EU regulatory register · GDPR
Article 14Information to be provided where personal data have not been obtained from the data subject
CELEX 32016R0679 · Read on 2026-08-18 · Chapter III
Short answer
1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:
Verbatim from the article. Source: NovaCopilot · https://legal.exploreworldai.com/eu/rattsakter/gdpr-2016-679/artikel-14 · Short answer as data · Official text
Official text
Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.
1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:
(a)
the identity and the contact details of the controller and, where applicable, of the controller's representative;
(b)
the contact details of the data protection officer, where applicable;
(c)
the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
(d)
the categories of personal data concerned;
(e)
the recipients or categories of recipients of the personal data, if any;
(f)
where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available.
2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:
The article continues in the official text.
Follow-up questions
Other articles in this chapter
Knowledge card
- Applies
- controller: Give the data subject the information listed in Article 14 where personal data have not been obtained from the data subject, including the source of the data.
- Risk if ignored
- critical
- What to do
- Give the data subject the information listed in Article 14 where personal data have not been obtained from the data subject, including the source of the data.
- Deadline
- Within a reasonable period and at the latest within one month after obtaining the data; at the latest at the first communication or first disclosure to another recipient, if earlier (Art. 14(3)).
card:eu:article:gdpr--art-14 · sha256 54110f6f6a66 · Source: NovaCopilot
Risk, sanction and outcome
Art. 14 · controller
Risk: high · Sanction: administrative_fine, högst EUR 20 000 000 · Authority: Competent supervisory authority
Decisions applying the provision: none in the register
Full chain (JSON)
Outcomes are counted from stored judgments that cite the provision verbatim. Source: NovaCopilot
Judgments of the Court of Justice
2 decisions
- C-422/24Court of Justice of the European Union
Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik
Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 13 and 14 – Scope – Personal data collected by means of body cameras worn by ticket inspectors on public transport – Legal basis for the obligation on the data controller to provide information to the data subject.
Ask NovaCopilot - C-169/23Court of Justice of the European Union
Nemzeti Adatvédelmi és Információszabadság Hatóság v UC
Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data and the free movement of such data – Regulation (EU) 2016/679 – Data processed when drawing up a COVID-19 certificate – Data not collected from the data subject – Information to be provided – Exception to the obligation to provide information – Article 14(5)(c) – Data generated by the controller in the context of its own processes – Right to complain – Competence of the supervisory authority – Article 77(1) – Appropriate measures to protect the data subject’s legitimate interests provided for by the Member State law to which the controller is subject – Measures relating to the security of data processing – Article 32.
Ask NovaCopilot
Judgments applying this article
16 judgments in the register cite the article in their text. EU 5 · DE 11
Source: NovaCopilot
The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.
Verifiable trust signals
- Source-linked answers and explicit evidence gaps
- Obligations, controls, risks and consequences
- Stable objects and verifiable checksums
- Rule-based objects, optional source-linked reasoning
- Model card, source status and audit