Articles 12, 13 & 14 GDPR : Transparency Principles and Information to Data Subjects

General Transparency and Accessibility Requirements (Art. 12 GDPR)

Article 12(1) requires the controller to take appropriate measures to provide any information and communication relating to processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

EDPB/WP29 Guidelines WP260 recommend a layered information approach to avoid information fatigue while ensuring immediate, seamless access to exhaustive details.

• Clear, plain and tailored language adapted to the target audience (in particular children);
• Provided in writing or by other means, including electronic means where appropriate;
• Free of charge as a matter of statutory principle for information and communications regarding rights.

Mandatory Legal Notice Content (Arts. 13 & 14 GDPR)

Privacy policies and collection forms must mandatorily state the following information:

• Identity and contact details of the controller and the Data Protection Officer (DPO) where applicable;
• Specific purposes of the processing and statutory legal basis (Art. 6 / 9);
• Legitimate interests pursued where processing is based on Article 6(1)(f);
• Recipients or categories of recipients of the personal data;
• Transfers of data to third countries outside the EEA and appropriate safeguards (SCCs, adequacy decisions);
• Storage retention periods or the criteria used to determine that period;
• Existence of all data subject rights (access, rectification, erasure, objection, restriction, portability) and the right to lodge a complaint with a supervisory authority (APD/GBA, CNIL, DPC).

Verified Official Sources

Associated Operational Micro-Tools

See Also in the Legal Framework