Article 13

Information to be provided where personal data are collected from the data subject

Chapter 3 | Rights of the data subject | 📖 13 min read

1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

(a) the identity and the contact details of the controller and, where applicable, of the controller's representative;

(b) the contact details of the data protection officer, where applicable;

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

(d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

(e) the recipients or categories of recipients of the personal data, if any;

(f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:

(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

(b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;

(c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

(d) the right to lodge a complaint with a supervisory authority;

(e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;

(f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.

4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.

Understanding This Article

Article 13 establishes comprehensive transparency obligations for controllers when collecting personal data directly from data subjects. This article ensures individuals receive clear, upfront information about how their data will be processed at the moment of collection, enabling informed decision-making and trust in data processing activities.

Timing and Scope:

Article 13 applies when personal data is collected from the data subject - directly from the individual through forms, registrations, purchases, or interactions. This contrasts with Article 14, which applies when data is obtained from other sources. The information must be provided 'at the time when personal data are obtained' - before or at the moment of collection, not afterward. This timing ensures individuals can make informed choices about whether to proceed with providing their data.

Paragraph 1 - Essential Information:

This paragraph lists mandatory information that must be provided in all cases:

(a) Controller Identity: The name and contact details of the organization processing the data, plus the representative's details if applicable (required for non-EU controllers under Article 27). This ensures data subjects know who is responsible and how to contact them.

(b) Data Protection Officer: If the controller has appointed a DPO (mandatory for public authorities, large-scale monitoring, or large-scale special category processing), their contact details must be provided. DPOs serve as accessible points of contact for data protection inquiries.

(c) Purposes and Legal Basis: Controllers must explain why they're collecting the data (specific purposes) and the legal justification (which Article 6 basis: consent, contract, legal obligation, etc.). Both elements are crucial - data subjects need to understand both what their data will be used for and why the processing is lawful.

(d) Legitimate Interests: When relying on legitimate interests as the legal basis (Article 6(1)(f)), controllers must disclose the specific interests they or third parties are pursuing. This transparency enables data subjects to understand and potentially challenge the balancing assessment underlying legitimate interests processing.

(e) Recipients: If data will be shared, controllers must identify the recipients or at least describe their categories (e.g., 'marketing service providers,' 'payment processors'). This reveals the data's potential journey beyond the collecting controller.

(f) International Transfers: If data will be transferred outside the EU/EEA, controllers must inform data subjects and explain the safeguards in place: EU Commission adequacy decisions, standard contractual clauses (Article 46), binding corporate rules, or other mechanisms. Data subjects must know if their data is leaving the EU's protective framework and how it's protected abroad.

Paragraph 2 - Additional Fair Processing Information:

Beyond the essential information, paragraph 2 requires additional details necessary for fair and transparent processing:

(a) Retention Period: How long will the data be kept? If exact periods can't be specified, controllers must explain the criteria for determining retention (e.g., 'until you close your account plus 3 years for legal compliance purposes'). This addresses the storage limitation principle.

(b) Data Subject Rights: Inform individuals of their rights to access, rectification, erasure, restriction, objection, and data portability. Data subjects need to know what rights they have to effectively exercise them.

(c) Right to Withdraw Consent: When processing is based on consent (Article 6(1)(a) or Article 9(2)(a) for special categories), controllers must inform data subjects they can withdraw consent anytime without affecting the lawfulness of processing before withdrawal. This ensures consent remains freely given.

(d) Right to Complain: Data subjects must know they can lodge complaints with supervisory authorities if they believe their rights are violated. This information empowers enforcement.

(e) Mandatory/Voluntary Data Provision: Is providing the data legally or contractually required? Is it necessary to enter into a contract? What happens if data is not provided? For example, a job application might state: 'Providing your employment history is necessary for us to assess your application. If not provided, we cannot consider your application.' This transparency prevents individuals from assuming data provision is always optional.

(f) Automated Decision-Making: If automated decision-making including profiling occurs (Article 22), controllers must inform data subjects, explain the logic involved (in meaningful, understandable terms, not just technical algorithms), and describe the significance and consequences. For instance: 'We use automated credit scoring based on your income, credit history, and payment behavior. This determines your loan eligibility and interest rate.'

Paragraph 3 - Purpose Change Notification:

If controllers later decide to process data for a new purpose incompatible with the original purpose (see Article 6(4) for compatibility assessment), they must inform data subjects before beginning the new processing. The notification must include the new purpose and any relevant additional information from paragraph 2. This ensures ongoing transparency when processing evolves.

Paragraph 4 - Existing Information Exception:

Controllers don't need to provide information the data subject already has. This avoids redundancy - if individuals already received the information (e.g., in a previous interaction, from a third party who collected it initially), repeating it isn't necessary. However, controllers should be cautious: they bear the burden of demonstrating data subjects already have the information.

Practical Implementation:

Article 13 is typically satisfied through privacy notices, privacy policies, data collection forms, website banners, app permissions screens, and contract terms. The information must meet Article 12's requirements: concise, transparent, intelligible, easily accessible, and in plain language. Many organizations use layered approaches: brief, key information at collection points, with detailed policies available via links.

Relationship to Other Articles:

Article 13 works with Article 12 (modalities for communication), Article 14 (information when data not obtained from subject), Articles 15-22 (the substantive rights mentioned in transparency notices), and Article 5 (fairness and transparency principles). Together, these create a comprehensive transparency framework.

Key Points

Controllers must provide specific information to data subjects at the time personal data is collected directly from them
Information must include controller identity, processing purposes, legal basis, recipients, retention periods, and data subject rights
When relying on legitimate interests, controllers must disclose the specific legitimate interests pursued
Data subjects must be informed whether providing data is mandatory and the consequences of not providing it
If processing purposes change, data subjects must be informed before the new processing begins

Practical Application

Website Registration Form Example (Good): A website registration page includes, before the form: 'We collect your name and email to create your account and send you updates. Legal basis: contract performance. We share your data with our email service provider (Mailchimp). We keep your data as long as your account is active. You can access, correct, or delete your data anytime in account settings. You can complain to the [National DPA]. See our full Privacy Policy for details.' This provides essential Article 13 information concisely at collection.

Newsletter Signup (Consent-Based): A newsletter signup form states: 'Enter your email to receive our weekly newsletter about marketing trends. We'll use your email solely for this newsletter. Legal basis: your consent. You can unsubscribe anytime using the link in each email. Unsubscribing won't affect any previous newsletters we sent based on your prior consent. We keep your email until you unsubscribe, then delete it within 30 days.' This clearly explains consent-based processing with withdrawal rights.

E-commerce Checkout Example: During checkout, a notice states: 'We collect your name, address, payment details to fulfill your order. Legal basis: contract performance. We share your address with our shipping partner (DHL) and payment details with our payment processor (Stripe) to complete your order. We keep order data for 7 years for tax compliance. Providing this information is necessary to complete your purchase - we cannot ship your order without a delivery address.' This explains mandatory data provision and its consequences.

Job Application Form: An online job application includes: 'We collect your CV, education history, and work experience to assess your suitability for this position. Legal basis: entering into an employment contract. We share applications with the hiring manager and HR team. We retain applications for 6 months, then delete them unless you're hired (then we keep them as employment records). Providing this information is voluntary, but without it, we cannot consider your application. You can request access to or deletion of your application by contacting hr@company.com.' This clearly explains the voluntary nature and consequences.

Legitimate Interests Example: A retail store's website states: 'We process your browsing behavior (pages visited, time spent) to improve our website's user experience and functionality. Legal basis: our legitimate interest in understanding how customers use our site to optimize it. We don't use this data for marketing. You can object to this processing in your privacy settings.' This discloses the specific legitimate interest pursued.

Children's App Example: A children's game displays to children: 'This game saves your scores and favorite characters so you can continue playing later. We don't share your information with anyone. Your parents can see and delete this information. Ask your parent if you have questions!' And to parents: 'We collect gameplay data (level progress, character selection) to provide game functionality. Legal basis: legitimate interest in game operation. Data stored on device only. Retention: until app uninstalled. Parents can access/delete via Settings menu. For questions, contact privacy@gamecompany.com.' This provides age-appropriate information to both audiences.

Automated Decision-Making Disclosure: A credit card application states: 'We use automated credit scoring to assess your application. This considers your stated income, credit history from credit bureaus, and existing financial commitments. The score determines whether we approve your application and your credit limit. A low score may result in application denial or lower limits. You have the right to contest this decision, request human review, and receive an explanation.' This provides meaningful information about the logic, significance, and consequences.

International Transfer Notice: A cloud service provider discloses: 'Your data is stored on servers in the United States. The US doesn't have an EU adequacy decision. We protect your data through Standard Contractual Clauses approved by the EU Commission. You can obtain a copy of these clauses by contacting dpo@company.com.' This properly informs about international transfers and safeguards.

Purpose Change Notification: A fitness app initially collected health data for tracking workouts (disclosed at signup). Later, the app wants to use this data for personalized product recommendations. Before starting, the app notifies users: 'We'd like to use your workout data to recommend fitness products we think you'll like. This is a new use beyond workout tracking. You can opt-out in Settings without affecting your workout tracking features.' This complies with paragraph 3's purpose change notification requirement.

Layered Privacy Notice (Best Practice): At data collection, provide a first layer with key information (200-300 words covering purposes, legal basis, recipients, retention, rights). Include a prominent link to a second layer with comprehensive details satisfying all Article 13 requirements. This balances conciseness (Article 12 requirement) with completeness (Article 13 requirement).

Multi-Purpose Collection: A mobile app collects location data for two purposes: (1) showing nearby stores (contract performance), and (2) analyzing foot traffic patterns (legitimate interests). The privacy notice clearly separates these: 'We collect your location to (1) show you nearby stores when you search - necessary for this feature to work, and (2) understand general traffic patterns to plan store openings - our legitimate interest in business development. You can disable location access in phone settings, though this will prevent the store finder from working.' This distinguishes multiple purposes with different legal bases.

Violation Example - Insufficient Information: A website's privacy policy states only: 'We collect personal data to operate our business and comply with law. See full terms for details.' This fails Article 13 because it doesn't specify purposes, legal basis, recipients, retention, or rights. Generic statements don't satisfy transparency obligations.

Violation Example - Hidden Information: A website buries Article 13 information in a 20-page privacy policy linked in tiny text at the page bottom, never mentioning key points at the actual collection form. This violates Article 12's requirement for easily accessible, concise information and Article 13's timing requirement (information at the time of collection).

Violation Example - Unclear Legal Basis: A form states: 'We process your data in accordance with GDPR.' This doesn't specify which legal basis is being relied upon. Article 13(1)(c) requires explicitly stating the legal basis (consent, contract, legitimate interests, etc.).

Best Practice - Just-in-Time Notices: Provide Article 13 information contextually at the moment of each data collection. For example, when an app requests camera access, display a popup: 'We'll access your camera to let you take profile photos. These photos are stored on your device and our servers until you delete them or close your account. You can change this permission in phone settings anytime.' This contextual transparency is more effective than expecting users to remember information from a privacy policy they read during app installation.

Understanding This Article

Key Points

Practical Application

Related Recitals

Related Articles in Chapter 3

Popular Articles