GDPR Article 13: Information When Data Collected From Subject

In one sentence. GDPR Article 13 governs what the controller must tell the data subject when collecting data directly from them: identity of controller, DPO contact, purposes and lawful basis, recipients, transfers, retention period, rights, complaint pathway, automated decision-making, and source-of-data details — at the moment of collection, in clear language. Article 14 covers the equivalent obligation when data is collected indirectly from third parties.

Article 13 is the source of every privacy notice you’ve ever read. Most CNIL sanctions for “transparency violations” cite missing Article 13 items: no DPO contact, no retention period, no mention of international transfers, no complaint pathway. The list is closed and exhaustive — every item must appear or the notice is non-compliant.

Key takeaways

• Article 13 lists 14 mandatory information items for direct collection.
• Information must be provided at the moment of collection — not after.
• Each item must appear in the privacy notice or contextual disclosure (form, banner).
• Layered notices acceptable, but the full information must be reachable in one click.
• Article 14 covers the same obligation when data comes from a third party.

1. Article 13 mandatory items (paragraph 1)

When data is collected directly from the data subject, the controller must provide:

2. Additional items (paragraph 2)

To ensure fair and transparent processing:

3. Layered privacy notices

The EDPB (Guidelines on transparency) endorses layered notices:

• Layer 1: short summary at point of collection (form, banner) — controller name, key purposes, link to full notice
• Layer 2: complete privacy notice on a dedicated page with all 14 items

Conditions:

• Layer 1 must be complete enough for an informed decision (controller, purposes, link to layer 2)
• Layer 2 must be one click away
• Both layers must use clear and plain language

4. Compliant privacy notice structure

A typical Article 13-compliant privacy notice has:

1. Who we are (controller identity, address, DPO contact)
2. What data we collect
3. Why we process it (purposes + lawful bases per purpose)
4. Who receives it (internal teams + named external recipients)
5. International transfers (countries + safeguard mechanism)
6. How long we keep it (per category of data)
7. Your rights (access, rectification, erasure, etc.) — how to exercise
8. Your right to complain to the CNIL/relevant DPA (with link)
9. Required vs optional fields (consequences of refusal)
10. Automated decision-making (logic, significance, consequences) — if any
11. Last updated date + change history

5. Common Article 13 violations sanctioned by CNIL

The CNIL’s procédure simplifiée frequently uses Article 13 violations as the lead grounds — they are visible on first inspection of the privacy notice.

6. Special cases

Mobile apps

Notice must be available before the user consents to install / first use the app. The standard practice: in-app first-launch notice + permanent link in settings.

Connected devices / IoT

Information must be provided through an accessible channel — companion app, paper insert, QR code linking to web notice.

Forms (paper or digital)

Notice in proximity to the form fields, not buried in terms of service. CNIL has sanctioned forms where the notice was a separate document the user never saw.

7. Article 13 vs Article 14: when each applies

If your processing involves both — most do — both articles apply.

8. Exemptions (Article 13(4))

The notice obligation doesn’t apply where the data subject already has the information. The bar for “already has” is high — generic awareness doesn’t count. The controller must be able to demonstrate the data subject has actually received the specific information.

In practice: the exemption applies in narrow cases (e.g., a returning customer who recently received an updated notice). Don’t rely on this exemption broadly.

9. Enforcement

Article 83(5)(b) places Article 13 violations at the top tier — up to €20M or 4% of global turnover.

10. Tooling

Official sources: Article 13 (information to be provided) of Regulation (EU) 2016/679 on EUR-Lex, the EDPB guidelines, recommendations and best practices register, and the ICO guidance.

Conclusion

Article 13 is the contract between the controller and the data subject at the moment of collection. The 14 items are not optional. The notice doesn’t need to be long — it needs to be complete, clear, and accessible. Most violations are omissions, not active misrepresentations: build a checklist once, audit notices quarterly.

FAQ

What information must I include in a privacy notice under GDPR Article 13?

14 items: controller identity, DPO contact, purposes and lawful basis, recipients, international transfers, retention period, rights (access, rectification, erasure, restriction, objection, portability), withdrawal of consent, complaint to supervisory authority, statutory/contractual requirements, automated decision-making, further-processing notice, source-of-data details.

When must Article 13 information be provided?

At the moment data is collected from the data subject — not after. For online forms, the notice must be available before the user submits. For mobile apps, before first use.

Can I use a layered privacy notice?

Yes. The EDPB endorses layered notices — short summary at point of collection + full notice one click away. Both layers must use clear and plain language. The summary alone is not enough.

What’s the difference between Articles 13 and 14?

Article 13 covers data collected directly from the data subject. Article 14 covers data collected indirectly (from third parties, public sources, partners). The information items are largely the same but timing differs.

Are there exemptions to Article 13?

Article 13(4) exempts the obligation where the data subject already has the information. The bar is high — generic awareness doesn’t count. Don’t rely on this exemption broadly.