Transparency and information duty

Under the General Data Protection Regulation, the information duty requires controllers to provide data subjects with transparent information about the processing of personal data. Where the data are collected directly from the data subject, Article 13 GDPR is the main provision. Where the data come from another source, Article 14 GDPR applies.

Depending on the situation, the information covers the controller’s identity and contact details, the purposes and legal bases of processing, recipients, intended transfers to third countries, and the storage period or the criteria used to determine it. It should also explain the relevant data subject rights, withdrawal of consent where applicable, the right to lodge a complaint and, where relevant, automated decision-making. If the data were obtained from another source, the categories of personal data and their source must also be stated.

The information must be concise, transparent, intelligible and easily accessible, using clear and plain language. For direct collection, it should generally be provided when the data are collected. If the data were not obtained from the data subject, the timing depends on the subsequent use and is generally no later than one month after the data were obtained. A single unchanged template therefore does not fit every processing operation.

Businesses should tailor each notice to the purpose, data flow, recipients and retention of the relevant process and keep material changes traceable. The section on compliance and privacy governance provides further context. Related terms include legal basis, personal data and consent.