Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to.
Try Cookiebot Free
Article 12
Transparent information, communication and modalities for the exercise of the rights of the data subject
Chapter 3|Rights of the data subject|📖 12 min read
1. The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.
2. The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject.
3. The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
4. If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.
6. Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.
7. The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing. Where the icons are presented electronically they shall be machine-readable.
8. The Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons.
Understanding This Article
Article 12 establishes the procedural framework and modalities for how controllers must communicate with data subjects about their rights and provide information under the GDPR. This article is fundamental to making data subject rights practical and enforceable, ensuring transparency is not merely theoretical but actionable.
Paragraph 1 - Clear and Accessible Communication:
The first paragraph sets high standards for how information must be provided. Communications must be: concise (brief and to the point, avoiding unnecessary length), transparent (open and honest about processing activities), intelligible (understandable to the intended audience), and easily accessible (not buried in complex documents or hard-to-find locations). The requirement for 'clear and plain language' rejects legalese and technical jargon that ordinary people cannot understand.
Special attention is given to children - information addressed to them must use age-appropriate language and presentation. This recognizes children's heightened vulnerability and need for tailored communication.
Information can be provided in writing (traditional letters, printed documents), electronically (emails, privacy dashboards, mobile apps), or orally when requested by the data subject (phone calls, in-person conversations), provided identity verification occurs through other means for oral communications. The flexibility allows controllers to use modern communication channels while ensuring accessibility.
Paragraph 2 - Facilitating Rights Exercise:
Controllers must actively facilitate data subject rights under Articles 15-22 (access, rectification, erasure, restriction, notification, portability, objection, and automated decision-making rights). 'Facilitate' means making the process easy, not creating unnecessary obstacles. This includes: providing clear instructions on how to exercise rights, offering multiple contact channels, avoiding complex identity verification procedures beyond what's necessary, and not requiring extensive information from data subjects before processing their requests.
The reference to Article 11(2) clarifies that controllers cannot refuse requests simply because they cannot identify the data subject - unless they can demonstrate genuine inability to identify. This prevents controllers from using non-identification as a blanket excuse to avoid responding to requests.
Paragraph 3 - Time Limits for Responding:
This paragraph establishes strict timeframes. Controllers must provide information on action taken 'without undue delay' and 'in any event within one month of receipt of the request.' The one-month period is mandatory, not merely a guideline. It can be extended by two additional months (total maximum: three months) only when necessary due to request complexity or volume.
If extending the deadline, controllers must inform data subjects within the initial one-month period, explaining the reasons for delay. This transparency requirement ensures data subjects aren't left wondering about request status.
Electronic requests should receive electronic responses unless the data subject requests otherwise. This promotes efficiency and environmental sustainability while respecting data subject preferences.
Paragraph 4 - Refusing Requests:
When controllers decide not to act on a request, they must inform the data subject without delay and within one month, explaining: (1) the reasons for not taking action, and (2) the right to lodge a complaint with a supervisory authority and seek judicial remedy. This ensures data subjects have recourse when disagreeing with refusals.
Controllers cannot simply ignore requests or provide vague rejections. They must justify refusals with specific reasons (e.g., 'the request is manifestly unfounded because...') and inform individuals of their enforcement options.
Paragraph 5 - Free of Charge Principle:
Information and actions must be provided free of charge as the default rule. This prevents controllers from monetizing or creating financial barriers to exercising fundamental rights. However, two exceptions allow controllers to charge reasonable fees or refuse requests that are 'manifestly unfounded or excessive,' particularly when repetitive.
'Manifestly unfounded' might include requests clearly made in bad faith or with no legitimate purpose. 'Excessive' typically refers to repetitive requests (same information requested multiple times within short periods) or requests requiring disproportionate effort (e.g., requesting manual review of thousands of hours of video footage without legitimate reason).
Critically, the burden of proof lies with the controller to demonstrate the request is manifestly unfounded or excessive. Controllers cannot arbitrarily label requests this way - they must provide evidence justifying the characterization.
Paragraph 6 - Identity Verification:
Controllers can request additional information to confirm requester identity when reasonable doubts exist. This prevents unauthorized disclosure of personal data to wrong individuals (a data breach). However, verification requirements must be proportionate - controllers cannot impose excessive identification hurdles that effectively prevent legitimate requests.
What's 'reasonable' depends on context: high-risk processing or sensitive data may justify stronger verification; low-risk processing should use minimal verification. Controllers should not request more identifying information than necessary for verification purposes.
Paragraph 7 - Standardised Icons:
Controllers may use standardized icons alongside textual information to provide visual, easily understandable overviews of processing. Icons must be: easily visible, intelligible, clearly legible, and machine-readable when electronic. This supports accessibility and quick comprehension, particularly useful for mobile interfaces or users with limited literacy.
Paragraph 8 - Commission Powers:
This empowers the European Commission to adopt delegated acts determining icon content and standardization procedures. As of now, the Commission has not exercised this power, so standardized icons remain optional and not formally defined, though some organizations have developed their own icon systems.
Practical Implications:
Article 12 transforms data subject rights from abstract concepts to practical, enforceable entitlements. It prevents controllers from technically complying with rights while making exercise practically impossible through complex processes, lengthy delays, or prohibitive costs. Supervisory authorities actively enforce these requirements, issuing fines for violations like: failing to respond within one month, using incomprehensible language, charging fees without justification, or creating unnecessary obstacles to rights exercise.
Key Points
Controllers must provide information and communications in a concise, transparent, intelligible, and easily accessible form using clear and plain language
Controllers must respond to data subject rights requests without undue delay, and within one month (extendable by two further months for complex requests)
Information and responses to requests must be provided free of charge unless requests are manifestly unfounded or excessive
Controllers must facilitate the exercise of data subject rights and cannot refuse requests unless unable to identify the requester
If refusing a request, controllers must inform data subjects of their right to complain to a supervisory authority and seek judicial remedy
Practical Application
Privacy Notice Example (Good): A mobile app provides a privacy notice in clear, concise language: 'We collect your location to show nearby stores. We share this with our mapping service provider. You can turn off location access in your phone settings anytime.' This is concise, transparent, intelligible, and accessible. Bad Example: A privacy notice states: 'Pursuant to applicable data protection regulations, the controller hereby notifies data subjects that geolocation data may be processed in accordance with legitimate interests as defined in Article 6(1)(f) GDPR for purposes including but not limited to enhancement of user experience...' This uses complex legal language failing the plain language requirement.
Children's Privacy Notice Example: A gaming app for children under 13 provides an age-appropriate privacy notice: 'This game collects information about how you play to make the game more fun. Your parents can see what information we collect and ask us to delete it. Ask your parents if you have questions!' This uses simple language and concepts children can understand.
Facilitating Rights Exercise (Good): A website includes a clearly labeled 'Your Privacy Rights' link in the footer, leading to a page with simple forms for access, deletion, and other requests. The forms require only basic information (email, name) with reasonable identity verification. Bad Example: A company requires data subjects to send notarized letters by postal mail, complete complex multi-page forms, and provide government ID copies for routine requests. This creates unnecessary barriers violating the facilitation requirement.
One-Month Response Example: On March 1st, a data subject emails an access request. The controller responds by March 28th with the requested information. This complies with the one-month deadline. Extension Example: A company receives 50 complex requests simultaneously. By March 28th, they email each requester: 'Due to the complexity and volume of requests received, we're extending our response deadline by two months to May 28th. We'll provide your information by then.' This complies with the extension rules.
Refusing a Request Example: A data subject requests erasure of data the controller processes under legal obligation (employment tax records). The controller responds within one month: 'We cannot erase your tax records because we're legally required to retain them for 7 years under tax law. You have the right to complain to the [Supervisory Authority name] or seek a judicial remedy if you disagree with this decision.' This properly explains the refusal reason and informs about recourse options.
Free of Charge Example: A data subject requests access to their personal data. The controller provides a comprehensive data export at no cost. Manifestly Excessive Example: The same data subject requests the same access report again two weeks later, then again one week after that, without any change in the underlying data or legitimate reason. On the fourth identical request within a month, the controller responds: 'We've provided this same information three times in the past month with no changes. This fourth request within 30 days is manifestly excessive under Article 12(5). We're charging a €25 administrative fee to process this request, or you may withdraw it.' The controller documents the previous requests as evidence justifying the fee.
Identity Verification Example (Proportionate): A data subject emails an access request from their registered email address. The controller responds to that same email with the information, using the email address itself as reasonable verification. Disproportionate Example: For the same request, the controller demands a notarized copy of government ID, utility bill, and in-person appearance at their office. This is disproportionate for a routine access request and violates the facilitation requirement.
Electronic Response Example: A data subject submits a request through an online form. The controller responds via email with a download link to the requested data, matching the electronic submission method. The data subject can still request a paper copy if preferred.
Standardised Icons Example: A privacy notice includes icons next to text: a sharing icon when describing data sharing, a clock icon when describing retention periods, and a location pin when describing geolocation processing. These visual cues help users quickly understand processing activities.
Multilayered Approach (Best Practice): A website implements a multilayered privacy notice: Layer 1 (brief overview with icons covering key points in one screen), Layer 2 (detailed explanations available via expandable sections), Layer 3 (full legal privacy policy for those wanting complete details). This approach provides concise, accessible information while still offering comprehensive details.
Automated Request Portal (Best Practice): A large organization creates a self-service privacy portal where data subjects can log in, view their data in real-time, download copies, request corrections, or submit deletion requests. Automated processing provides instant responses for straightforward requests, with human review for complex cases. Response times average 10 days, well within the one-month deadline.
Violation Example - Delayed Response: A controller receives an access request on January 1st but doesn't respond until April 15th (3.5 months later) without providing any extension notice or justification. This violates Article 12(3)'s one-month requirement and extension procedures. The supervisory authority could impose fines for the delay.
Violation Example - Unreasonable Fee: A data subject requests access to their data. The controller demands a €200 'administrative fee' without demonstrating the request is manifestly excessive or unfounded. This violates Article 12(5)'s free-of-charge principle. The controller cannot charge fees simply because processing requests requires effort - only when requests are genuinely manifestly excessive.
Best Practice - Proactive Communication: When processing changes significantly, a controller proactively notifies affected data subjects in clear language: 'We're updating how we use your data. Starting next month, we'll use your purchase history to recommend products. You can opt out in your account settings.' This exceeds minimum requirements but demonstrates respect for data subjects and builds trust.
Complex Request Handling: A data subject requests 'all data you have about me and everywhere you've shared it.' This is broad but legitimate. The controller responds within one month with: (1) personal data categories they hold, (2) recipients/categories of recipients, (3) offer to provide specific datasets if the subject clarifies which they want, and (4) explanation that gathering everything in one package would take additional time, proposing a two-month extension. This balances compliance with practicality.
Plain Language Best Practice: Instead of: 'Data retention periods are determined based on legitimate business requirements and applicable regulatory obligations,' write: 'We keep your data for as long as you have an account, then delete it after 3 years unless required to keep it longer by law.' The second version is concise, transparent, and uses plain language.