Art. 13 GDPR – Information to be provided where personal data are collected from the data subject
- Key Facts
- The 12 Mandatory Notice Items at a Glance
- Article 13 vs Article 14: Which Applies?
- What Typically Breaks a Compliant Article 13 Notice
- GDPR Article 13 Fines: Enforcement Cases and Amounts
- Recitals That Explain Article 13
- Article 13 Compliance Checklist
- Frequently Asked Questions about Article 13
- Related Key Issues and Articles
| Art. 13(1)(a) | The identity and contact details of the controller and, where applicable, its representative. | controller identity |
| Art. 13(1)(b) | The contact details of the data protection officer, where applicable. | DPO contact |
| Art. 13(1)(c) | The purposes of the processing for which the personal data are intended, as well as the legal basis for the processing. | purposes & legal basis |
| Art. 13(1)(d) | Where processing rests on Art. 6(1)(f), the legitimate interests pursued by the controller or a third party. | legitimate interests |
| Art. 13(1)(e) | The recipients or categories of recipients of the personal data, if any. | recipients |
| Art. 13(1)(f) | Where applicable, the intention to transfer data to a third country, whether an adequacy decision exists, and, absent one, the safeguard relied on and how to obtain a copy of it. | international transfers |
| Art. 13(2)(a) | The storage period, or the criteria used to determine it. | storage period |
| Art. 13(2)(b) | The existence of the rights to access, rectification, erasure, restriction, objection, and data portability. | data subject rights |
| Art. 13(2)(c) | Where processing rests on consent, the right to withdraw it at any time. | right to withdraw consent |
| Art. 13(2)(d) | The right to lodge a complaint with a supervisory authority. | complaint right |
| Art. 13(2)(e) | Whether providing the data is a statutory or contractual requirement, and the consequences of not providing it. | mandatory & consequences |
| Art. 13(2)(f) | The existence of automated decision-making, including profiling under Art. 22, and meaningful information about its logic, significance and envisaged consequences. | automated decision-making |
| Art. 13(3) | Where the controller intends to further process the data for a purpose other than the one it was collected for, it must give the data subject information on that other purpose before the further processing begins. | further processing |
| Art. 13(4) | Paragraphs 1 to 3 do not apply where and insofar as the data subject already has the information. | exception |
Article 13 is the checklist for the moment a controller collects data straight from the person it concerns. It does not decide whether the processing is lawful; that is Article 6‘s job. It decides whether the person was told enough, at the right time, in the right form, to understand what is happening to their data and to act on it.
In practice, most fines under this article are not about a missing privacy policy. Uber and Netflix both had one. The failures were narrower and more specific: no concrete retention period, no named recipients where the controller could have named them, no explanation of the safeguard used for a transfer outside the EEA. A privacy policy that exists but stays vague on these points is the pattern regulators keep finding.
Key Facts
| Chapter | Chapter 3 – Rights of the data subject (Art. 12–23) |
|---|---|
| Applies to | Every controller collecting personal data directly from the data subject. Where the data comes from somewhere else, Art. 14 applies instead |
| Maximum fine | €20.000.000 or 4% of worldwide annual turnover, whichever is higher, since Art. 13 sits among the data subject’s rights under Art. 12–22 (Art. 83(5)(b)) |
| In force since | 25 May 2018 |
| Explained by recitals | 60, 61, 62 |
| Depends on | Art. 5(1)(a) for the fairness and transparency principle, Art. 12 for how the information must be presented |
| Companion provision | Art. 14 imposes the equivalent duty, with more exceptions, where data was not collected from the data subject |
| Closest UK equivalent | UK GDPR Art. 13, identical wording |
The 12 Mandatory Notice Items at a Glance
Article 13 has no single list of “the” requirements; they run across two paragraphs. Laid out together, there are twelve of them.
| # | Item | What it requires | Provision |
|---|---|---|---|
| 1 | Controller identity | Name and contact details of the controller and, where applicable, its representative | Art. 13(1)(a) |
| 2 | DPO contact | Contact details of the data protection officer, where one has been appointed | Art. 13(1)(b) |
| 3 | Purposes & legal basis | Each purpose of processing, paired with the specific legal basis relied on for it | Art. 13(1)(c) |
| 4 | Legitimate interests | Where relied on under Art. 6(1)(f), the specific interest pursued by the controller or a third party | Art. 13(1)(d) |
| 5 | Recipients | The recipients, or categories of recipients, who receive the data | Art. 13(1)(e) |
| 6 | International transfers | Any intended transfer outside the EEA, the adequacy status, and the safeguard relied on absent one | Art. 13(1)(f) |
| 7 | Storage period | A concrete retention period, or the criteria used to determine one | Art. 13(2)(a) |
| 8 | Data subject rights | The existence of the rights to access, rectification, erasure, restriction, objection and portability | Art. 13(2)(b) |
| 9 | Right to withdraw consent | Where consent is the basis, that it can be withdrawn at any time | Art. 13(2)(c) |
| 10 | Complaint right | The right to lodge a complaint with a supervisory authority | Art. 13(2)(d) |
| 11 | Mandatory or voluntary | Whether providing the data is a statutory or contractual requirement, and the consequence of refusing | Art. 13(2)(e) |
| 12 | Automated decision-making | The existence of profiling or automated decisions under Art. 22, with meaningful information on the logic and consequences | Art. 13(2)(f) |
Article 13 vs Article 14: Which Applies?
| Article 13 | Article 14 | |
|---|---|---|
| Triggered by | Data collected directly from the data subject | Data obtained from a source other than the data subject |
| Content required | The 12 items above | Largely the same 12 items, plus the categories of personal data concerned and the source it came from |
| Timing | At the time of collection | Within a reasonable period, at the latest one month, or at first communication or disclosure if sooner |
| Exceptions | One: the data subject already has the information (Art. 13(4)) | Several, including where notice proves impossible or would involve disproportionate effort, or where a Union or Member State law expressly provides for the data’s collection or disclosure |
In practice, most controllers need both: Article 13 for data a customer submits directly, Article 14 for anything appended later from a third-party source, such as an enrichment or credit-reference provider.
How Article 12 interacts with Article 13. Article 13 sets what has to be said; Article 12 sets how. A controller may satisfy Article 13’s content requirement in full and still fail if the notice is not presented in a layered, accessible way: a short first layer covering the most important points, with the complete detail available at a click, rather than one dense page or, worse, information scattered across several linked documents a user has to hunt for. The Uber and Netflix findings above cited failures under both articles for exactly this reason.
What Typically Breaks a Compliant Article 13 Notice
Most Article 13 findings are not about missing a privacy policy altogether. They are about specific, checkable gaps inside one that otherwise looks complete.
| Requirement | What typically breaks it | Governing provision |
|---|---|---|
| Purposes tied to a legal basis | Purposes are listed in general terms without stating which legal basis supports which purpose, so the reader cannot tell what specific data feeds what specific use | Art. 13(1)(c), Recital 60 |
| Recipients | Only categories are named (“advertising partners”, “service providers”) when the controller knows the actual, limited set of recipients and could name them | Art. 13(1)(e) |
| International transfers | A generic statement that data “may be transferred outside the EEA” without naming the safeguard relied on or how to get a copy of it | Art. 13(1)(f) |
| Storage period | No retention period and no criteria for determining one, just silence on the point | Art. 13(2)(a) |
| Rights and complaint route | Rights are listed but the practical mechanism to exercise them is buried several menus deep or is otherwise disproportionately hard to use | Art. 13(2)(b), Art. 12(2) |
| Timing | Information about a new processing purpose is given after the fact rather than before the further processing starts | Art. 13(3), Recital 61 |
GDPR Article 13 Fines: Enforcement Cases and Amounts
Both Dutch decisions below rest on express Article 13 findings, cited paragraph by paragraph. Google is listed because it is routinely cited in Article 13 discussions; its operative findings sat across several articles and it is documented at its own source below the table.
| Organisation | Authority | Decision date | Fine |
|---|---|---|---|
| Uber B.V. / Uber Technologies Inc. | Autoriteit Persoonsgegevens (Netherlands) | 11 Dec 2023 | €10.000.000 |
| Netflix International B.V. | Autoriteit Persoonsgegevens (Netherlands) | 18 Dec 2024 | €4.750.000 |
| Google LLC | CNIL (France) | 21 Jan 2019 | €50.000.000 |
The Google LLC decision, upheld by the Conseil d’État on 19 June 2020, found insufficiently accessible and clear information among its grounds alongside Article 6 and Article 12, rather than resting on Article 13 alone, which is why it sits outside the two case studies below. It remains the leading European statement that scattering the required information across many linked documents defeats the transparency purpose Article 13 exists to serve.
All Article 13 enforcement cases →
Recitals That Explain Article 13
Grounds the notice duty in the fairness and transparency principle: the person has to be told the processing exists and what it is for, told about any profiling and its consequences, and, where the data comes from them directly, told whether providing it is mandatory and what happens if they refuse. It allows the information to be paired with standardised, machine-readable icons for a quick overview.
Fixes when the notice is due: at collection, or within a reasonable period if the data came from elsewhere. If data is later passed to a new recipient, the person should be told at that point. If the controller later wants to use the data for a different purpose, it has to give notice of that purpose before the further processing starts. Where several sources were used and the exact origin cannot be traced item by item, general information about the sources is enough.
Narrows the duty rather than removing it: no notice is needed where the person already has the information, where the law itself requires the recording or disclosure, or where giving notice is impossible or a disproportionate effort. That last exception is aimed particularly at archiving, scientific, historical or statistical processing, weighed against how many people are affected, how old the data is, and what safeguards are in place.
Article 13 Compliance Checklist
Most of the gaps in the cases above trace back to the same thing: a privacy notice written once and never rechecked against what the business actually collects. Keeping the notice tied to a live data inventory, rather than a document someone updates when they remember, is the underlying fix. Secure Privacy’s platform is built around that kind of ongoing sync.