EU regulatory register · GDPR
Article 13Information to be provided where personal data are collected from the data subject
CELEX 32016R0679 · Read on 2026-08-18 · Chapter III
Short answer
1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:
Verbatim from the article. Source: NovaCopilot · https://legal.exploreworldai.com/eu/rattsakter/gdpr-2016-679/artikel-13 · Short answer as data · Official text
Official text
Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.
1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:
(a)
the identity and the contact details of the controller and, where applicable, of the controller's representative;
(b)
the contact details of the data protection officer, where applicable;
(c)
the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
(d)
where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;
(e)
the recipients or categories of recipients of the personal data, if any;
(f)
where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.
2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:
The article continues in the official text.
Follow-up questions
Other articles in this chapter
Knowledge card
- Applies
- controller: Give the data subject the information listed in Article 13, including identity, purposes, legal basis, recipients, transfers, retention period and rights, when personal data are obtained from the data subject.
- Risk if ignored
- critical
- What to do
- Give the data subject the information listed in Article 13, including identity, purposes, legal basis, recipients, transfers, retention period and rights, when personal data are obtained from the data subject.
- Deadline
- At the time when the personal data are obtained.
card:eu:article:gdpr--art-13 · sha256 cc6bfece779e · Source: NovaCopilot
Risk, sanction and outcome
Art. 13 · controller
Risk: high · Sanction: administrative_fine, högst EUR 20 000 000 · Authority: Competent supervisory authority
Decisions applying the provision: none in the register
Full chain (JSON)
Outcomes are counted from stored judgments that cite the provision verbatim. Source: NovaCopilot
Judgments of the Court of Justice
2 decisions
- C-422/24Court of Justice of the European Union
Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik
Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 13 and 14 – Scope – Personal data collected by means of body cameras worn by ticket inspectors on public transport – Legal basis for the obligation on the data controller to provide information to the data subject.
Ask NovaCopilot - C-757/22Court of Justice of the European Union
Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V
Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – First sentence of Article 12(1) – Transparency of information – Article 13(1)(c) and (e) – Obligation of the controller to provide information – Article 80(2) – Representation of data subjects by a consumer protection association – Representative action in the absence of a mandate and independently of the infringement of specific rights of a data subject – Action based on infringement by the controller of its obligation to provide information – Concept of ‘infringement of [the rights of a data subject] as a result of the processing’.
Ask NovaCopilot
Judgments applying this article
17 judgments in the register cite the article in their text. EU 10 · DE 7
- eu:c-422-24
- eu:c-484-24-62024cj0484
- eu:c-673-17-62017cj0673
- eu:c-61-19
- eu:c-154-21
- eu:c-175-20-62020cj0175
- eu:c-319-20-62020cj0319
- eu:c-394-23-62023cj0394
- eu:c-492-23
- eu:c-621-22-62022cj0621
Source: NovaCopilot
Recitals that carry the interpretation
The recitals in the preamble have no legal force of their own but often decide how the article is read. The links are curated against the official text. Read 2026-08-31.
Skäl 60 · Article 13
The information duty must be clear and accessible, adapted in particular to children.
Guidance and secondary law
Authority guidance and the delegated or implementing acts that fill the article, with the primary source at the issuing body. Read 2026-08-31.
- Guideline · EDPB2023-02-14Guidelines 03/2022 on deceptive design patterns in social media interfaces
Deceptive design patterns in interfaces, read against Articles 5, 12, 13 and 25.
Article 5, 12, 13, 25
The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.
Verifiable trust signals
- Source-linked answers and explicit evidence gaps
- Obligations, controls, risks and consequences
- Stable objects and verifiable checksums
- Rule-based objects, optional source-linked reasoning
- Model card, source status and audit