GDPR Art. 12 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this article. Contains: the article text, related recitals, cases citing it, enforcement stats and top fines, guidance, and related topics. Everything links back to its source on overview.legal — legal information, not advice.

Transparent information, communication and modalities for the exercise of the rights of the data subject

Information Provision Modalities and Communication Methods Personal Data
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679
  1. 1.

    The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.

    Information Provision Modalities and Communication Methods Personal Data Controllers 81
  2. 2.

    The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject.

    Personal Data Controllers 51
  3. 3.

    The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.

    Personal Data Controllers 46
  4. 4.

    If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

    Supervisory Authorities Supervision Personal Data 5
  5. 5.

    Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:

    Personal Data Controllers 15
    1. a)
      charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or
    2. b)
      refuse to act on the request.
    3. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.
      Controllers
  6. 6.

    Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

    Personal Data Controllers 2
  7. 7.

    The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing. Where the icons are presented electronically they shall be machine-readable.

    4
  8. 8.

    The Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons.

Enforcement

Cited in 452 fines totalling €1.2B

Top authority: 🇪🇺Italian Data Protection Authority (Garante) (155) · median fine €11,500 · see all enforcement for Art. 12 →

Connections by provision

12(1) 68 Case Law 12 Guidance 1 News .md
Case Law 68
Judgment of the Court (Grand Chamber) of 10 February 2026.#WhatsApp Ireland Ltd v European Data Protection Board.#Appeal – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 63 – Consistency mechanism – Article 65 – Dispute resolution by the European Data Protection Board – Binding decision – Action for annulment – First paragraph of Article 263 TFEU – Act open to challenge – Fourth paragraph of Article 263 TFEU – Condition that the Judgment of the Court (First Chamber) of 22 June 2023.#Proceedings brought by J.M.#Request for a preliminary ruling from the Itä-Suomen hallinto-oikeus.#Reference for a preliminary ruling – Processing of personal data – Regulation (EU) 2016/679 – Articles 4 and 15 – Scope of the right of access to information referred to in Article 15 – Information contained in log data – Article 4 – Definition of ‘personal data’ – Definition of ‘recipients’ – Temporal application.#Case C-579/21. Judgment of the General Court (Fourth Chamber) of 20 July 2016 (Extracts).#Athanassios Oikonomopoulos v European Commission.#Non-contractual liability — Damage caused by the Commission in the context of an OLAF investigation and by OLAF — Actions for damages — Action for a declaration that certain measures taken by OLAF were void and inadmissible for evidentiary purposes before the national authorities — Admissibility — Misuse of powers — Processing of personal data — Rights of the defence.#Case Österreichische Datenschutzbehörde v CRIF BGH refers to CJJH whether available interim injunction affects delisting balance under Judgment of the Court (Fifth Chamber) of 14 March 2024.#Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala v Nemzeti Adatvédelmi és Információszabadság Hatóság.#Request for a preliminary ruling from the Fővárosi Törvényszék.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 58(2)(d) and (g) – Powers of the supervisory authority of a Member State – Paragraph 17(1) – Right to e BVwG - W256 2227693-1 Judgment of the Court (Third Chamber) of 16 February 2023.#HYA and Othersprokuratura.#Request for a preliminary ruling from the Spetsializiran nakazatelen sad.#Reference for a preliminary ruling – Telecommunications sector – Processing of personal data and the protection of privacy – Directive 2002/58 – Article 15(1) – Restriction of the confidentiality of electronic communications – Judicial decision authorising the interception, recording and storage of telephone conversations of persons suspe +60 more
Guidance 12
EDPB Annual Report 2021 EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro EDPB-EDPS Joint Opinion 2/2021 on standard contractual clauses for the transfer of personal data to third countries EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse Guidelines 8/2020 on the targeting of social media users EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Guidelines 02/2021 on virtual voice assistants +4 more
News 1
CJEU: PNR Directive Valid if Limited to the “Strictly Necessary”
12(2) 41 Case Law 9 Guidance 1 Literature .md
Case Law 41
Judgment of the Court (Second Chamber) of 15 March 2017.#Tele2 (Netherlands) BV and Others v Autoriteit Consument en Markt (ACM).#Request for a preliminary ruling from the College van Beroep voor het Bedrijfsleven.#Reference for a preliminary ruling — Electronic communications networks and services — Directive 2002/22/EC — Article 25(2) — Directory enquiry services and directories — Directive 2002/58/EC — Article 12 — Directories of subscribers — Making available personal data concerning subscri Judgment of the Court (Fourth Chamber) of 27 October 2022.#Proximus NV v Gegevensbeschermingsautoriteit.#Request for a preliminary ruling from the Hof van beroep te Brussel.#Reference for a preliminary ruling – Processing of personal data and protection of privacy in the electronic communications sector – Directive 2002/58/EC – Article 12 – Public telephone directories and directory enquiry services – Subscriber’s consent – Obligations of the provider of directories and of directory enquiry serv Judgment of the Court (First Chamber) of 13 November 2025.#Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).#Request for a preliminary ruling from the Curtea de Apel Bucureşti.#Reference for a preliminary ruling – Processing of personal data and the protection of privacy in the electronic communications sector – Directive 2002/58/EC – Article 13(1) and (2) – Unsolicited communications – Concept of communication ‘for the purposes of di CJEU - C-543/09 - Deutsche Telekom Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers Cour Administrative - 49701C Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers ¶44 Judgment of the Court (Grand Chamber) of 20 September 2022.#Criminal proceedings against VD bd]
 
 Criminal proceedings against VD and SR.#Requests for a preliminary ruling from the Cour de cassation.#References for a preliminary ruling – Single market for financial services – Market abuse – Insider dealing – Directive 2003/6/EC – Article 12(2)(a) and (d) – Regulation (EU) No 596/2014 – Article 23(2)(g) and (h) – Supervisory and investigatory powers of the Autorité des marchés financiers +33 more
Guidance 9
EDPB Annual Report 2021 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Statement 2/2025 on the implementation of the PNR Directive in light of CJEU Judgment C-817/19 EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) EDPB Annual Report 2023 EDPB Annual Report 2022 EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro Guidelines 01/2022 on data subject rights - Right of access +1 more
Literature 1
The data subject’s right to access to information under GDPR and the right of the data controller to protect its know-how
12(3) 35 Case Law 10 Guidance 1 News .md
Case Law 35
Judgment of the Court (Second Chamber) of 15 March 2017.#Tele2 (Netherlands) BV and Others v Autoriteit Consument en Markt (ACM).#Request for a preliminary ruling from the College van Beroep voor het Bedrijfsleven.#Reference for a preliminary ruling — Electronic communications networks and services — Directive 2002/22/EC — Article 25(2) — Directory enquiry services and directories — Directive 2002/58/EC — Article 12 — Directories of subscribers — Making available personal data concerning subscri Judgment of the Court (Fourth Chamber) of 27 October 2022.#Proximus NV v Gegevensbeschermingsautoriteit.#Request for a preliminary ruling from the Hof van beroep te Brussel.#Reference for a preliminary ruling – Processing of personal data and protection of privacy in the electronic communications sector – Directive 2002/58/EC – Article 12 – Public telephone directories and directory enquiry services – Subscriber’s consent – Obligations of the provider of directories and of directory enquiry serv Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers Judgment of the General Court (Fourth Chamber) of 20 July 2016 (Extracts).#Athanassios Oikonomopoulos v European Commission.#Non-contractual liability — Damage caused by the Commission in the context of an OLAF investigation and by OLAF — Actions for damages — Action for a declaration that certain measures taken by OLAF were void and inadmissible for evidentiary purposes before the national authorities — Admissibility — Misuse of powers — Processing of personal data — Rights of the defence.#Case BVwG - W291 2298748-1 Österreichische Datenschutzbehörde v CRIF BVwG - W252 2247042-1 VG München - M 26a K 25.5210 +27 more
Guidance 10
EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) EDPB Annual Report 2023 EDPB Annual Report 2021 Guidelines 01/2022 on data subject rights - Right of access Guidelines 04/2022 on the calculation of administrative fines under the GDPR Opinion 3/2025 on the draft decision of the French Supervisory Authority (FR SA) regarding the “Lexing GDPR certification criteria” EDPB Annual Report 2022 Recommendations 1/2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR) +2 more
News 1
Rb. Rotterdam - ROT 25/8349, 25/8350, 25/6295, 25/6296 and 25/6297
12(4) 1 Case Law 4 Guidance .md
Case Law 1
AG Arnsberg - 42 C 434/23
Guidance 4
EDPB-EDPS Joint Opinion 2/2021 on standard contractual clauses for the transfer of personal data to third countries EDPB Annual Report 2021 Guidelines 01/2022 on data subject rights - Right of access ¶108 EDPB-EDPS Joint Opinion 2/2021 on standard contractual clauses for the transfer of personal data to third countries
12(5) 9 Case Law 4 Guidance 1 Literature 1 News .md
Case Law 9
Rb. Den Haag - C/09/689833 Judgment of the Court (First Chamber) of 12 January 2023.#RW v Österreichische Post AG.#Request for a preliminary ruling from the Oberster Gerichtshof.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 15(1)(c) – Data subject’s right of access to his or her data – Information about the recipients or categories of recipient to whom the personal data have been or will be disclosed – Restrictions.#C VG München - M 26a K 25.5210 Rb. Noord-Holland - C/15/376188 AG Arnsberg - 42 C 434/23 CJEU - C-526/24 - Brillen Rottler ¶51 Judgment of the Court (First Chamber) of 12 January 2023.#RW v Österreichische Post AG.#Request for a preliminary ruling from the Oberster Gerichtshof.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 15(1)(c) – Data subject’s right of access to his or her data – Information about the recipients or categories of recipient to whom the personal data have been or will be disclosed – Restrictions.#C ¶5.14.3 Rb. Den Haag - C/09/689833 +1 more
Guidance 4
Opinion 15/2025 on the draft decision of the Austrian Supervisory Authority (AT SA) regarding the certification criteria of BDO Consulting GmbH Guidelines 01/2022 on data subject rights - Right of access Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s) Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria
Literature 1
The Court of Justice on the Excessiveness of Access Requests under the GDPR
News 1
Rb. Rotterdam - ROT 25/8349, 25/8350, 25/6295, 25/6296 and 25/6297
12(5)(a) 5 Guidance .md
Guidance 5
Guidelines 04/2022 on the calculation of administrative fines under the GDPR Guidelines 01/2022 on data subject rights - Right of access Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria ¶57 Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria ¶46 Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria
12(5)(b) 4 Case Law 1 Literature .md
Case Law 4
CJEU - C-526/24 - Brillen Rottler AG Arnsberg - 42 C 434/23 Judgment of the Court (First Chamber) of 12 January 2023.#RW v Österreichische Post AG.#Request for a preliminary ruling from the Oberster Gerichtshof.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 15(1)(c) – Data subject’s right of access to his or her data – Information about the recipients or categories of recipient to whom the personal data have been or will be disclosed – Restrictions.#C ¶49 Judgment of the Court (First Chamber) of 12 January 2023.#RW v Österreichische Post AG.#Request for a preliminary ruling from the Oberster Gerichtshof.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 15(1)(c) – Data subject’s right of access to his or her data – Information about the recipients or categories of recipient to whom the personal data have been or will be disclosed – Restrictions.#C
Literature 1
The data subject’s right to access to information under GDPR and the right of the data controller to protect its know-how
12(6) 2 Guidance .md
Guidance 2
EDPB Annual Report 2022 Guidelines 01/2022 on data subject rights - Right of access
12(7) 3 Guidance 1 Literature .md
Guidance 3
Contribution of the EDPB to the evaluation of the GDPR under Article 97 EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space ¶27 EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space
Literature 1
General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens?

Related across sources

Enforcement NAIH fines online store HUF 2M for unclear and incomplete privacy notice Case Law Rb. Noord-Holland - C/15/376188 Enforcement IMY reprimands Swedish Police for inadequate GDPR Article 13 info at Arlanda border Case Law AG Arnsberg - 42 C 434/23 News The Italian SA imposed a 40 000 EUR fine on a company for violating the confidentiality of a employee's email account after the end of his employment Enforcement HDPA (Greece) examines deletion request from National Registry of Undesirable Aliens