Article 12 — Information to Be Provided to the Data Subject — shared requirements from Articles 12, 13 and 14

Legal Provision

Information to be provided to the data subject: establishes the specific information that must communicated to the data subject, distinguishing whether data are directly collected from the data subject or from other sources

Scope

Applies to the entities determining the purposes and means of the processing: data controllers.

Requirement type

Duty: when collection personal data, the data controller shall provide certain information to the data subject.

Actions to demonstrate compliance

A. Binary (yes/no)

• If the personal data have been directly collected from the data subject, information has been provided in a separate information sheet, contract, or privacy notice.
• If information has not been directly collected from the data subject, the organisation has an available privacy policy.

B. Non-binary (require a contextual assessment)

• Review whether the information provided is simple, clear and adapted to the target audience.
• Layered or dynamic notice formats to improve understandability.
• Internal justifications when omitting certain disclosures based on exceptions.
• Log of any changes in the nature of the information and notify the data subjects of these changes.
• Clear and accessible information covering legal bases, retention periods, data processed, and if profiling or automated decisions are used, clearly explain its logic and effects.

Monitoring requirement

• Verification that the information is accurate and up to date.
• Regular audits on the effectiveness of the means for the provision of information.
• Visibility and timing of privacy notices
• Testing clarity with users or collect feedback from information sheets (or privacy policies).

Consequences of non-compliance

• Fines up to €10 million or 2% of global turnover.
• Legal claims for damages by individuals.
• Suspension or deletion of data processing.
• Reputational damage and loss of public trust.
• Supervisory authorities can conduct investigative, corrective and advisory powers.