We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideEU

EU GDPR Transparency Notices

Build privacy notices around the actual Article 12, 13 and 14 fields: who controls the processing, why data is used, legal basis, recipients, transfers, retention, rights, and data sources.

Use one notice record per processing purpose so legal, product, marketing, HR, support, procurement, and data-governance teams keep the public notice aligned with the data flow.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
6 sections4 primary sources
Overview

A GDPR transparency notice should tell a person who the is, what personal data is processed, why and on which lawful basis, who receives it, how long it is kept, whether it is transferred internationally, and how to exercise relevant rights or complain. applies when personal data is collected from the person. applies when it is obtained elsewhere or generated from data not collected directly from that person.

Section 1

Write the notice in Article 12 language

Article 12 sets the form of the notice. The must provide and 14 information in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. Information addressed specifically to a child must be written so the child can understand it.

Keep the notice separate from unrelated terms, support articles, and sales copy. The person should be able to find the identity, purpose, lawful basis, retention position, recipients, transfer information, and rights without searching through unrelated material.

  • Use a when space is limited: put the identity, purpose, data involved, lawful basis, important effects, and relevant rights in the first layer, then link directly to the complete information.
  • Keep the complete notice available in writing or by electronic means so every required or 14 field is easy to find.
  • Use concrete verbs: collect, use, share, store, delete, disclose, transfer, and retain.
  • Avoid vague retention wording unless the notice also gives the criteria used to determine the period.
  • State which rights apply to the processing and give a usable contact or request method. Access, rectification, erasure, restriction, objection, portability, and withdrawal do not all apply in the same way to every lawful basis or set of facts.
  • Provide the information free of charge. Article 12 also requires the to help people exercise their data-subject rights.
Section 2

Use Article 13 when data is collected from the person

For forms, account sign-up, checkout, job applications, support chats, newsletter sign-ups, events, identifiers collected from a person's device, and other direct collection points, information is due at the time the personal data is obtained.

The notice should describe the processing purpose by purpose. If the same person gives data for account creation, billing, fraud prevention, analytics, marketing, and support, each purpose needs its own lawful basis, recipient position, retention position, and rights context.

  • Identify the and, where applicable, the controller's representative.
  • Give the DPO contact details where a DPO applies.
  • State the purposes of processing and the legal basis for each purpose.
  • If relying on legitimate interests under Article 6(1)(f), identify the interests pursued by the or a third party.
  • Name the recipients or categories of recipients, if any, such as payment providers, hosting providers, CRM providers, professional advisers, group entities, or public authorities where disclosure applies.
  • For transfers to a third country or international organisation, state whether there is an adequacy decision or refer to the Article 46 or Article 47 safeguards, or the suitable safeguards for a transfer under the second subparagraph of Article 49(1), and how the person can obtain a copy or find them.
  • State the storage period or the criteria used to determine it.
  • Explain the rights to access, rectification, erasure, restriction, objection, and portability where they apply, plus consent withdrawal where consent is the basis.
  • Explain the right to lodge a complaint with a supervisory authority.
  • Say whether providing the data is statutory, contractual, or necessary to enter into a contract, and describe the consequences of not providing it.
  • Disclose the existence of covered by Article 22(1) or (4), including profiling, and give meaningful information about the logic involved, its significance, and its envisaged consequences for the person.
  • does not require the to repeat information the person already has, but the controller should be able to show what information was already provided.
Section 3

Use Article 14 when data comes from another source

applies when the did not collect the personal data from the person. Common examples include data bought from a broker, received from a partner or group company, collected from public sources, supplied by an employer, customer, referrer, or fraud-prevention service, or inferred or generated from data obtained elsewhere. In its 28 November 2024 judgment in C-169/23, the Court of Justice confirmed that Article 14 also covers data the controller generates from data not collected directly from the person.

The notice overlaps with , but it adds the categories of personal data concerned and the source from which the data originates, including whether it came from publicly accessible sources.

  • Provide the identity, representative information where applicable, and DPO contact details where applicable.
  • State purposes and legal basis, including the specific legitimate interest where Article 6(1)(f) is used.
  • List the categories of personal data concerned because the person did not provide the data directly.
  • State recipients or categories of recipients, if any.
  • Give the transfer position for third countries or international organisations, including adequacy or safeguards where applicable.
  • State the storage period or retention criteria.
  • Explain rights to access, rectification, erasure, restriction, objection, portability, and consent withdrawal where they apply, plus the right to complain to a supervisory authority.
  • Identify the source of the data and say whether it came from publicly accessible sources where that applies.
  • Disclose covered by Article 22(1) or (4), including profiling, and explain the logic, significance, and envisaged consequences.
  • Deliver the information within a reasonable period after obtaining the data and no later than one month. If the communicates with the person sooner, provide it by that first communication; if disclosure to another recipient comes first, provide it no later than the first disclosure.
Section 4

Apply Article 14 timing and exceptions narrowly

Treat one month as the latest deadline. The must choose a reasonable delivery time for the circumstances and give the notice sooner if it communicates with the person or first discloses the data before then.

(5) has limited exceptions. The must identify the exact exception, document why it applies, and meet any safeguard conditions. A difficult or expensive notification exercise does not by itself establish disproportionate effort.

  • Information already held: duties do not apply to the extent the person already has the information.
  • Impossible, disproportionate effort, or serious impairment: (5)(b) is especially directed to public-interest archiving, scientific or historical research, and statistical processing subject to Article 89(1). The must take appropriate protective measures, including making the information publicly available.
  • Obtaining or disclosure laid down by law: (5)(c) applies only where Union or Member State law applicable to the expressly provides for the obtaining or disclosure and includes appropriate measures to protect the person's legitimate interests.
  • Professional secrecy: (5)(d) applies where Union or Member State law requires the personal data to remain confidential under professional or statutory secrecy.
  • Direct collection: provides no impossibility or disproportionate-effort exception for notice at the collection point.
Section 5

Keep recipients, transfers, and safeguards specific

Do not describe sharing only with a broad partner label. Articles 13 and 14 require recipients or categories of recipients, if any, and separate information where the intends to transfer personal data to a third country or international organisation.

For international transfers, the notice should say whether the transfer relies on an adequacy decision or on another safeguard. Where Article 46, Article 47, or the second subparagraph of Article 49(1) is relevant, the notice must refer to the safeguards and say how to obtain a copy or where they are available.

  • Use named recipients where the recipient is stable and meaningful to the person; use precise categories where names change often.
  • Separate processors, independent controllers, joint controllers, group entities, public authorities, and professional advisers where those categories are used.
  • Do not list speculative recipient categories that are not used in the actual processing flow.
  • For transfers, record the destination country or international organisation, the transfer mechanism, and where the safeguard can be reviewed.
  • Keep the public notice aligned with processor terms, transfer impact records, SCC records, and the record of processing activities.
Section 6

Make retention, lawful basis, and rights testable

Maintain a matching evidence record for each processing purpose. The public notice should not state a basis, retention period, recipient list, or transfer safeguard that the record of processing, contract file, data map, or product implementation cannot support.

Review the notice when a purpose changes, a new recipient receives data, a new data source is added, data moves to a third country, retention rules change, or is introduced. Articles 13(3) and 14(4) require the to give information about a new purpose, and the relevant additional information, before further processing begins.

When does a GDPR notice need content?

Use when the collects personal data from the person. The information must be provided at the time the personal data is obtained.

When does a GDPR notice need content?

Use when the did not collect the personal data directly from the person. This includes data received from someone else and data the controller generates from data obtained elsewhere. The notice must include the categories of personal data and the source, including whether it was publicly accessible.

What should a GDPR transparency notice say about retention?

It should state the period for which the personal data will be stored. If a fixed period is not possible, it should state the criteria used to determine that period.

What should a GDPR transparency notice say about international transfers?

It should say whether personal data is transferred to a third country or international organisation and, where applicable, whether there is an adequacy decision or which safeguard applies and how the person can obtain a copy or find it.

Can a skip an notice because contacting everyone is difficult?

Not for that reason alone. The must satisfy a specific (5) exception. If it relies on impossibility, disproportionate effort, or serious impairment under Article 14(5)(b), it must document the assessment and take appropriate measures to protect people, including making the information publicly available.

Can a GDPR privacy notice use layers?

Yes. A can put the most important information at the collection point and link directly to complete details. The must still provide every applicable or 14 item in a concise, clear, accessible, and easy-to-find form.

  • For each purpose, store the Article 6 lawful basis, any Article 9 condition for special-category data, and the official-authority or Union or Member State law relied on for criminal-conviction or offence data under Article 10.
  • For consent, include how the person can withdraw consent and keep the notice wording consistent with the consent interface.
  • For legitimate interests, name the specific interest rather than using a generic phrase.
  • For retention, state a fixed period where possible; otherwise state objective criteria such as account status, contract duration, legal limitation period, dispute hold, or statutory retention requirement.
  • For rights, explain the request channel and make objection, portability, consent withdrawal, and complaint language visible where those rights are relevant to the processing.
  • For data, keep a source register that distinguishes partner-provided data, customer-provided third-party data, public-source data, purchased data, and internally inferred data.
Recommended next step

This guide helps check every public privacy notice against Articles 12, 13 and 14

Sorena can help map each notice section to the underlying purpose, lawful basis, recipient, transfer safeguard, retention rule, rights workflow, and data source.

Research workflow
Open Research Copilot for EU GDPR

Ask questions tied to cited sources about GDPR notice content, Article 13 direct collection, Article 14 source disclosures, transfers, retention, and data subject rights.

Explore next step
Talk to Sorena
Talk through implementation

Review your GDPR transparency notices against processing purposes, data sources, recipients, transfers, retention rules, and rights workflows.

Explore next step
Primary sources

References and citations

Regulation (EU) 2016/679 (GDPR)
eur-lex.europa.eu7 citations
Referenced sections
  • Binding GDPR source for Article 12 communication standards, Article 13 direct-collection notice content, Article 14 indirect-source notice content, retention criteria, rights, recipients, and transfer disclosures.
  • Article 12 requires Article 13 and 14 information to be concise, transparent, intelligible, easily accessible, and in clear plain language.
  • Article 13 lists the notice information required when personal data is collected from the data subject.
Show 4 more
  • Article 14 covers notice content, source disclosure, and timing where personal data was not obtained from the data subject.
  • Article 14(3) sets the timing triggers and Article 14(5) states the exceptions and safeguard conditions.
  • Articles 13 and 14 require recipient information and transfer information; Chapter V sets the general GDPR transfer rule.
  • Articles 13 and 14 require legal basis, retention, rights, source, and further-purpose information in privacy notices.
"concise, transparent, intelligible and easily accessible"
More quoted passages
"at the time when personal data are obtained"
"from which source the personal data originate"
"recipients or categories of recipients"
"the purposes of the processing"
Article 29 Working Party Guidelines on transparency under Regulation 2016/679, endorsed by the EDPB
edpb.europa.eu4 citations
Referenced sections
  • Official EDPB-hosted guidance for layered notices, accessibility, timing, changes, further processing, and narrow use of Article 14 exceptions.
  • Explains layered notices, first-layer priorities, accessibility, child-directed language, and the practical presentation of Articles 12 to 14 information.
  • Explains that Article 14 exceptions should be applied narrowly and gives the documented assessment and protective measures expected for impossibility or disproportionate effort.
Show 1 more
  • Supports layered presentation and explains notice changes, further-purpose information, and timing before further processing.
Court of Justice judgment of 28 November 2024, C-169/23
eur-lex.europa.eu2 citations
Referenced sections
  • Binding interpretation confirming that Article 14 covers personal data generated by a controller from data not collected directly from the data subject.
  • Confirms that Article 14 covers both data obtained from someone other than the data subject and data generated by the controller from data not collected directly from the data subject.
European Commission - Standard Contractual Clauses
commission.europa.eu2 citations
Referenced sections
  • Commission source for standard contractual clauses as a GDPR transfer safeguard for data transfers from the EU to third countries.
  • Commission source for standard contractual clauses as a GDPR transfer safeguard for EU-to-third-country transfers.
"Standard contractual clauses"

Related guides

EU GDPR Applicability Test for Products, Vendors, and Data Flows

A concrete GDPR scope test for personal data, controller and processor roles, EU establishment, EU targeting or monitoring, special-category and child data, transfers, vendors, and evidence.

EU GDPR Article 30 RoPA Intake Workflow

This GDPR Article 30 RoPA intake workflow helps capture controller and processor fields, owners, transfers, retention, security measures, and evidence before a processing activity goes live.

EU GDPR Automated Decision-Making and Profiling: Article 22 Scope, Safeguards, and Evidence

GDPR guide to profiling and Article 22 decisions: scope, transparency, lawful basis, DPIA triggers, safeguards, human intervention, challenge rights, and evidence.

EU GDPR Breach Notification 72 Hours: Article 33 and 34 workflow

EU GDPR breach notification workflow covering awareness, 72-hour supervisory authority notices, processor escalation, high-risk data-subject communication, delay reasons, and evidence logs.

EU GDPR Breach Notification Workflow: 72-hour clock, risk assessment, and records

A concrete EU GDPR breach notification workflow for detecting and triaging incidents, starting the awareness clock, assessing risk, notifying authorities or data subjects, and keeping Article 33 records.

EU GDPR Checklist: scope, lawful basis, DSARs, DPIA, RoPA, transfers

This GDPR checklist helps review scope, lawful basis, notices, DSAR handling, DPIAs, RoPA, processor contracts, SCC transfers, breach notification, retention, security, and evidence.

Show all related guides (39)

EU GDPR Children and Special-Category Data Guide

GDPR guide to children's consent and special-category data: Article 8 national age variation, Article 9 conditions, transparency, DPIA triggers, safeguards, and evidence.

EU GDPR Compliance Checklist: scope, rights, DPIA, RoPA, transfers

Practical EU GDPR compliance guide for mapping scope, lawful basis, notices, data-subject rights, DPIAs, RoPA, processor terms, breaches, transfers, retention, security, and penalties.

EU GDPR Controller, Processor, and Joint Controller Roles

Classify GDPR controllers, processors, and joint controllers from actual decision-making, then document Article 26 allocation, Article 28 terms, instructions, and vendor evidence.

EU GDPR Data Subject Rights and DSAR Workflow

GDPR rights-request workflow for intake, identity checks, request scope, the one-month response clock, extensions, refusals, processor coordination, and evidence.

EU GDPR deadlines and compliance calendar

EU GDPR calendar for calculating rights-request deadlines, breach notification, DPIA and prior-consultation gates, transfer reviews, and retention checks.

EU GDPR DPIA and Prior Consultation Workflow

Screen high-risk processing, run a GDPR Article 35 DPIA, record mitigation, and identify when Article 36 prior consultation is required.

EU GDPR DPIA and risk management under Articles 35 and 36

EU GDPR DPIA guide covering Article 35 triggers and contents, CNIL and DPC PIA methods, residual risk, mitigation records, and prior consultation limits.

EU GDPR DSAR Workflow: Intake, Clock, Rights, and Evidence

Run a GDPR DSAR workflow for intake, identity checks, rights scoping, one-month response timing, extensions, refusals, processor handoffs, and evidence records.

EU GDPR FAQ: scope, lawful basis, rights, DPIA, breaches, transfers

Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers.

EU GDPR International Transfers and SCCs: Chapter V evidence guide

GDPR Chapter V guide to adequacy decisions, SCCs, transfer assessments, supplementary measures, Article 49 derogations, and EU-US DPF checks.

EU GDPR Lawful Basis and Consent Guide

Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records.

EU GDPR Lawful Basis and LIA Workflow for Article 6(1)(f)

Assess GDPR legitimate interests with a purpose, necessity, balancing, Article 21 objection, and evidence-record workflow based on Article 6(1)(f).

EU GDPR Lead Supervisory Authority and One-Stop-Shop

How GDPR main establishment, cross-border processing, Article 56 lead authority competence, and Article 60 cooperation fit together.

EU GDPR LIA Template for Article 6(1)(f)

This EU GDPR legitimate interests assessment template helps document Article 6(1)(f) purpose, necessity, balancing, safeguards, objection rights, and evidence.

EU GDPR penalties and fines: Article 83 tiers and evidence

EU GDPR penalties guide covering Article 83 fine ceilings, the EDPB calculation method, CJEU conditions, Article 58 powers, and evidence.

EU GDPR Processor Contracts and Vendor Management | Article 28 Evidence Guide

EU GDPR Article 28 guide for processor contracts, sub-processor controls, controller-processor role boundaries, vendor evidence, and SCC transfer clauses where applicable.

EU GDPR Record of Processing Activities Template: Article 30 RoPA Fields

Build a GDPR Article 30 record of processing activities with separate controller and processor fields for purposes, data categories, recipients, transfers, erasure time limits, and security measures.

EU GDPR Requirements: scope, rights, security, DPIA, RoPA, and transfers

Overview of core EU GDPR requirements covering scope, principles, lawful basis, notices, data-subject rights, processors, RoPA, security, breaches, DPIAs, and international transfers.

EU GDPR Retention and Erasure Schedule

Build an EU GDPR retention and erasure schedule with purpose-based periods, expiry actions, Article 17 decisions, recipient notices, and deletion evidence.

EU GDPR Transfer TIA and SCC Workflow

A GDPR workflow for checking adequacy, selecting SCC modules, documenting transfer impact assessments, and recording supplementary measures for third-country transfers.

EU GDPR vs Brazil LGPD: scope, legal bases, rights, incidents, and transfers

Compare EU GDPR and Brazil LGPD scope, actors, legal bases, rights timing, security incidents, international transfers, evidence, regulators, and penalties.

EU GDPR vs California CCPA: scope, rights, opt-outs, and evidence

Compare EU GDPR and California CCPA scope, roles, consumer rights, response times, sale and sharing opt-outs, risk assessments, contracts, transfers, and enforcement.

EU GDPR vs ePrivacy Directive: personal data, cookies, consent, and communications

Compare the EU GDPR and ePrivacy Directive for personal data processing, consent and lawful basis, cookies and terminal access, electronic communications, and parallel compliance.

EU GDPR vs UK GDPR: Scope, Rights, Transfers, and Evidence

Compare the EU GDPR and amended UK GDPR across scope, rights, automated decisions, accountability, breaches, regulators, and international transfers.

GDPR vs EU AI Act: privacy controls for AI systems

Map the GDPR work that remains necessary when an AI system processes personal data, including lawful basis, notices, DPIAs, Article 22, rights, security, records, and transfers.

GDPR vs EU Data Act: personal data, connected products, and access rights

Compare GDPR privacy duties with EU Data Act rights and duties for connected-product data, third-party access, data holders, users, contracts, cloud switching, and enforcement.

Does the EU GDPR apply outside the EU under Article 3?

A GDPR Article 3 territorial-scope FAQ covering EU establishment, non-EU targeting, monitoring in the EU, public-international-law cases, and Article 27 representatives.

EU GDPR Article 6 Legal Bases FAQ

FAQ on the six Article 6 GDPR lawful bases, consent caveats, legitimate interests, public-task and legal-obligation limits, and Article 9 special-category data.

EU GDPR DSAR Exceptions: refusal, extensions, identity checks

FAQ on when EU GDPR controllers may extend, charge for, narrow, redact, or refuse a data subject access request under Articles 12 and 15.

EU GDPR SCC Transfer Impact Assessment FAQ

FAQ on when SCC transfer impact assessments are needed, what Clause 14 records, and when supplementary safeguards or transfer suspension are required.

GDPR processor vs controller: role boundaries and evidence

Decide whether a party is a GDPR controller, processor, or joint controller using purpose-and-means tests, Article 28 terms, Article 26 arrangements, and Article 30 records.

When does the EU GDPR require a DPIA?

Answer the EU GDPR DPIA threshold question with Article 35 triggers, high-risk criteria, supervisory-authority list checks, and DPIA content requirements.

When does the GDPR 72-hour breach notification clock start?

GDPR breach-awareness FAQ covering the Article 33 clock, processor escalation, delayed or phased notifications, risk assessment, and records to keep.