate redaction rather than withholding the whole response.
An erasure request requires a decision under Article 17. Explain what was erased and, where applicable, which data remain for a specific exception and purpose. Avoid saying that all data must be retained merely because one invoice has a statutory retention period. If restriction is relevant, explain how the data are separated from ordinary use and direct the person to the outcome of their restriction request.
For portability, the applicable conditions and format differ from ordinary access. Article 20 requires a structured, commonly used and machine-readable format for the data within its scope. A readable PDF that works for some access responses may therefore be inadequate for portability. Do not label every download button a complete implementation of both rights.
An objection to processing likewise needs a purpose-specific answer. Direct-marketing objections end processing for that marketing purpose; objections to certain other processing require the Article 21 assessment. The response should explain the decision the organisation actually made, including how it affects future communications, instead of merely confirming that the request was logged.
Use a format the person can access safely
Article 12(1) permits written information and other means, including electronic means where appropriate. If the person requests oral information, it may be provided when identity is proven by other means. This does not require turning every rights process into a telephone service, but it does prevent assuming that an electronic form is the only legally possible route.
Where a request is made electronically, Article 12(3) says the information should be provided electronically where possible unless the person requests otherwise. The method must still protect confidentiality. A secure download can be appropriate, provided access does not depend on purchasing software or opening an account that the person cannot reasonably use. Explain expiry dates and offer a workable way to retrieve the answer if technical access fails.
Before release, check the recipient, attachments and redactions. A response to one person must not accidentally include another customer’s file. If an answer uses tables or codes, give enough explanation to connect entries with their meaning. The objective is intelligibility of the actual response, not merely sending a large volume of material that satisfies an internal completion metric.
Charges and refusals require evidence
Information under Articles 13 and 14, communications and actions under Articles 15 to 22 and 34 are generally free under Article 12(5). Where requests are manifestly unfounded or excessive, particularly because of repetition, the controller may charge a reasonable fee reflecting administrative costs or refuse to act. The controller bears the burden of demonstrating the grounds. Dissatisfaction, an ongoing dispute or inconvenience does not by itself meet that threshold.
Repetition should be assessed in context. A second access request may cover newly created data or follow an incomplete answer. Before refusing, check what changed and what was previously provided. A fee should reflect the permitted administrative costs, not serve as a deterrent or a source of profit. Keep the evidence supporting the conclusion, including why a less restrictive response would not resolve the issue.
There is also a distinct rule in Article 15(3): a reasonable administrative-cost fee may apply to further copies requested by the person. That rule should not be confused with charging for an initial access response because the data are extensive. The existence of one charging provision does not erase the conditions of the other.
If the controller does not act on a request, Article 12(4) requires reasons without delay and at the latest within one month of receipt, together with information about a supervisory-authority complaint and a judicial remedy. A refusal can also concern only part of a request. Explain the withheld part sufficiently to make the outcome understandable, while respecting any legally protected information. Article 14’s exceptions to indirect-collection notices are not general grounds for refusing all individual rights.
Build accountability into the handover
A workable case record contains the request, receipt date, assigned owner, searches or actions undertaken, necessary identity checks, any justified extension and the final response. Retain enough to demonstrate handling, with a defined purpose and retention rule. The GDPR does not set a universal five-year period for all request files, and retaining full identity documents indefinitely can create a new problem.
Controllers should identify which suppliers must assist them and how assistance is requested. Staff leave and systems change, so the procedure needs substitute owners and a way to reach archived records. Review a small selection of completed cases for missed departments, unclear answers and unnecessary identity demands. This is a practical quality method rather than a legally prescribed audit frequency.
Article 12(7) allows standardised icons alongside information to give a meaningful overview; electronically presented icons must be machine-readable. Paragraph 8 empowers the Commission to adopt delegated acts about them. Icons can support an explanation, but a symbol alone cannot replace required information that the person needs to understand the processing.
Frequently asked questions
Does Article 12 give us 30 days?
It provides one month, with the relevant EU calculation rules. The duty to act without undue delay also applies. Necessary extensions, limited suspensions and the reasons for them need individual assessment; they are not automatic additions to every request.
Can we require our form or a passport?
A form can help collect useful details, but should not exclude a clear request through an appropriate channel. Additional identity evidence is permitted where reasonable doubts justify it and the information is necessary. Use the least intrusive method that adequately resolves those doubts.
Must we grant every request without charge?
Each right has its own conditions and exceptions. Article 12 generally requires free handling, with narrowly defined fee or refusal grounds for manifestly unfounded or excessive requests; Article 15 separately addresses further copies. A negative or partial outcome still requires a timely, reasoned response and remedy information.
Readers working with French materials can also consult the French guide to access requests. The language bridge does not change the EU procedural rules explained here.