--- title: "Art. 14 GDPR: Information to be provided where personal data have not been obtained from the data subject" canonical: "https://dposchool.com/gdpr/article/14" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_14" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 14 GDPR · Chapter III: Rights of the data subject · Section 2: Information and access to personal data # Article 14 GDPR: Information to be provided where personal data have not been obtained from the data subject Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) When personal data have not been obtained from the data subject, the controller must provide the information listed in the article, including the categories of data and their source, within the time limits set in paragraph 3. Paragraph 5 lists the exceptions, such as where the data subject already has the information or providing it proves impossible or would involve a disproportionate effort. ## Official text ### Article 14(1) **1.** Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: #### Article 14(1)(a) **(a)** the identity and the contact details of the controller and, where applicable, of the controller's representative; #### Article 14(1)(b) **(b)** the contact details of the data protection officer, where applicable; #### Article 14(1)(c) **(c)** the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; #### Article 14(1)(d) **(d)** the categories of personal data concerned; #### Article 14(1)(e) **(e)** the recipients or categories of recipients of the personal data, if any; #### Article 14(1)(f) **(f)** where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available. ### Article 14(2) **2.** In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: #### Article 14(2)(a) **(a)** the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; #### Article 14(2)(b) **(b)** where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; #### Article 14(2)(c) **(c)** the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability; #### Article 14(2)(d) **(d)** where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; #### Article 14(2)(e) **(e)** the right to lodge a complaint with a supervisory authority; #### Article 14(2)(f) **(f)** from which source the personal data originate, and if applicable, whether it came from publicly accessible sources; #### Article 14(2)(g) **(g)** the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. ### Article 14(3) **3.** The controller shall provide the information referred to in paragraphs 1 and 2: #### Article 14(3)(a) **(a)** within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed; #### Article 14(3)(b) **(b)** if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or #### Article 14(3)(c) **(c)** if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed. ### Article 14(4) **4.** Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. ### Article 14(5) **5.** Paragraphs 1 to 4 shall not apply where and insofar as: #### Article 14(5)(a) **(a)** the data subject already has the information; #### Article 14(5)(b) **(b)** the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available; #### Article 14(5)(c) **(c)** obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interests; or #### Article 14(5)(d) **(d)** where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 14 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_14) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 61](https://dposchool.com/gdpr/recital/61) - [Recital 62](https://dposchool.com/gdpr/recital/62) ## Court of Justice judgments ### [C-422/24, Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik](https://dposchool.com/gdpr/case/c-422-24) Judgment of 18 December 2025 · ECLI:EU:C:2025:980 Data recorded by body cameras worn by ticket inspectors are collected from the data subject, so information must be given under Art. 13, not Art. 14. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-422/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0422) ### [C-169/23, Nemzeti Adatvédelmi és Információszabadság Hatóság v UC](https://dposchool.com/gdpr/case/c-169-23) Judgment of 28 November 2024 · ECLI:EU:C:2024:988 The exception from informing people when national law provides for obtaining or disclosing data applies also to data the controller generates itself; the authority may check that national law gives adequate safeguards. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-169/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0169) ### Related (earlier law or other instruments) #### [C-413/23 P, European Data Protection Supervisor v Single Resolution Board](https://dposchool.com/gdpr/case/c-413-23-p) Judgment of 4 September 2025 · ECLI:EU:C:2025:645 Instrument: Regulation (EU) 2018/1725 (EU institutions; definitions mirror the GDPR) On appeal, the Court held that pseudonymised data are not necessarily personal data for every recipient, but that the controller's duty to inform people about recipients is judged from the controller's own position at the time of collection; it set aside the General Court's judgment and sent part of the case back. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-413/23%20P&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0413) ## EDPB guidance ### [Guidelines 03/2026 on web scraping in the context of generative AI](https://dposchool.com/gdpr/guidance/edpb-03-2026) EDPB 03/2026 · Draft for consultation · First published 8 July 2026 Consultation open until 30 October 2026. Articles indicative. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-032026-on-web-scraping-in-the-context-of-generative-ai_en) ### [Guidelines on transparency under Regulation 2016/679](https://dposchool.com/gdpr/guidance/wp260-rev-01) WP260 rev.01 · Final · First published 11 April 2018 · Endorsed by the EDPB 11 April 2018 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/article-29-working-party-guidelines-on-transparency-under-regulation-2016679_en) ## Fines Amounts are shown in the currency in which the fine was imposed. ### [Experian Nederland B.V.: EUR 2,700,000](https://dposchool.com/gdpr/fine/ap-experian-2025-10) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 16 October 2025 · Appeal status: not appealed Credit-scoring business used personal data from many sources without a valid legal basis and did not inform the people concerned. [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/actueel/experian-krijgt-boete-van-27-miljoen-euro-voor-privacyovertredingen) ### [LinkedIn Ireland Unlimited Company: EUR 310,000,000](https://dposchool.com/gdpr/fine/dpc-linkedin-2024-10) Data Protection Commission (Ireland), Ireland · Decision of 22 October 2024 · Appeal status: under appeal Processed members' data for behavioural analysis and targeted advertising without a valid legal basis, and without fair and clear information. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-linkedin-ireland-unlimited-company-october-2024) ### [Clearview AI Inc.: EUR 30,500,000](https://dposchool.com/gdpr/fine/ap-clearview-2024-05) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 16 May 2024 · Appeal status: not appealed Built a facial recognition database of billions of photos, including of people in the Netherlands, without a legal basis, and did not inform people or answer access requests. [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/documents/decision-fine-clearview-ai) ### [Clearview AI, Inc: EUR 20,000,000](https://dposchool.com/gdpr/fine/hdpa-clearview-2022-07) Hellenic Data Protection Authority, Greece · Decision of 13 July 2022 · Appeal status: unknown Facial recognition company processed people's images in Greece unlawfully, without transparency, ignored an access request and had no EU representative. [Source: the authority](https://www.dpa.gr/en/en/enimerwtiko/prakseisArxis/imposition-fine-clearview-ai-inc) ### [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/garante-clearview-2022-02) Garante per la protezione dei dati personali, Italy · Decision of 10 February 2022 · Appeal status: unknown Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9751362) ### [IAB Europe: EUR 250,000](https://dposchool.com/gdpr/fine/apd-iab-europe-2022-02) Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium), Belgium · Decision of 2 February 2022 · Appeal status: upheld The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO. [Source: the authority](https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr) ### [CAIXABANK, S.A.: EUR 6,000,000](https://dposchool.com/gdpr/fine/aepd-caixabank-2021-01) Agencia Española de Protección de Datos (AEPD), Spain · Decision of 7 January 2021 · Appeal status: unknown Bank relied on invalid consent and its privacy information was unclear when it profiled customers and shared data across its group for commercial purposes. Not fully confirmed: Operative part of resolution PS/00477/2019 read: EUR 2,000,000 for Articles 13 and 14 and EUR 4,000,000 for Article 6; a charge under Article 22 was dismissed. The resolution text carries no visible date; 7 January 2021 comes from a later AEPD document. [Source: the authority](https://www.aepd.es/documento/ps-00477-2019.pdf) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter III](https://dposchool.com/gdpr/chapter/3) / Article 14 Previous: [Art. 13 GDPR: Information to be provided where personal data are collected from the data subject](https://dposchool.com/gdpr/article/13) Next: [Art. 15 GDPR: Right of access by the data subject](https://dposchool.com/gdpr/article/15) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents