Information Provision Modalities and Communication Methods

Legal Framework

Article 12 GDPR establishes the overarching requirements for how controllers must communicate with data subjects, setting standards that are distinct from the substantive content of the information itself. The provision mandates that any information relating to processing — whether provided under Articles 13 and 14 (transparency obligations), or in response to rights exercised under Articles 15 through 22 — must be delivered in a "transparent, intelligible and easily accessible form, using clear and plain language." This modality requirement applies across the full spectrum of data subject interaction, from initial privacy notices to responses to access requests.

Article 12(8) further empowers the European Commission to adopt delegated acts specifying standardized icons to present information in an easily visible, intelligible, and clearly legible manner. This mechanism targets non-essential elements of the legislative act, allowing the Commission to refine how information is visually communicated without altering the core obligations. The rationale is straightforward: the effectiveness of data subject rights depends not only on what information is disclosed but on whether the recipient can actually comprehend and use it.

The AI Act complements this framework at Article 13, which addresses transparency and information provision to deployers of AI systems, extending the principle of intelligible communication into the AI governance domain.

Key Developments

The Court of Justice's jurisprudence under the predecessor Directive 95/46 — which Article 12 GDPR codifies and extends — established that a data subject does not automatically have a right to receive a physical copy of the document on which their data is recorded, provided the objective of the access right can be fully satisfied through another form of provision. This principle carries forward: the modality of communication must serve the purpose of enabling the data subject to exercise their rights effectively, but the controller retains flexibility in choosing the appropriate means.

Dutch administrative courts have rigorously enforced the Article 12(1) quality standards. In a March 2025 ruling, a court examined whether information provided in response to an access request met the transparency and accessibility requirements, with the applicant specifically challenging the form of communication under Article 12(1). The court's analysis confirms that the modality standard is justiciable — data subjects can challenge not only the completeness of information but the manner of its delivery.

The EDPB's Guidelines 01/2022 on the right of access reinforce that the right of access, anchored in Article 8 of the EU Charter of Fundamental Rights, requires controllers to provide information in a way that genuinely enables comprehension, not merely formal compliance.

Practical Guidance

• Assess the recipient's context before communicating. Article 12(1) requires clear and plain language — this is a contextual standard. Information directed at a child, an employee, or a consumer requires different linguistic registers and formatting choices.

• Provide access in a format that fulfills the purpose of the request. A literal copy of the underlying document is not always required; an intelligible summary or structured extract may suffice, provided it fully satisfies the data subject's right to verify lawfulness and exercise subsequent rights.

• Implement searchable, structured responses to access requests. When processing large volumes of data, Article 12(3) and recital 63 permit controllers to ask data subjects to specify the information or processing activities their request relates to — but this narrowing mechanism must itself be communicated transparently and cannot be used to obstruct legitimate requests.

• Document the modality choices made. If a controller chooses a particular communication format over another, the reasoning should be recorded. Courts and DPAs will assess whether the chosen modality genuinely enabled the data subject to understand and act on the information provided.

• Monitor standardized icon developments. The Commission's delegated act authority under Article 12(8) may introduce mandatory visual formats for certain categories of information; controllers should track these developments and be prepared to integrate standardized icons into privacy notices and access responses.