Artifact GuideEU

EU GDPR Transparency Notices

Build privacy notices around the actual Article 12, 13 and 14 fields: who controls the processing, why data is used, legal basis, recipients, transfers, retention, rights, and data sources.

Use one notice record per processing purpose so legal, product, marketing, HR, support, procurement, and data-governance teams keep the public notice aligned with the data flow.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

GDPR transparency notices are not generic privacy-policy pages. Articles 12, 13 and 14 require controllers to give people clear, accessible information about the processing, including the controller identity, purposes, lawful basis, recipients, international transfers, retention, rights, and complaint route. Article 13 applies when personal data is collected from the person; Article 14 applies when the data comes from another source.

Section 1

Write the notice in Article 12 language

Article 12 sets the form of the notice. The controller must provide Article 13 and 14 information in a concise, transparent, intelligible and easily accessible form, using clear and plain language. If the information is addressed to a child, the language standard is especially important.

Do not bury the notice inside terms, support articles, or sales copy. The person should be able to find the controller identity, purpose, lawful basis, retention position, recipients, transfer information, and rights without reading unrelated material.

Use a short first layer that names the controller, purpose, data categories, lawful basis, rights, and links to the full notice.
Keep one complete notice available in writing or by electronic means so every required Article 13 or 14 field is in one place.
Use concrete verbs: collect, use, share, store, delete, disclose, transfer, and retain.
Avoid vague retention wording unless the notice also gives the criteria used to determine the period.
Make rights instructions practical enough for a person to request access, rectification, erasure, restriction, objection, portability, withdrawal of consent, or complaint review.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 12 requires Article 13 and 14 information to be concise, transparent, intelligible, easily accessible, and in clear plain language.

Section 2

Use Article 13 when data is collected from the person

For forms, account sign-up, checkout, job applications, support chats, newsletter sign-ups, events, cookies that collect personal data, and other direct collection points, Article 13 information is due at the time the personal data is obtained.

The notice should describe the processing purpose by purpose. If the same person gives data for account creation, billing, fraud prevention, analytics, marketing, and support, each purpose needs its own lawful basis, recipient position, retention position, and rights context.

Identify the controller and, where applicable, the controller's representative.
Give the DPO contact details where a DPO applies.
State the purposes of processing and the legal basis for each purpose.
If relying on legitimate interests under Article 6(1)(f), identify the interests pursued by the controller or a third party.
Name the recipients or categories of recipients, if any, such as payment providers, hosting providers, CRM providers, professional advisers, group entities, or public authorities where disclosure applies.
For transfers to a third country or international organisation, state whether there is an adequacy decision or refer to the Article 46, Article 47, or Article 49 safeguard and how the person can obtain a copy or find it.
State the storage period or the criteria used to determine it.
Explain the rights to access, rectification, erasure, restriction, objection, and portability, plus consent withdrawal where consent is the basis.
Explain the right to lodge a complaint with a supervisory authority.
Say whether providing the data is statutory, contractual, or necessary to enter into a contract, and describe the consequences of not providing it.
Disclose automated decision-making, including profiling, where Article 22 information is required.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 13 lists the notice information required when personal data is collected from the data subject.

Section 3

Use Article 14 when data comes from another source

Article 14 applies when the controller did not obtain the personal data from the person. Common examples include data bought from a broker, received from a partner, generated by another group company, collected from public sources, or supplied by an employer, customer, referrer, or fraud-prevention service.

The Article 14 notice overlaps with Article 13, but it adds two points that are easy to miss: categories of personal data concerned, and the source from which the personal data originates, including whether it came from publicly accessible sources.

Provide the controller identity, representative information where applicable, and DPO contact details where applicable.
State purposes and legal basis, including the specific legitimate interest where Article 6(1)(f) is used.
List the categories of personal data concerned because the person did not provide the data directly.
State recipients or categories of recipients, if any.
Give the transfer position for third countries or international organisations, including adequacy or safeguards where applicable.
State the storage period or retention criteria.
Explain rights to access, rectification, erasure, restriction, objection, portability, consent withdrawal where relevant, and complaint to a supervisory authority.
Identify the source of the data and say whether it came from publicly accessible sources where that applies.
Disclose automated decision-making, including profiling, where Article 22 information is required.
Deliver the information within a reasonable period after obtaining the data and at the latest within one month, or earlier if first communication or first disclosure happens before then.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 14 covers notice content, source disclosure, and timing where personal data was not obtained from the data subject.

Section 4

Keep recipients, transfers, and safeguards specific

A transparency notice should not describe sharing only with a broad partner label. Articles 13 and 14 require recipients or categories of recipients if any, and separate information where the controller intends to transfer personal data to a third country or international organisation.

For international transfers, the notice should say whether the transfer relies on an adequacy decision or on another safeguard. Where Article 46, Article 47, or the second subparagraph of Article 49(1) is relevant, the notice must refer to the safeguards and say how to obtain a copy or where they are available.

Use named recipients where the recipient is stable and meaningful to the person; use precise categories where names change often.
Separate processors, independent controllers, joint controllers, group entities, public authorities, and professional advisers where those categories are used.
Do not list speculative recipient categories that are not used in the actual processing flow.
For transfers, record the destination country or international organisation, the transfer mechanism, and where the safeguard can be reviewed.
Keep the public notice aligned with processor terms, transfer impact records, SCC records, and the record of processing activities.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Articles 13 and 14 require recipient information and transfer information; Chapter V sets the general GDPR transfer rule.

European Commission - Standard Contractual Clauses

Commission source for standard contractual clauses as a GDPR transfer safeguard for EU-to-third-country transfers.

Section 5

Make retention, lawful basis, and rights testable

A privacy notice is easier to maintain when each processing purpose has a matching internal record. The public notice should not promise a basis, retention period, recipient list, or transfer safeguard that the record of processing, contract file, data map, or product implementation cannot support.

Review the notice when a purpose changes, a new recipient receives data, a new data source is added, data moves to a third country, retention rules change, or automated decision-making is introduced. Articles 13 and 14 also require further-purpose information before further processing for a different purpose.

When does a GDPR notice need Article 13 content?

Use Article 13 when the controller collects personal data from the person. The information must be provided at the time the personal data is obtained.

When does a GDPR notice need Article 14 content?

Use Article 14 when the controller did not obtain the personal data from the person. The notice must include the categories of personal data and the source of the data, including whether it came from publicly accessible sources where applicable.

What should a GDPR transparency notice say about retention?

It should state the period for which the personal data will be stored. If a fixed period is not possible, it should state the criteria used to determine that period.

What should a GDPR transparency notice say about international transfers?

It should say whether personal data is transferred to a third country or international organisation and, where applicable, whether there is an adequacy decision or which safeguard applies and how the person can obtain a copy or find it.

For each purpose, store the Article 6 lawful basis and any Article 9 or Article 10 condition needed for special-category, criminal-conviction, or offence data.
For consent, include how the person can withdraw consent and keep the notice wording consistent with the consent interface.
For legitimate interests, name the specific interest rather than using a generic phrase.
For retention, state a fixed period where possible; otherwise state objective criteria such as account status, contract duration, legal limitation period, dispute hold, or statutory retention requirement.
For rights, explain any workflow channel and make objection, portability, consent withdrawal, and complaint language visible where those rights are relevant to the processing.
For Article 14 data, keep a source register that distinguishes partner-provided data, customer-provided third-party data, public-source data, purchased data, and internally inferred data.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Articles 13 and 14 require legal basis, retention, rights, source, and further-purpose information in privacy notices.

Recommended next step

Use this guide to check every public privacy notice against Articles 12, 13 and 14

Sorena can help map each notice section to the underlying purpose, lawful basis, recipient, transfer safeguard, retention rule, rights workflow, and data source.

Research workflow

Open Research Copilot for EU GDPR

Ask source-linked questions about GDPR notice content, Article 13 direct collection, Article 14 source disclosures, transfers, retention, and data subject rights.

Explore next step

Talk to Sorena

Talk through implementation

Review your GDPR transparency notices against processing purposes, data sources, recipients, transfers, retention rules, and rights workflows.

Explore next step

Primary sources