EU regulatory register · GDPR
Article 13Information to be provided where personal data are collected from the data subject
CELEX 32016R0679 · Read on 2026-08-18 · Chapter III
Official text
Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.
1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:
(a)
the identity and the contact details of the controller and, where applicable, of the controller's representative;
(b)
the contact details of the data protection officer, where applicable;
(c)
the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
(d)
where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;
(e)
the recipients or categories of recipients of the personal data, if any;
(f)
where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.
2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:
The article continues in the official text.
Other articles in this chapter
Judgments of the Court of Justice
2 decisions
- C-422/24Court of Justice of the European Union
Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik
Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 13 and 14 – Scope – Personal data collected by means of body cameras worn by ticket inspectors on public transport – Legal basis for the obligation on the data controller to provide information to the data subject.
- C-757/22Court of Justice of the European Union
Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V
Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – First sentence of Article 12(1) – Transparency of information – Article 13(1)(c) and (e) – Obligation of the controller to provide information – Article 80(2) – Representation of data subjects by a consumer protection association – Representative action in the absence of a mandate and independently of the infringement of specific rights of a data subject – Action based on infringement by the controller of its obligation to provide information – Concept of ‘infringement of [the rights of a data subject] as a result of the processing’.
The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.
Verifiable trust signals
- Six fixed blocks, one source per line
- No sentence written by a language model
- Engine version and read date on every answer
- No customer data, no documents, no advice
- Model card and audit published under the EU AI Act