---
title: "Art. 13 GDPR: Information to be provided where personal data are collected from the data subject"
canonical: "https://dposchool.com/gdpr/article/13"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_13"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 13 GDPR · Chapter III: Rights of the data subject · Section 2: Information and access to personal data

# Article 13 GDPR: Information to be provided where personal data are collected from the data subject

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Summary (not the official text)

When personal data are collected from the data subject, the controller must, at the time of collection, tell the data subject the information listed in the article, such as its identity, the purposes and legal basis, the recipients, any transfers, the retention period and the data subject's rights.

## Official text

### Article 13(1)

**1.** Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

#### Article 13(1)(a)

**(a)** the identity and the contact details of the controller and, where applicable, of the controller's representative;

#### Article 13(1)(b)

**(b)** the contact details of the data protection officer, where applicable;

#### Article 13(1)(c)

**(c)** the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

#### Article 13(1)(d)

**(d)** where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

#### Article 13(1)(e)

**(e)** the recipients or categories of recipients of the personal data, if any;

#### Article 13(1)(f)

**(f)** where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

### Article 13(2)

**2.** In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:

#### Article 13(2)(a)

**(a)** the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

#### Article 13(2)(b)

**(b)** the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;

#### Article 13(2)(c)

**(c)** where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

#### Article 13(2)(d)

**(d)** the right to lodge a complaint with a supervisory authority;

#### Article 13(2)(e)

**(e)** whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;

#### Article 13(2)(f)

**(f)** the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

### Article 13(3)

**3.** Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.

### Article 13(4)

**4.** Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 13 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_13)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 60](https://dposchool.com/gdpr/recital/60)
- [Recital 61](https://dposchool.com/gdpr/recital/61)

## Court of Justice judgments

### [C-422/24, Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik](https://dposchool.com/gdpr/case/c-422-24)

Judgment of 18 December 2025 · ECLI:EU:C:2025:980

Data recorded by body cameras worn by ticket inspectors are collected from the data subject, so information must be given under Art. 13, not Art. 14.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-422/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0422)

### [C-757/22, Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V](https://dposchool.com/gdpr/case/c-757-22)

Judgment of 11 July 2024 · ECLI:EU:C:2024:598

Consumer associations can bring representative actions for failures to inform users about purposes and recipients, because such failures are infringements 'as a result of the processing'.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-757/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0757)

### Related (earlier law or other instruments)

#### [C-413/23 P, European Data Protection Supervisor v Single Resolution Board](https://dposchool.com/gdpr/case/c-413-23-p)

Judgment of 4 September 2025 · ECLI:EU:C:2025:645

Instrument: Regulation (EU) 2018/1725 (EU institutions; definitions mirror the GDPR)

On appeal, the Court held that pseudonymised data are not necessarily personal data for every recipient, but that the controller's duty to inform people about recipients is judged from the controller's own position at the time of collection; it set aside the General Court's judgment and sent part of the case back.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-413/23%20P&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0413)

#### [C-40/17, Fashion ID GmbH & Co.KG v Verbraucherzentrale NRW eV](https://dposchool.com/gdpr/case/c-40-17)

Judgment of 29 July 2019 · ECLI:EU:C:2019:629

Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)

A website that embeds a social plugin is a joint controller with the plugin provider for collecting and sending visitors' data, but only for that stage; each must pursue a legitimate interest, and the site must obtain any consent and give information for the stage it controls.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-40/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0040)

## EDPB guidance

### [Guidelines 3/2019 on processing of personal data through video devices](https://dposchool.com/gdpr/guidance/edpb-03-2019)

EDPB 03/2019 · Final · First published 12 July 2019 · Final version 30 January 2020

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-32019-on-processing-of-personal-data-through-video-devices_en)

### [Guidelines on transparency under Regulation 2016/679](https://dposchool.com/gdpr/guidance/wp260-rev-01)

WP260 rev.01 · Final · First published 11 April 2018 · Endorsed by the EDPB 11 April 2018

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/article-29-working-party-guidelines-on-transparency-under-regulation-2016679_en)

## Fines

Amounts are shown in the currency in which the fine was imposed.

### [IQVIA Solutions Italy S.r.l: EUR 7,000,000](https://dposchool.com/gdpr/fine/garante-iqvia-2026-09)

Garante per la protezione dei dati personali, Italy · Decision of 23 September 2026 · Appeal status: unknown

Health-analytics firm treated a database of about one million GP patients as anonymous when a persistent identifier made them re-identifiable; no legal basis, no information, no DPIA, weak retention and security.

[Source: the authority](https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en)

### [TikTok Technology Limited: EUR 530,000,000](https://dposchool.com/gdpr/fine/dpc-tiktok-2025-04)

Data Protection Commission (Ireland), Ireland · Decision of 30 April 2025 · Appeal status: under appeal

Allowed staff in China to access EEA users' data without showing equivalent protection, and did not tell users about these transfers.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-tiktok-technology-limited)

### [Luka Inc.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-luka-replika-2025-04)

Garante per la protezione dei dati personali, Italy · Decision of 10 April 2025 · Appeal status: unknown

AI companion chatbot ran with no identified legal basis, an inadequate privacy policy and no effective age verification despite excluding minors.

[Source: the authority](https://www.edpb.europa.eu/news/ai-the-italian-supervisory-authority-fines-company-behind-chatbot-replika_en)

### [Netflix International B.V.: EUR 4,750,000](https://dposchool.com/gdpr/fine/ap-netflix-2024-11)

Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 26 November 2024 · Appeal status: unknown

Did not tell customers clearly enough, in its privacy statement and access replies, about purposes, legal bases, recipients, retention and transfers (2018 to 2020).

[Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/documents/fine-netflix)

### [Posti: EUR 2,400,000](https://dposchool.com/gdpr/fine/fi-posti-2024-11)

Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman, Finland), Finland · Decision of 13 November 2024 · Appeal status: unknown

Automatically opened an OmaPosti electronic mailbox for customers, tied to other services, with a pre-ticked box and without clear information.

Not fully confirmed: Confirmed on the EDPB news page. Fine for Art. 5 and 6(1); reprimand and order for Art. 13; instruction on Art. 25. Company name given only as 'Posti'.

[Source: the authority](https://www.edpb.europa.eu/news/finnish-sa-administrative-fine-imposed-on-posti-for-unlawful-processing-of-personal-data_en)

### [Foodinho s.r.l.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-foodinho-2024-11)

Garante per la protezione dei dati personali, Italy · Decision of 13 November 2024 · Appeal status: unknown

Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10074601)

### [LinkedIn Ireland Unlimited Company: EUR 310,000,000](https://dposchool.com/gdpr/fine/dpc-linkedin-2024-10)

Data Protection Commission (Ireland), Ireland · Decision of 22 October 2024 · Appeal status: under appeal

Processed members' data for behavioural analysis and targeted advertising without a valid legal basis, and without fair and clear information.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-linkedin-ireland-unlimited-company-october-2024)

### [Avast Software s.r.o.: CZK 351,000,000](https://dposchool.com/gdpr/fine/uoou-avast-2024-04)

Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Czech Republic · Decision of 10 April 2024 · Appeal status: upheld

Antivirus maker passed pseudonymised browsing histories of about 100 million users to a sister company that sold insights to marketers, while telling users the data was anonymous and used only for statistics.

[Source: the authority](https://uoou.gov.cz/novinky/vse/uoou-ulozil-pokutu-351-mil-kc-za-poruseni-gdpr)

### [Amazon France Logistique: EUR 32,000,000](https://dposchool.com/gdpr/fine/cnil-amazon-france-logistique-2023-12)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 27 December 2023 · Appeal status: reduced

Warehouse employee monitoring: scanner-based productivity indicators kept in detail for 31 days, some judged to lack a legal basis, plus poor information to temporary staff and on CCTV, and weak security.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048989272)

### [Uber Technologies Inc. en Uber B.V.: EUR 10,000,000](https://dposchool.com/gdpr/fine/ap-uber-2023-12)

Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 11 December 2023 · Appeal status: under appeal

Unclear to drivers on retention periods and transfers outside Europe, and made it hard for them to exercise access and portability rights.

[Source: the authority](https://www.autoriteitpersoonsgegevens.nl/documenten/boete-uber-privacyrechten)

### [EOS Matrix d.o.o.: EUR 5,470,000](https://dposchool.com/gdpr/fine/azop-eos-matrix-2023-10)

Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Croatia · Announced on 5 October 2023 · Appeal status: unknown

Debt collector could not protect or explain a leak from its main database, processed non-debtors' data and debtors' health data with no legal basis, and recorded calls without a legal basis or clear notice.

[Source: the authority](https://azop.hr/agenciji-za-naplatu-potrazivanja-eos-matrix-d-o-o-izrecena-upravna-novcana-kazna-u-iznosu-od-547-milijuna-eura/)

### [TikTok Technology Limited: EUR 345,000,000](https://dposchool.com/gdpr/fine/dpc-tiktok-2023-09)

Data Protection Commission (Ireland), Ireland · Decision of 1 September 2023 · Appeal status: under appeal

Child users' accounts were public by default, 'Family Pairing' was weak, and children were not told clearly about the settings; the EDPB added a fairness ('dark patterns') finding.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-tiktok-technology-limited-september-2023)

### [CRITEO: EUR 40,000,000](https://dposchool.com/gdpr/fine/cnil-criteo-2023-06)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 15 June 2023 · Appeal status: unknown

Ad-tech company could not show that the people whose browsing data it processed had consented, gave incomplete information, mishandled access, withdrawal and erasure requests, and lacked a proper joint-controller arrangement with partners.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063)

### [Meta Platforms Ireland Limited: EUR 210,000,000](https://dposchool.com/gdpr/fine/dpc-meta-facebook-2022-12)

Data Protection Commission (Ireland), Ireland · Decision of 31 December 2022 · Appeal status: under appeal

Facebook relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-december-2022)

### [Meta Platforms Ireland Limited: EUR 180,000,000](https://dposchool.com/gdpr/fine/dpc-meta-instagram-2022-12)

Data Protection Commission (Ireland), Ireland · Decision of 31 December 2022 · Appeal status: under appeal

Instagram relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-december-2022)

### [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/garante-clearview-2022-02)

Garante per la protezione dei dati personali, Italy · Decision of 10 February 2022 · Appeal status: unknown

Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9751362)

### [IAB Europe: EUR 250,000](https://dposchool.com/gdpr/fine/apd-iab-europe-2022-02)

Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium), Belgium · Decision of 2 February 2022 · Appeal status: upheld

The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO.

[Source: the authority](https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr)

### [WhatsApp Ireland Ltd: EUR 225,000,000](https://dposchool.com/gdpr/fine/dpc-whatsapp-2021-08)

Data Protection Commission (Ireland), Ireland · Decision of 20 August 2021 · Appeal status: under appeal

Did not tell users and non-users clearly enough how their data was processed, including sharing with other group companies.

Not fully confirmed: The DPC summary page tags only Articles 5 and 13 (no sub-paragraphs); the full decision also covers other transparency articles. Fine raised after EDPB binding decision 1/2021. DPC fines table: Pending Appeal.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/decision-concerning-whatsapp-ireland-ltd)

### [Deliveroo Italy s.r.l.: EUR 2,500,000](https://dposchool.com/gdpr/fine/garante-deliveroo-2021-07)

Garante per la protezione dei dati personali, Italy · Decision of 22 July 2021 · Appeal status: unknown

Food-delivery platform managed about 8,000 riders through opaque algorithms (booking and work allocation), collected excessive data including location, and lacked a DPIA and proper records.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9685994)

### [CAIXABANK, S.A.: EUR 6,000,000](https://dposchool.com/gdpr/fine/aepd-caixabank-2021-01)

Agencia Española de Protección de Datos (AEPD), Spain · Decision of 7 January 2021 · Appeal status: unknown

Bank relied on invalid consent and its privacy information was unclear when it profiled customers and shared data across its group for commercial purposes.

Not fully confirmed: Operative part of resolution PS/00477/2019 read: EUR 2,000,000 for Articles 13 and 14 and EUR 4,000,000 for Article 6; a charge under Article 22 was dismissed. The resolution text carries no visible date; 7 January 2021 comes from a later AEPD document.

[Source: the authority](https://www.aepd.es/documento/ps-00477-2019.pdf)

### [Carrefour France: EUR 2,250,000](https://dposchool.com/gdpr/fine/cnil-carrefour-france-2020-11)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 18 November 2020 · Appeal status: unknown

Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings.

Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb\_aar\_2020\_final\_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042563756)

### [Google LLC: EUR 50,000,000](https://dposchool.com/gdpr/fine/cnil-google-2019-01)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 21 January 2019 · Appeal status: upheld

Information on ad personalisation was scattered and unclear, and consent to it was not specific or informed (pre-ticked, bundled), so it gave no valid legal basis.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000038032552/)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter III](https://dposchool.com/gdpr/chapter/3) / Article 13

Previous: [Art. 12 GDPR: Transparent information, communication and modalities for the exercise of the rights of the data subject](https://dposchool.com/gdpr/article/12)

Next: [Art. 14 GDPR: Information to be provided where personal data have not been obtained from the data subject](https://dposchool.com/gdpr/article/14)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents