Information obligations require controllers to inform data subjects about the processing of their personal data. The relevant legal requirements arise in particular from Articles 12 to 14 of the General Data Protection Regulation (GDPR). Companies must explain which personal data they process, for what purposes, on what legal basis and what rights data subjects have. The scope and timing of the information depend in particular on whether the data is collected directly from the data subject or obtained from other sources.
What are information obligations under the GDPR?
Information obligations are intended to ensure transparency in the processing of personal data. They inform data subjects about how their personal data is processed and what data protection rights they have.
Articles 13 and 14 GDPR specify the information that controllers must provide when collecting personal data. These obligations generally apply regardless of the legal basis on which the processing is carried out. Even lawful processing without consent does not therefore exempt companies from their statutory information obligations.
Article 12 GDPR additionally sets out the requirements governing the form in which the information must be provided.
Information obligations must be distinguished from the right of access under Article 15 GDPR. While controllers are generally required to provide the information under Articles 13 and 14 GDPR proactively, the right of access usually requires a corresponding request from the data subject.
What is the difference between Articles 13 and 14 GDPR?
The GDPR distinguishes between these provisions according to the source from which the controller obtains the personal data.
Information obligations under Article 13 GDPR
Article 13 GDPR applies where personal data is collected directly from the data subject.
This is the case, for example, when a customer enters their contact details in an order form or an applicant submits their application documents directly to a company.
As a general rule, the controller must provide the required information at the time the personal data is collected. Under Article 13(4) GDPR, the controller is not required to provide the information again if the data subject already has the relevant information.
Information obligations under Article 14 GDPR
Article 14 GDPR applies where personal data is not collected directly from the data subject but is obtained, for example, from a business partner or a public register.
Specific deadlines apply to the provision of this information. As a general rule, the controller must provide it within a reasonable period and, at the latest, within one month of obtaining the data.
If the controller intends to communicate with the data subject, the information must be provided no later than the time of the first communication. If disclosure to another recipient is intended, the information must be provided no later than the time of the first disclosure. These deadlines also apply if the one-month period has not yet expired.
Article 14(5) GDPR sets out statutory exceptions to these obligations.
What information must companies provide?
Articles 13 and 14 GDPR specify the information that data subjects must receive. The specific information obligations depend on the processing activity in question.
The key information includes:
- Controller: The name and contact details of the controller and, where applicable, its representative.
- Data protection officer: The contact details of the data protection officer, if one has been appointed.
- Purposes and legal bases of processing: An explanation of why personal data is processed and on what legal basis.
- Legitimate interests: Details of the legitimate interests pursued where processing is based on Article 6(1)(f) GDPR.
- Recipients: Information about the recipients or categories of recipients of personal data, where applicable.
- Transfers to third countries: The required information about intended transfers to third countries or international organisations.
- Retention period: The intended retention period or the criteria used to determine it.
- Data subject rights: Information about rights including access, rectification, erasure, restriction of processing and, where applicable, data portability and the right to object.
- Withdrawal of consent and complaints: Information about the right to withdraw consent where processing is based on consent, as well as the right to lodge a complaint with a supervisory authority.
- Automated decision-making: The required information about automated decision-making, including profiling, insofar as it falls within the scope of Article 22 GDPR.
Where data is collected directly from the data subject, the controller must also provide the information required under Article 13(2)(e) GDPR about whether the provision of personal data is a statutory or contractual requirement, whether the data subject is obliged to provide the data, and the possible consequences of failing to do so.
Where data is collected indirectly, controllers must additionally provide, in particular, information about the categories of personal data concerned and their source. Where applicable, this includes stating whether the data originated from publicly accessible sources.
All information required under Article 13 or Article 14 GDPR in the circumstances of the particular case must be provided.
How must the information be provided?
Under Article 12(1) GDPR, controllers must provide information in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
The presentation must be appropriate to the intended audience. Information specifically addressed to children requires language that is particularly easy to understand.
In practice, information is often provided through privacy notices on websites, in online forms, when contracts are concluded or as part of recruitment procedures.
The information may be provided in writing or by other means, including electronic means where appropriate. What matters is that data subjects can access and understand it in good time and without unnecessary difficulty.
A layered approach to presenting information is permitted. In this approach, the most important information is presented clearly at the outset and supplemented by more detailed privacy information. All information required by law must remain accessible.
Under Article 12(5) GDPR, the information must generally be provided free of charge.
When do exceptions to information obligations apply?
The GDPR provides for certain exceptions and restrictions. These differ depending on whether Article 13 or Article 14 GDPR applies.
Where personal data is collected directly from the data subject, the information obligation under Article 13(4) GDPR does not apply insofar as the data subject already has the relevant information.
Where personal data is collected indirectly, Article 14(5) GDPR provides for further exceptions.
These include, in particular, the following circumstances:
- The data subject already has the required information.
- Providing the information is impossible or would involve disproportionate effort, provided that the statutory requirements are met.
- The obtaining or disclosure of the data is expressly regulated by applicable legislation and appropriate safeguards are provided for.
- The personal data must remain confidential as a result of a statutory obligation of professional secrecy.
If a controller relies on the exception based on impossibility or disproportionate effort under Article 14(5)(b) GDPR, it must take appropriate measures to protect the rights and freedoms and legitimate interests of the data subjects. These measures include, in particular, making the information publicly available.
The exceptions are subject to the relevant statutory requirements. Mere additional organisational effort does not automatically justify dispensing with the information.
In addition, Article 23 GDPR provides for statutory restrictions on information obligations under certain conditions.
Controllers must assess whether an exception actually applies and be able to demonstrate compliance with data protection requirements.
Practical example: Information obligations when placing an online order
An online retailer collects a customer's name, delivery address, email address and the information required to process payment during the ordering process.
As the data is collected directly from the customer, the information obligations under Article 13 GDPR apply.
The online retailer provides easily accessible privacy information during the ordering process. This explains, in particular, the purposes and legal bases of processing, the recipients of the data, the retention period and the customer's rights.
Providing the information only after the order has been completed is generally too late, unless the customer has already received the required information beforehand.
legal data assessment: Information obligations are an essential element of transparent data processing. For each processing activity, companies must assess what information is required under Article 13 or 14 GDPR and when it must be provided. Complete, intelligible and easily accessible privacy information is essential. It must reflect the actual data processing activities and be updated whenever they change.
Legal bases
Article 5(1)(a) GDPR; Articles 12 to 15 GDPR; Article 23 GDPR; Article 58 GDPR; Articles 82 and 83 GDPR; Recitals 39 and 58 to 62 GDPR.
Frequently asked questions about information obligations
When must companies provide information about data processing?
Where personal data is collected directly from the data subject, the information must generally be provided at the time of collection. Where data is collected indirectly, the deadlines set out in Article 14(3) GDPR apply.
What is the difference between an information obligation and the right of access?
Information obligations under Articles 13 and 14 GDPR generally apply without the data subject having to make a prior request. By contrast, the right of access under Article 15 GDPR enables data subjects to request information about the processing of their personal data.
Is a privacy notice on a website sufficient?
A privacy notice on a website fulfils the information obligations only if it contains all the required information and is made available to data subjects in good time and in an easily accessible manner in the relevant processing context. Merely referring to a privacy notice that is difficult to find is not sufficient.
Must data subjects be informed again if the purpose of processing changes?
If a controller intends to further process personal data for a different purpose, it must generally inform the data subject of the new purpose and provide the other required information before that further processing takes place, in accordance with Article 13(3) or Article 14(4) GDPR.
What are the consequences of breaching information obligations?
Breaches of information obligations may result in supervisory measures under Article 58 GDPR and administrative fines under Article 83 GDPR. In particular, the supervisory authority may order the controller to fulfil its statutory information obligations. Data subjects may also be entitled to compensation under Article 82 GDPR, provided that the relevant requirements are met.
Related terms.
Collection of personal data The collection of personal data refers to obtaining information relating to an identified or identifiable natural person. It is a form of processing within the meaning of Article 4(2) of the General Data Protection Regulation (GDPR). Organisations may only collect personal data where an appropriate legal basis exists and the data protection principles are observed. The principles of purpose limitation and data minimisation, as well as the information obligations towards data subjects, are particularly important in this regard. Right of access The right of access under Article 15 GDPR enables data subjects to find out whether and which personal data concerning them is being processed by a company or public authority. In particular, it covers information about the purposes of processing, the categories of personal data, the recipients and the storage period. In addition, data subjects generally have the right to obtain a copy of the personal data being processed. The right of access serves to ensure transparency and enables data subjects to verify the lawfulness of data processing. 