--- title: "Art. 12 GDPR: Transparent information, communication and modalities for the exercise of the rights of the data subject" canonical: "https://dposchool.com/gdpr/article/12" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_12" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 12 GDPR · Chapter III: Rights of the data subject · Section 1: Transparency and modalities # Article 12 GDPR: Transparent information, communication and modalities for the exercise of the rights of the data subject Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) The controller must give information and communications to data subjects in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and must facilitate the exercise of their rights. It must act on a request without undue delay and in any event within one month, which may be extended by two further months where necessary; information and actions are free of charge, but for manifestly unfounded or excessive requests the controller may charge a reasonable fee or refuse to act. ## Official text ### Article 12(1) **1.** The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means. ### Article 12(2) **2.** The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject. ### Article 12(3) **3.** The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject. ### Article 12(4) **4.** If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. ### Article 12(5) **5.** Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: #### Article 12(5)(a) **(a)** charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or #### Article 12(5)(b) **(b)** refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. ### Article 12(6) **6.** Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. ### Article 12(7) **7.** The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing. Where the icons are presented electronically they shall be machine-readable. ### Article 12(8) **8.** The Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 12 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_12) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 58](https://dposchool.com/gdpr/recital/58) - [Recital 59](https://dposchool.com/gdpr/recital/59) ## Court of Justice judgments ### [C-526/24, Brillen Rottler GmbH & Co. KG v TC](https://dposchool.com/gdpr/case/c-526-24) Judgment of 19 March 2026 · ECLI:EU:C:2026:216 Even a first access request can be refused as excessive if the controller proves it was made with abusive intent, such as manufacturing a damages claim; a breach of the right of access can give rise to compensation, including for loss of control, if actual damage is shown. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-526/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0526) ### [C-757/22, Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V](https://dposchool.com/gdpr/case/c-757-22) Judgment of 11 July 2024 · ECLI:EU:C:2024:598 Consumer associations can bring representative actions for failures to inform users about purposes and recipients, because such failures are infringements 'as a result of the processing'. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-757/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0757) ### [C-307/22, FT v DW](https://dposchool.com/gdpr/case/c-307-22) Judgment of 26 October 2023 · ECLI:EU:C:2023:811 The first copy of one's data must be free even if the request has no data protection motive; national law cannot make patients pay for it; a patient is entitled to a full copy of medical records where needed to check accuracy. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-307/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0307) ### [C-154/21, RW v Österreichische Post AG](https://dposchool.com/gdpr/case/c-154-21) Judgment of 12 January 2023 · ECLI:EU:C:2023:3 The right of access includes the actual identity of recipients to whom data were disclosed, not just categories, unless they cannot be identified or the request is manifestly unfounded or excessive. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-154/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0154) ## EDPB guidance ### [Guidelines 01/2022 on data subject rights - Right of access](https://dposchool.com/gdpr/guidance/edpb-01-2022) EDPB 01/2022 · Final · First published 28 January 2022 · Final version 17 April 2023 Version 2.1 is final. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-012022-on-data-subject-rights-right-of-access_en) ### [Guidelines 03/2022 on deceptive design patterns in social media platform interfaces](https://dposchool.com/gdpr/guidance/edpb-03-2022) EDPB 03/2022 · Final · First published 21 March 2022 · Final version 24 February 2023 Version 1 was titled 'dark patterns'. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-032022-on-deceptive-design-patterns-in-social-media-platform_en) ### [Guidelines on transparency under Regulation 2016/679](https://dposchool.com/gdpr/guidance/wp260-rev-01) WP260 rev.01 · Final · First published 11 April 2018 · Endorsed by the EDPB 11 April 2018 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/article-29-working-party-guidelines-on-transparency-under-regulation-2016679_en) ## Fines Amounts are shown in the currency in which the fine was imposed. ### [Experian Nederland B.V.: EUR 2,700,000](https://dposchool.com/gdpr/fine/ap-experian-2025-10) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 16 October 2025 · Appeal status: not appealed Credit-scoring business used personal data from many sources without a valid legal basis and did not inform the people concerned. [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/actueel/experian-krijgt-boete-van-27-miljoen-euro-voor-privacyovertredingen) ### [Luka Inc.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-luka-replika-2025-04) Garante per la protezione dei dati personali, Italy · Decision of 10 April 2025 · Appeal status: unknown AI companion chatbot ran with no identified legal basis, an inadequate privacy policy and no effective age verification despite excluding minors. [Source: the authority](https://www.edpb.europa.eu/news/ai-the-italian-supervisory-authority-fines-company-behind-chatbot-replika_en) ### [Netflix International B.V.: EUR 4,750,000](https://dposchool.com/gdpr/fine/ap-netflix-2024-11) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 26 November 2024 · Appeal status: unknown Did not tell customers clearly enough, in its privacy statement and access replies, about purposes, legal bases, recipients, retention and transfers (2018 to 2020). [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/documents/fine-netflix) ### [Foodinho s.r.l.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-foodinho-2024-11) Garante per la protezione dei dati personali, Italy · Decision of 13 November 2024 · Appeal status: unknown Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10074601) ### [Clearview AI Inc.: EUR 30,500,000](https://dposchool.com/gdpr/fine/ap-clearview-2024-05) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 16 May 2024 · Appeal status: not appealed Built a facial recognition database of billions of photos, including of people in the Netherlands, without a legal basis, and did not inform people or answer access requests. [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/documents/decision-fine-clearview-ai) ### [Amazon France Logistique: EUR 32,000,000](https://dposchool.com/gdpr/fine/cnil-amazon-france-logistique-2023-12) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 27 December 2023 · Appeal status: reduced Warehouse employee monitoring: scanner-based productivity indicators kept in detail for 31 days, some judged to lack a legal basis, plus poor information to temporary staff and on CCTV, and weak security. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048989272) ### [Uber Technologies Inc. en Uber B.V.: EUR 10,000,000](https://dposchool.com/gdpr/fine/ap-uber-2023-12) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 11 December 2023 · Appeal status: under appeal Unclear to drivers on retention periods and transfers outside Europe, and made it hard for them to exercise access and portability rights. [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/documenten/boete-uber-privacyrechten) ### [EOS Matrix d.o.o.: EUR 5,470,000](https://dposchool.com/gdpr/fine/azop-eos-matrix-2023-10) Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Croatia · Announced on 5 October 2023 · Appeal status: unknown Debt collector could not protect or explain a leak from its main database, processed non-debtors' data and debtors' health data with no legal basis, and recorded calls without a legal basis or clear notice. [Source: the authority](https://azop.hr/agenciji-za-naplatu-potrazivanja-eos-matrix-d-o-o-izrecena-upravna-novcana-kazna-u-iznosu-od-547-milijuna-eura/) ### [TikTok Technology Limited: EUR 345,000,000](https://dposchool.com/gdpr/fine/dpc-tiktok-2023-09) Data Protection Commission (Ireland), Ireland · Decision of 1 September 2023 · Appeal status: under appeal Child users' accounts were public by default, 'Family Pairing' was weak, and children were not told clearly about the settings; the EDPB added a fairness ('dark patterns') finding. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-tiktok-technology-limited-september-2023) ### [CRITEO: EUR 40,000,000](https://dposchool.com/gdpr/fine/cnil-criteo-2023-06) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 15 June 2023 · Appeal status: unknown Ad-tech company could not show that the people whose browsing data it processed had consented, gave incomplete information, mishandled access, withdrawal and erasure requests, and lacked a proper joint-controller arrangement with partners. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063) ### [Spotify AB: SEK 58,000,000](https://dposchool.com/gdpr/fine/imy-spotify-2023-06) Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), Sweden · Decision of 12 June 2023 · Appeal status: upheld Gave users their data on request but did not explain clearly enough how it was used (purposes, categories, recipients, retention, sources, transfer safeguards). [Source: the authority](https://www.imy.se/tillsyner/spotify-ratten-till-tillgang/) ### [Meta Platforms Ireland Limited: EUR 210,000,000](https://dposchool.com/gdpr/fine/dpc-meta-facebook-2022-12) Data Protection Commission (Ireland), Ireland · Decision of 31 December 2022 · Appeal status: under appeal Facebook relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-december-2022) ### [Meta Platforms Ireland Limited: EUR 180,000,000](https://dposchool.com/gdpr/fine/dpc-meta-instagram-2022-12) Data Protection Commission (Ireland), Ireland · Decision of 31 December 2022 · Appeal status: under appeal Instagram relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-december-2022) ### [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/cnil-clearview-2022-10) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 17 October 2022 · Appeal status: unknown Facial-recognition firm scraped photos of people in France from the web with no legal basis, ignored access and erasure requests and did not cooperate with the CNIL; ordered to stop and delete, with a daily penalty. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046444859) ### [Meta Platforms Ireland Limited: EUR 405,000,000](https://dposchool.com/gdpr/fine/dpc-instagram-2022-09) Data Protection Commission (Ireland), Ireland · Decision of 2 September 2022 · Appeal status: under appeal Instagram let 13 to 17 year olds run business accounts that published their phone numbers or emails, and set child accounts to public by default. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-processing-personal-data-relating-child-users-instagram-social-networking-service) ### [Clearview AI, Inc: EUR 20,000,000](https://dposchool.com/gdpr/fine/hdpa-clearview-2022-07) Hellenic Data Protection Authority, Greece · Decision of 13 July 2022 · Appeal status: unknown Facial recognition company processed people's images in Greece unlawfully, without transparency, ignored an access request and had no EU representative. [Source: the authority](https://www.dpa.gr/en/en/enimerwtiko/prakseisArxis/imposition-fine-clearview-ai-inc) ### [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/garante-clearview-2022-02) Garante per la protezione dei dati personali, Italy · Decision of 10 February 2022 · Appeal status: unknown Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9751362) ### [IAB Europe: EUR 250,000](https://dposchool.com/gdpr/fine/apd-iab-europe-2022-02) Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium), Belgium · Decision of 2 February 2022 · Appeal status: upheld The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO. [Source: the authority](https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr) ### [Carrefour France: EUR 2,250,000](https://dposchool.com/gdpr/fine/cnil-carrefour-france-2020-11) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 18 November 2020 · Appeal status: unknown Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings. Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb\_aar\_2020\_final\_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042563756) ### [Google LLC: EUR 50,000,000](https://dposchool.com/gdpr/fine/cnil-google-2019-01) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 21 January 2019 · Appeal status: upheld Information on ad personalisation was scattered and unclear, and consent to it was not specific or informed (pre-ticked, bundled), so it gave no valid legal basis. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000038032552/) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter III](https://dposchool.com/gdpr/chapter/3) / Article 12 Previous: [Art. 11 GDPR: Processing which does not require identification](https://dposchool.com/gdpr/article/11) Next: [Art. 13 GDPR: Information to be provided where personal data are collected from the data subject](https://dposchool.com/gdpr/article/13) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents