Artifact GuideEU

EU GDPR Transparency Notices

Build privacy notices around the actual Article 12, 13 and 14 fields: who controls the processing, why data is used, legal basis, recipients, transfers, retention, rights, and data sources.

Use one notice record per processing purpose so legal, product, marketing, HR, support, procurement, and data-governance teams keep the public notice aligned with the data flow.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 24, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 24, 2026

Overview

A GDPR transparency notice should tell a person who the is, what personal data is processed, why and on which lawful basis, who receives it, how long it is kept, whether it is transferred internationally, and how to exercise relevant rights or complain. applies when personal data is collected from the person. applies when it is obtained elsewhere or generated from data not collected directly from that person.

Section 1

Write the notice in Article 12 language

Article 12 sets the form of the notice. The must provide and 14 information in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. Information addressed specifically to a child must be written so the child can understand it.

Keep the notice separate from unrelated terms, support articles, and sales copy. The person should be able to find the identity, purpose, lawful basis, retention position, recipients, transfer information, and rights without searching through unrelated material.

Use a when space is limited: put the identity, purpose, data involved, lawful basis, important effects, and relevant rights in the first layer, then link directly to the complete information.
Keep the complete notice available in writing or by electronic means so every required or 14 field is easy to find.
Use concrete verbs: collect, use, share, store, delete, disclose, transfer, and retain.
Avoid vague retention wording unless the notice also gives the criteria used to determine the period.
State which rights apply to the processing and give a usable contact or request method. Access, rectification, erasure, restriction, objection, portability, and withdrawal do not all apply in the same way to every lawful basis or set of facts.
Provide the information free of charge. Article 12 also requires the to help people exercise their data-subject rights.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 12 requires Article 13 and 14 information to be concise, transparent, intelligible, easily accessible, and in clear plain language.

Article 29 Working Party Guidelines on transparency under Regulation 2016/679, endorsed by the EDPB

Explains layered notices, first-layer priorities, accessibility, child-directed language, and the practical presentation of Articles 12 to 14 information.

Section 2

Use Article 13 when data is collected from the person

For forms, account sign-up, checkout, job applications, support chats, newsletter sign-ups, events, identifiers collected from a person's device, and other direct collection points, information is due at the time the personal data is obtained.

The notice should describe the processing purpose by purpose. If the same person gives data for account creation, billing, fraud prevention, analytics, marketing, and support, each purpose needs its own lawful basis, recipient position, retention position, and rights context.

Identify the and, where applicable, the controller's representative.
Give the DPO contact details where a DPO applies.
State the purposes of processing and the legal basis for each purpose.
If relying on legitimate interests under Article 6(1)(f), identify the interests pursued by the or a third party.
Name the recipients or categories of recipients, if any, such as payment providers, hosting providers, CRM providers, professional advisers, group entities, or public authorities where disclosure applies.
For transfers to a third country or international organisation, state whether there is an adequacy decision or refer to the Article 46 or Article 47 safeguards, or the suitable safeguards for a transfer under the second subparagraph of Article 49(1), and how the person can obtain a copy or find them.
State the storage period or the criteria used to determine it.
Explain the rights to access, rectification, erasure, restriction, objection, and portability where they apply, plus consent withdrawal where consent is the basis.
Explain the right to lodge a complaint with a supervisory authority.
Say whether providing the data is statutory, contractual, or necessary to enter into a contract, and describe the consequences of not providing it.
Disclose the existence of covered by Article 22(1) or (4), including profiling, and give meaningful information about the logic involved, its significance, and its envisaged consequences for the person.
does not require the to repeat information the person already has, but the controller should be able to show what information was already provided.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 13 lists the notice information required when personal data is collected from the data subject.

Section 3

Use Article 14 when data comes from another source

applies when the did not collect the personal data from the person. Common examples include data bought from a broker, received from a partner or group company, collected from public sources, supplied by an employer, customer, referrer, or fraud-prevention service, or inferred or generated from data obtained elsewhere. In its 28 November 2024 judgment in C-169/23, the Court of Justice confirmed that Article 14 also covers data the controller generates from data not collected directly from the person.

The notice overlaps with , but it adds the categories of personal data concerned and the source from which the data originates, including whether it came from publicly accessible sources.

Provide the identity, representative information where applicable, and DPO contact details where applicable.
State purposes and legal basis, including the specific legitimate interest where Article 6(1)(f) is used.
List the categories of personal data concerned because the person did not provide the data directly.
State recipients or categories of recipients, if any.
Give the transfer position for third countries or international organisations, including adequacy or safeguards where applicable.
State the storage period or retention criteria.
Explain rights to access, rectification, erasure, restriction, objection, portability, and consent withdrawal where they apply, plus the right to complain to a supervisory authority.
Identify the source of the data and say whether it came from publicly accessible sources where that applies.
Disclose covered by Article 22(1) or (4), including profiling, and explain the logic, significance, and envisaged consequences.
Deliver the information within a reasonable period after obtaining the data and no later than one month. If the communicates with the person sooner, provide it by that first communication; if disclosure to another recipient comes first, provide it no later than the first disclosure.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 14 covers notice content, source disclosure, and timing where personal data was not obtained from the data subject.

Court of Justice judgment of 28 November 2024, C-169/23

Confirms that Article 14 covers both data obtained from someone other than the data subject and data generated by the controller from data not collected directly from the data subject.

Section 4

Apply Article 14 timing and exceptions narrowly

Treat one month as the latest deadline. The must choose a reasonable delivery time for the circumstances and give the notice sooner if it communicates with the person or first discloses the data before then.

(5) has limited exceptions. The must identify the exact exception, document why it applies, and meet any safeguard conditions. A difficult or expensive notification exercise does not by itself establish disproportionate effort.

Information already held: duties do not apply to the extent the person already has the information.
Impossible, disproportionate effort, or serious impairment: (5)(b) is especially directed to public-interest archiving, scientific or historical research, and statistical processing subject to Article 89(1). The must take appropriate protective measures, including making the information publicly available.
Obtaining or disclosure laid down by law: (5)(c) applies only where Union or Member State law applicable to the expressly provides for the obtaining or disclosure and includes appropriate measures to protect the person's legitimate interests.
Professional secrecy: (5)(d) applies where Union or Member State law requires the personal data to remain confidential under professional or statutory secrecy.
Direct collection: provides no impossibility or disproportionate-effort exception for notice at the collection point.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Article 14(3) sets the timing triggers and Article 14(5) states the exceptions and safeguard conditions.

Article 29 Working Party Guidelines on transparency under Regulation 2016/679, endorsed by the EDPB

Explains that Article 14 exceptions should be applied narrowly and gives the documented assessment and protective measures expected for impossibility or disproportionate effort.

Section 5

Keep recipients, transfers, and safeguards specific

Do not describe sharing only with a broad partner label. Articles 13 and 14 require recipients or categories of recipients, if any, and separate information where the intends to transfer personal data to a third country or international organisation.

For international transfers, the notice should say whether the transfer relies on an adequacy decision or on another safeguard. Where Article 46, Article 47, or the second subparagraph of Article 49(1) is relevant, the notice must refer to the safeguards and say how to obtain a copy or where they are available.

Use named recipients where the recipient is stable and meaningful to the person; use precise categories where names change often.
Separate processors, independent controllers, joint controllers, group entities, public authorities, and professional advisers where those categories are used.
Do not list speculative recipient categories that are not used in the actual processing flow.
For transfers, record the destination country or international organisation, the transfer mechanism, and where the safeguard can be reviewed.
Keep the public notice aligned with processor terms, transfer impact records, SCC records, and the record of processing activities.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Articles 13 and 14 require recipient information and transfer information; Chapter V sets the general GDPR transfer rule.

European Commission - Standard Contractual Clauses

Commission source for standard contractual clauses as a GDPR transfer safeguard for EU-to-third-country transfers.

Section 6

Make retention, lawful basis, and rights testable

Maintain a matching evidence record for each processing purpose. The public notice should not state a basis, retention period, recipient list, or transfer safeguard that the record of processing, contract file, data map, or product implementation cannot support.

Review the notice when a purpose changes, a new recipient receives data, a new data source is added, data moves to a third country, retention rules change, or is introduced. Articles 13(3) and 14(4) require the to give information about a new purpose, and the relevant additional information, before further processing begins.

When does a GDPR notice need content?

Use when the collects personal data from the person. The information must be provided at the time the personal data is obtained.

When does a GDPR notice need content?

Use when the did not collect the personal data directly from the person. This includes data received from someone else and data the controller generates from data obtained elsewhere. The notice must include the categories of personal data and the source, including whether it was publicly accessible.

What should a GDPR transparency notice say about retention?

It should state the period for which the personal data will be stored. If a fixed period is not possible, it should state the criteria used to determine that period.

What should a GDPR transparency notice say about international transfers?

It should say whether personal data is transferred to a third country or international organisation and, where applicable, whether there is an adequacy decision or which safeguard applies and how the person can obtain a copy or find it.

Can a skip an notice because contacting everyone is difficult?

Not for that reason alone. The must satisfy a specific (5) exception. If it relies on impossibility, disproportionate effort, or serious impairment under Article 14(5)(b), it must document the assessment and take appropriate measures to protect people, including making the information publicly available.

Can a GDPR privacy notice use layers?

Yes. A can put the most important information at the collection point and link directly to complete details. The must still provide every applicable or 14 item in a concise, clear, accessible, and easy-to-find form.

For each purpose, store the Article 6 lawful basis, any Article 9 condition for special-category data, and the official-authority or Union or Member State law relied on for criminal-conviction or offence data under Article 10.
For consent, include how the person can withdraw consent and keep the notice wording consistent with the consent interface.
For legitimate interests, name the specific interest rather than using a generic phrase.
For retention, state a fixed period where possible; otherwise state objective criteria such as account status, contract duration, legal limitation period, dispute hold, or statutory retention requirement.
For rights, explain the request channel and make objection, portability, consent withdrawal, and complaint language visible where those rights are relevant to the processing.
For data, keep a source register that distinguishes partner-provided data, customer-provided third-party data, public-source data, purchased data, and internally inferred data.

Sources for this answer

Regulation (EU) 2016/679 (GDPR)

Articles 13 and 14 require legal basis, retention, rights, source, and further-purpose information in privacy notices.

Article 29 Working Party Guidelines on transparency under Regulation 2016/679, endorsed by the EDPB

Supports layered presentation and explains notice changes, further-purpose information, and timing before further processing.

Recommended next step

This guide helps check every public privacy notice against Articles 12, 13 and 14

Sorena can help map each notice section to the underlying purpose, lawful basis, recipient, transfer safeguard, retention rule, rights workflow, and data source.

Research workflow

Open Research Copilot for EU GDPR

Ask questions tied to cited sources about GDPR notice content, Article 13 direct collection, Article 14 source disclosures, transfers, retention, and data subject rights.

Explore next step

Talk to Sorena

Talk through implementation

Review your GDPR transparency notices against processing purposes, data sources, recipients, transfers, retention rules, and rights workflows.

Explore next step

Primary sources

References and citations

Article 29 Working Party Guidelines on transparency under Regulation 2016/679, endorsed by the EDPB

edpb.europa.eu

Referenced sections

Supports layered presentation and explains notice changes, further-purpose information, and timing before further processing.

Court of Justice judgment of 28 November 2024, C-169/23

eur-lex.europa.eu

Referenced sections

Confirms that Article 14 covers both data obtained from someone other than the data subject and data generated by the controller from data not collected directly from the data subject.

European Commission - Standard Contractual Clauses

commission.europa.eu

Referenced sections