Art. 13 GDPR · Chapter III: Rights of the data subject · Section 2: Information and access to personal data
Article 13 GDPR: Information to be provided where personal data are collected from the data subject
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
When personal data are collected from the data subject, the controller must, at the time of collection, tell the data subject the information listed in the article, such as its identity, the purposes and legal basis, the recipients, any transfers, the retention period and the data subject's rights.
Official text
Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:
the identity and the contact details of the controller and, where applicable, of the controller's representative;
the contact details of the data protection officer, where applicable;
the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;
the recipients or categories of recipients of the personal data, if any;
where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.
In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:
the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
the right to lodge a complaint with a supervisory authority;
whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;
the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.
Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-422/24, Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik
Judgment of 18 December 2025ECLI:EU:C:2025:980
Data recorded by body cameras worn by ticket inspectors are collected from the data subject, so information must be given under Art. 13, not Art. 14.
- C-757/22, Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V
Judgment of 11 July 2024ECLI:EU:C:2024:598
Consumer associations can bring representative actions for failures to inform users about purposes and recipients, because such failures are infringements 'as a result of the processing'.
Related (earlier law or other instruments)
- C-413/23 P, European Data Protection Supervisor v Single Resolution Board
Judgment of 4 September 2025ECLI:EU:C:2025:645
Instrument: Regulation (EU) 2018/1725 (EU institutions; definitions mirror the GDPR)
On appeal, the Court held that pseudonymised data are not necessarily personal data for every recipient, but that the controller's duty to inform people about recipients is judged from the controller's own position at the time of collection; it set aside the General Court's judgment and sent part of the case back.
- C-40/17, Fashion ID GmbH & Co.KG v Verbraucherzentrale NRW eV
Judgment of 29 July 2019ECLI:EU:C:2019:629
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
A website that embeds a social plugin is a joint controller with the plugin provider for collecting and sending visitors' data, but only for that stage; each must pursue a legitimate interest, and the site must obtain any consent and give information for the stage it controls.
EDPB guidance
- Guidelines 3/2019 on processing of personal data through video devices
EDPB 03/2019FinalFirst published 12 July 2019Final version 30 January 2020
- Guidelines on transparency under Regulation 2016/679
WP260 rev.01FinalFirst published 11 April 2018Endorsed by the EDPB 11 April 2018
Fines
Amounts are shown in the currency in which the fine was imposed.
- IQVIA Solutions Italy S.r.l: EUR 7,000,000
Garante per la protezione dei dati personali, ItalyDecision of 23 September 2026Appeal status: unknown
Health-analytics firm treated a database of about one million GP patients as anonymous when a persistent identifier made them re-identifiable; no legal basis, no information, no DPIA, weak retention and security.
- TikTok Technology Limited: EUR 530,000,000
Data Protection Commission (Ireland), IrelandDecision of 30 April 2025Appeal status: under appeal
Allowed staff in China to access EEA users' data without showing equivalent protection, and did not tell users about these transfers.
- Luka Inc.: EUR 5,000,000
Garante per la protezione dei dati personali, ItalyDecision of 10 April 2025Appeal status: unknown
AI companion chatbot ran with no identified legal basis, an inadequate privacy policy and no effective age verification despite excluding minors.
- Netflix International B.V.: EUR 4,750,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 26 November 2024Appeal status: unknown
Did not tell customers clearly enough, in its privacy statement and access replies, about purposes, legal bases, recipients, retention and transfers (2018 to 2020).
- Posti: EUR 2,400,000
Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman, Finland), FinlandDecision of 13 November 2024Appeal status: unknown
Automatically opened an OmaPosti electronic mailbox for customers, tied to other services, with a pre-ticked box and without clear information.
Not fully confirmed: Confirmed on the EDPB news page. Fine for Art. 5 and 6(1); reprimand and order for Art. 13; instruction on Art. 25. Company name given only as 'Posti'.
- Foodinho s.r.l.: EUR 5,000,000
Garante per la protezione dei dati personali, ItalyDecision of 13 November 2024Appeal status: unknown
Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data.
- LinkedIn Ireland Unlimited Company: EUR 310,000,000
Data Protection Commission (Ireland), IrelandDecision of 22 October 2024Appeal status: under appeal
Processed members' data for behavioural analysis and targeted advertising without a valid legal basis, and without fair and clear information.
- Avast Software s.r.o.: CZK 351,000,000
Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Czech RepublicDecision of 10 April 2024Appeal status: upheld
Antivirus maker passed pseudonymised browsing histories of about 100 million users to a sister company that sold insights to marketers, while telling users the data was anonymous and used only for statistics.
- Amazon France Logistique: EUR 32,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 27 December 2023Appeal status: reduced
Warehouse employee monitoring: scanner-based productivity indicators kept in detail for 31 days, some judged to lack a legal basis, plus poor information to temporary staff and on CCTV, and weak security.
- Uber Technologies Inc. en Uber B.V.: EUR 10,000,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 11 December 2023Appeal status: under appeal
Unclear to drivers on retention periods and transfers outside Europe, and made it hard for them to exercise access and portability rights.
- EOS Matrix d.o.o.: EUR 5,470,000
Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), CroatiaAnnounced on 5 October 2023Appeal status: unknown
Debt collector could not protect or explain a leak from its main database, processed non-debtors' data and debtors' health data with no legal basis, and recorded calls without a legal basis or clear notice.
- TikTok Technology Limited: EUR 345,000,000
Data Protection Commission (Ireland), IrelandDecision of 1 September 2023Appeal status: under appeal
Child users' accounts were public by default, 'Family Pairing' was weak, and children were not told clearly about the settings; the EDPB added a fairness ('dark patterns') finding.
- CRITEO: EUR 40,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 15 June 2023Appeal status: unknown
Ad-tech company could not show that the people whose browsing data it processed had consented, gave incomplete information, mishandled access, withdrawal and erasure requests, and lacked a proper joint-controller arrangement with partners.
- Meta Platforms Ireland Limited: EUR 210,000,000
Data Protection Commission (Ireland), IrelandDecision of 31 December 2022Appeal status: under appeal
Facebook relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases.
- Meta Platforms Ireland Limited: EUR 180,000,000
Data Protection Commission (Ireland), IrelandDecision of 31 December 2022Appeal status: under appeal
Instagram relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases.
- Clearview AI: EUR 20,000,000
Garante per la protezione dei dati personali, ItalyDecision of 10 February 2022Appeal status: unknown
Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it.
- IAB Europe: EUR 250,000
Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium), BelgiumDecision of 2 February 2022Appeal status: upheld
The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO.
- WhatsApp Ireland Ltd: EUR 225,000,000
Data Protection Commission (Ireland), IrelandDecision of 20 August 2021Appeal status: under appeal
Did not tell users and non-users clearly enough how their data was processed, including sharing with other group companies.
Not fully confirmed: The DPC summary page tags only Articles 5 and 13 (no sub-paragraphs); the full decision also covers other transparency articles. Fine raised after EDPB binding decision 1/2021. DPC fines table: Pending Appeal.
- Deliveroo Italy s.r.l.: EUR 2,500,000
Garante per la protezione dei dati personali, ItalyDecision of 22 July 2021Appeal status: unknown
Food-delivery platform managed about 8,000 riders through opaque algorithms (booking and work allocation), collected excessive data including location, and lacked a DPIA and proper records.
- CAIXABANK, S.A.: EUR 6,000,000
Agencia Española de Protección de Datos (AEPD), SpainDecision of 7 January 2021Appeal status: unknown
Bank relied on invalid consent and its privacy information was unclear when it profiled customers and shared data across its group for commercial purposes.
Not fully confirmed: Operative part of resolution PS/00477/2019 read: EUR 2,000,000 for Articles 13 and 14 and EUR 4,000,000 for Article 6; a charge under Article 22 was dismissed. The resolution text carries no visible date; 7 January 2021 comes from a later AEPD document.
- Carrefour France: EUR 2,250,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 18 November 2020Appeal status: unknown
Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings.
Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb_aar_2020_final_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both.
- Google LLC: EUR 50,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 21 January 2019Appeal status: upheld
Information on ad personalisation was scattered and unclear, and consent to it was not specific or informed (pre-ticked, bundled), so it gave no valid legal basis.