GDPR Article 13 requires a controller to provide information when it obtains personal data from the person concerned. The notice must explain the relevant processing clearly and at the right time. Some information depends on the circumstances: a DPO’s contact details are required where applicable, for example, and consent withdrawal matters where consent is the basis used. There is no universal set of fourteen statements that every notice must reproduce unchanged.
This guide explains how to apply Article 13 to forms, observed data, applications and ordinary customer interactions. It distinguishes the legal information requirements from practical ways of presenting them. References were checked on 30 September 2026. The aim is a notice that people can understand and an organisation can keep accurate as its processing changes.
Decide whether the data comes from the person
Direct collection includes information a person deliberately supplies, such as an application form or support message. It also includes information obtained by observing that person, for example through a camera or a device recording their interactions. The transparency guidelines endorsed by the EDPB explain this distinction. “Direct” does not mean that the person must have typed every data item into a box.
Where information comes from another controller, a broker, public sources or another individual, examine Article 14 on indirectly collected data. Its requirements include information about the source and categories of data, together with different timing rules and exceptions. Source-of-data information is not a separate universal Article 13 item that should be copied into every direct-collection checklist.
A process can involve both situations. An applicant may provide a CV directly while a recruiter obtains additional information from a referee. Assess the relevant collection and later processing rather than choosing one article for the entire organisation. A combined notice can be useful if it clearly distinguishes the activities, information sources and rules that apply to each.
Provide information when collection happens
Article 13 requires the information at the time the data is obtained. A notice sent only after an online form has been submitted will not normally meet that timing requirement for the collection already completed. Place the information or an effective route to it where the person encounters the collection, rather than assuming that a general footer link will always be sufficient.
Map the actual sequence. A website may record interactions before a visitor presses “submit”; an application may transmit identifiers before the first account screen; a telephone service may record a conversation before the customer provides their name. The relevant moment follows the processing, not a convenient business milestone. Align information with each material operation and check any separate rules governing its lawfulness.
Do not import Article 14’s one-month outer limit into direct collection. For indirect collection, that limit can be brought forward by the first communication with the person or disclosure to another recipient, under the conditions in Article 14(3). The different deadlines reflect different collection situations. They are not alternatives that a controller can freely select for the same operation.
Identify the controller and the appropriate contacts
Article 13(1)(a) requires the controller’s identity and contact details, and those of its representative where applicable. Use the legal entity responsible for the processing, not only a product or trading name. A group website should explain which entity is involved where the answer differs by service. A reader should not have to infer responsibility from a list of unrelated group companies.
The representative requirement is conditional. An entity outside the EU does not automatically have a representative in every situation; the applicable rules must be checked. Likewise, Article 13(1)(b) requires DPO contact details where applicable. A business without a designated DPO should not invent one or describe a general customer-support contact as holding that statutory role.
Test the contact route you publish. Someone must receive and recognise a privacy enquiry and route it appropriately. A technically valid email address that nobody monitors does not provide a useful way to exercise rights. If several contact options are offered, explain their purpose clearly while avoiding unnecessary obstacles for a person who uses an appropriate alternative channel.
Connect each purpose with its lawful basis
Describe what the organisation actually does with the data. Account administration, fraud prevention, advertising and service development may involve different operations and legal reasoning. Phrases such as “business purposes” or “improving your experience” can conceal important distinctions. A reader should be able to understand the intended use and relate it to the information being collected.
Article 13(1)© requires the purposes and legal basis. The Article 6 lawful-basis guide helps identify the relevant grounds. A notice should not list every possible basis without explaining which supports the activity. Nor should it imply that an operation is necessary for a contract merely because it benefits the business offering that contract.
Where Article 6(1)(f) is relied upon, Article 13(1)(d) also requires the legitimate interests pursued by the controller or a third party. Identify the interest concretely, such as protecting a specified service against fraud, and describe the actual processing. Publishing a notice does not replace the necessity and balancing assessment or turn an otherwise unlawful use into a lawful one.
Explain recipients and transfers meaningfully
Article 13(1)(e) refers to recipients or categories of recipients, where applicable. It does not universally require every recipient to be named in the notice. However, categories must communicate something useful. A statement that data may be shared with “partners” can leave the person unable to understand whether this means a payment provider, a delivery company or an advertising business.
Describe disclosures in relation to the activity. A supplier receiving information solely to host the service plays a different role from another company using it for its own purposes. The notice should reflect that distinction without overwhelming the person with internal procurement terminology. Check the description against the actual recipients and keep it consistent with contracts and technical access arrangements.
For intended transfers to a third country or international organisation, Article 13(1)(f) requires the relevant information about adequacy or applicable safeguards and how to obtain a copy or access them. Do not simply state that all transfers are “GDPR compliant”. Identify the mechanism that actually applies and provide a usable route to the relevant information, taking appropriate confidentiality protections into account.
Make retention understandable
Article 13(2)(a) calls for the storage period or, where that is not possible, the criteria used to determine it. “For as long as necessary” rarely explains the decision by itself. Identify the event that starts or ends a period and distinguish categories where their purposes differ. The data retention policy guide helps connect those explanations to an operational schedule.
For example, a customer account may close while some transaction records remain necessary for a legal obligation. Explain the difference rather than promise that every item disappears immediately or imply that all account information will be kept for the longest applicable period. Restricted retention for a specific purpose should not be described as continued unrestricted use of the whole customer profile.
Check the systems against the notice. A clear period is misleading if exports, attachments or support archives are retained indefinitely without assessment. Conversely, avoid selecting a period simply because a template contains it. The published statement needs a documented basis and an owner who can tell the organisation when the underlying retention arrangements have changed.
Describe rights without promising outcomes in every case
Article 13(2)(b) requires information about the relevant rights to request access, rectification, erasure or restriction, to object and to portability. Explain how a person can act and make the route accessible. Rights have their own conditions and limits; avoid promising that every request must produce immediate deletion of every record or that portability covers every inference the organisation has generated.
The right of access guide explains the distinct response process. A privacy notice is not an access response and does not contain all of an individual’s personal data. Equally, supplying a generic policy when someone has requested their data will not normally discharge the access obligation. Staff need to recognise which task is being performed.
Include the right to complain to a supervisory authority under Article 13(2)(d). Do not suggest that using your internal complaint process removes that right. The contact and procedural information should be relevant to the audience and applicable framework. A notice intended for several countries may need an accessible explanation rather than automatically referring every person to one national authority without context.
Separate information from consent
Where processing rests on consent under Article 6(1)(a) or explicit consent under Article 9(2)(a), Article 13(2)© requires information about withdrawal at any time and its lack of effect on the lawfulness of processing before withdrawal. Explain the practical withdrawal route. The withdrawal mechanism must meet the GDPR’s requirements independently of whether the notice describes it accurately.
Reading or acknowledging a notice is not the same as consenting to all the processing described in it. Avoid a compulsory box that merges account terms, privacy information and optional marketing into a single acceptance. The consent wording examples can support a separate consent exercise where that basis is appropriate, with wording adapted to the actual purposes and choices.
Similarly, updating a notice does not automatically create a new lawful basis. If the organisation wants to introduce a new optional use requiring consent, assess that requirement directly. It cannot rely on a sentence stating that continued use of the service means acceptance of every future change. Transparency and lawfulness must both be addressed in the proposed operation.
Explain required data and automated decisions
Article 13(2)(e) addresses whether providing data is a statutory or contractual requirement, or necessary to enter a contract, whether the person is obliged to provide it and the possible consequences of not doing so. Make this concrete at the collection point. A label marking every field “mandatory” does not explain why an optional commercial preference is needed to deliver a service.
Article 13(2)(f) concerns the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4). At least in those cases, meaningful information about the logic involved, significance and envisaged consequences is required. Do not describe every automated calculation as an Article 22 decision, or omit a consequential automated decision because the organisation calls it a recommendation.
Explain the process in language the intended audience can use: what information matters, how it influences the outcome and what the decision means for the person. An unexplained technical label or generic statement that “an algorithm may be used” is unhelpful. The transparency assessment must be consistent with the actual decision process and the applicable safeguards, including any genuine human involvement.
Use layers to improve access, not to hide information
The Article 12 transparency requirements govern how information is provided: concise, intelligible, easily accessible and in clear language. A layered approach can help organise detailed material. The endorsed guidelines recommend that the first layer cover the controller, purposes, rights and information about particularly significant or unexpected effects, with a clear route to the remaining detail.
This is not a universal statutory “one-click” rule. The requirement is effective access in the real context. Nested pages that make a person search repeatedly for essential information may fail it, even if each page has a privacy heading. Conversely, a coherent arrangement combining contextual explanations and an accessible complete notice can be more useful than placing every legal detail into a small form.
Check that the layers agree. A first layer promising that data will never be shared cannot be repaired by a later section describing extensive disclosures. The short explanation must remain accurate on its own terms. Present the information that could most affect the person where it will be noticed, rather than relying on the least visible part of the document.
Adapt the notice to the collection channel
A paper form, a telephone interaction and a mobile app require different presentation choices. A QR code can provide access to detail, but it should not be the only practical route for people who cannot use it. A telephone service can combine an initial explanation with other accessible means. The organisation remains responsible for providing the necessary information at the appropriate time.
For an app, examine what happens before installation, during first use and when a new feature begins collecting data. The endorsed guidance recommends making relevant app information available before download and keeping it easily accessible afterwards. An operating-system permission prompt addresses a technical choice; it should not be assumed to supply all the information Article 13 requires about the controller’s processing.
Cookies and similar technologies also involve separate electronic-communications requirements. A privacy notice does not itself establish valid consent where consent is required. The French CNIL cookie-banner guide is a country-specific resource in French; organisations elsewhere must examine their applicable national rules. Keep those requirements distinct from the wider explanation of personal-data processing.
Handle new purposes and information already supplied
Under Article 13(3), planned further processing for another purpose requires information about that purpose and relevant additional paragraph 2 information before the further processing starts. This does not authorise an incompatible new use. The lawful basis and any purpose-compatibility requirements must be assessed separately. A notice update records part of that process rather than replacing the substantive legal decision.
Article 13(4) applies only where and insofar as the person already has the information. Record what was provided, when, how and whether it is still accurate. A returning customer may already know the controller’s identity while needing information about a new purpose or recipient. General awareness that a company collects data does not establish possession of the specific information required.
Do not import Article 14’s disproportionate-effort exception into Article 13. Any applicable legislative restriction also requires its own assessment under the GDPR framework; a controller cannot invent one because providing information is inconvenient. The wider guide to GDPR information notices helps organise the notice while preserving the distinction between direct and indirect collection.
Keep evidence of an accurate, usable notice
Maintain the approved text, its effective date and the collection points where it appears. When a material change occurs, record how it was communicated and why that method and timing were appropriate. Merely changing a date at the bottom of a page does not show that existing users learned about a significant new use. Corrections of spelling and changes to processing need different treatment.
Finally, review the notice against a sample of real operations and ask intended readers to explain its main points. Can they identify the controller, understand the purpose, find retention information and exercise a right? Keep the findings and address gaps. That process produces stronger evidence of transparency than counting headings or assuming that a generated document is compliant because it mentions Article 13.