Art. 12 GDPR · Chapter III: Rights of the data subject · Section 1: Transparency and modalities
Article 12 GDPR: Transparent information, communication and modalities for the exercise of the rights of the data subject
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
The controller must give information and communications to data subjects in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and must facilitate the exercise of their rights. It must act on a request without undue delay and in any event within one month, which may be extended by two further months where necessary; information and actions are free of charge, but for manifestly unfounded or excessive requests the controller may charge a reasonable fee or refuse to act.
Official text
The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.
The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject.
The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:
charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or
refuse to act on the request.
The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.
Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.
The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing. Where the icons are presented electronically they shall be machine-readable.
The Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-526/24, Brillen Rottler GmbH & Co. KG v TC
Judgment of 19 March 2026ECLI:EU:C:2026:216
Even a first access request can be refused as excessive if the controller proves it was made with abusive intent, such as manufacturing a damages claim; a breach of the right of access can give rise to compensation, including for loss of control, if actual damage is shown.
- C-757/22, Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V
Judgment of 11 July 2024ECLI:EU:C:2024:598
Consumer associations can bring representative actions for failures to inform users about purposes and recipients, because such failures are infringements 'as a result of the processing'.
- C-307/22, FT v DW
Judgment of 26 October 2023ECLI:EU:C:2023:811
The first copy of one's data must be free even if the request has no data protection motive; national law cannot make patients pay for it; a patient is entitled to a full copy of medical records where needed to check accuracy.
- C-154/21, RW v Österreichische Post AG
Judgment of 12 January 2023ECLI:EU:C:2023:3
The right of access includes the actual identity of recipients to whom data were disclosed, not just categories, unless they cannot be identified or the request is manifestly unfounded or excessive.
EDPB guidance
- Guidelines 01/2022 on data subject rights - Right of access
EDPB 01/2022FinalFirst published 28 January 2022Final version 17 April 2023
Version 2.1 is final.
- Guidelines 03/2022 on deceptive design patterns in social media platform interfaces
EDPB 03/2022FinalFirst published 21 March 2022Final version 24 February 2023
Version 1 was titled 'dark patterns'.
- Guidelines on transparency under Regulation 2016/679
WP260 rev.01FinalFirst published 11 April 2018Endorsed by the EDPB 11 April 2018
Fines
Amounts are shown in the currency in which the fine was imposed.
- Experian Nederland B.V.: EUR 2,700,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 16 October 2025Appeal status: not appealed
Credit-scoring business used personal data from many sources without a valid legal basis and did not inform the people concerned.
- Luka Inc.: EUR 5,000,000
Garante per la protezione dei dati personali, ItalyDecision of 10 April 2025Appeal status: unknown
AI companion chatbot ran with no identified legal basis, an inadequate privacy policy and no effective age verification despite excluding minors.
- Netflix International B.V.: EUR 4,750,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 26 November 2024Appeal status: unknown
Did not tell customers clearly enough, in its privacy statement and access replies, about purposes, legal bases, recipients, retention and transfers (2018 to 2020).
- Foodinho s.r.l.: EUR 5,000,000
Garante per la protezione dei dati personali, ItalyDecision of 13 November 2024Appeal status: unknown
Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data.
- Clearview AI Inc.: EUR 30,500,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 16 May 2024Appeal status: not appealed
Built a facial recognition database of billions of photos, including of people in the Netherlands, without a legal basis, and did not inform people or answer access requests.
- Amazon France Logistique: EUR 32,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 27 December 2023Appeal status: reduced
Warehouse employee monitoring: scanner-based productivity indicators kept in detail for 31 days, some judged to lack a legal basis, plus poor information to temporary staff and on CCTV, and weak security.
- Uber Technologies Inc. en Uber B.V.: EUR 10,000,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 11 December 2023Appeal status: under appeal
Unclear to drivers on retention periods and transfers outside Europe, and made it hard for them to exercise access and portability rights.
- EOS Matrix d.o.o.: EUR 5,470,000
Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), CroatiaAnnounced on 5 October 2023Appeal status: unknown
Debt collector could not protect or explain a leak from its main database, processed non-debtors' data and debtors' health data with no legal basis, and recorded calls without a legal basis or clear notice.
- TikTok Technology Limited: EUR 345,000,000
Data Protection Commission (Ireland), IrelandDecision of 1 September 2023Appeal status: under appeal
Child users' accounts were public by default, 'Family Pairing' was weak, and children were not told clearly about the settings; the EDPB added a fairness ('dark patterns') finding.
- CRITEO: EUR 40,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 15 June 2023Appeal status: unknown
Ad-tech company could not show that the people whose browsing data it processed had consented, gave incomplete information, mishandled access, withdrawal and erasure requests, and lacked a proper joint-controller arrangement with partners.
- Spotify AB: SEK 58,000,000
Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), SwedenDecision of 12 June 2023Appeal status: upheld
Gave users their data on request but did not explain clearly enough how it was used (purposes, categories, recipients, retention, sources, transfer safeguards).
- Meta Platforms Ireland Limited: EUR 210,000,000
Data Protection Commission (Ireland), IrelandDecision of 31 December 2022Appeal status: under appeal
Facebook relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases.
- Meta Platforms Ireland Limited: EUR 180,000,000
Data Protection Commission (Ireland), IrelandDecision of 31 December 2022Appeal status: under appeal
Instagram relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases.
- Clearview AI: EUR 20,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 17 October 2022Appeal status: unknown
Facial-recognition firm scraped photos of people in France from the web with no legal basis, ignored access and erasure requests and did not cooperate with the CNIL; ordered to stop and delete, with a daily penalty.
- Meta Platforms Ireland Limited: EUR 405,000,000
Data Protection Commission (Ireland), IrelandDecision of 2 September 2022Appeal status: under appeal
Instagram let 13 to 17 year olds run business accounts that published their phone numbers or emails, and set child accounts to public by default.
- Clearview AI, Inc: EUR 20,000,000
Hellenic Data Protection Authority, GreeceDecision of 13 July 2022Appeal status: unknown
Facial recognition company processed people's images in Greece unlawfully, without transparency, ignored an access request and had no EU representative.
- Clearview AI: EUR 20,000,000
Garante per la protezione dei dati personali, ItalyDecision of 10 February 2022Appeal status: unknown
Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it.
- IAB Europe: EUR 250,000
Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium), BelgiumDecision of 2 February 2022Appeal status: upheld
The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO.
- Carrefour France: EUR 2,250,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 18 November 2020Appeal status: unknown
Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings.
Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb_aar_2020_final_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both.
- Google LLC: EUR 50,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 21 January 2019Appeal status: upheld
Information on ad personalisation was scattered and unclear, and consent to it was not specific or informed (pre-ticked, bundled), so it gave no valid legal basis.