Recipient

Legal Framework

The GDPR defines "recipient" in Article 4(9) as:

"'recipient' means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not."
— GDPR Art. 4(9)

This definition is deliberately broad: a recipient need not be a third party. It can include processors, joint controllers, or any other body to which data are disclosed. The sole carve-out concerns public authorities receiving data within a specific legal inquiry — they are not treated as recipients, though their subsequent processing remains subject to applicable data protection rules.

Several articles operationalise the concept. Article 14(1)(e) requires controllers to inform data subjects of "the recipients or categories of recipients of the personal data, if any" when data were not obtained from the data subject. Article 14(1)(f) extends this to transfers to recipients in third countries. Article 19 imposes a downstream obligation: controllers must communicate any rectification, erasure, or restriction of processing "to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort." Article 46 governs transfers to recipients outside the EEA, requiring appropriate safeguards such as standard contractual clauses or binding corporate rules.

Key Developments

The CJEU's ruling in RW v Österreichische Post AG clarified the access right's interaction with recipient identification. The Court held that Article 15(1)(c) entails a concrete obligation:

"the data subject's right of access to personal data concerning him or her, provided for by that provision, entails, where those data have been or will be disclosed to recipients, an obligation on the part of the controller to provide the data subject with the actual identity of those recipients, unless it is impossible to identify those recipients"
— RW v Österreichische Post AG ¶51

This establishes a strong default: controllers must name specific recipients, not merely categories, unless identification is genuinely impossible or the request is manifestly unfounded under Article 12(5). The Court confirmed in the same judgment that Article 19 reinforces this by requiring controllers to inform data subjects about recipients upon request.

Earlier, in Rijkeboer, the CJEU struck down national rules limiting storage of recipient information to one year while basic data was retained far longer, finding this did not strike a fair balance unless the controller could show longer storage would be an excessive burden.

The Article 29 WP transparency guidelines reinforce that a recipient "does not have to be a third party" and may be "a data controller, joint controller or processor," confirming the definition's breadth.

Status of the Debate

The definition itself is settled, but its application is actively contested in litigation. The central open question is the threshold for when identifying specific recipients becomes "impossible" or involves "disproportionate effort" under Article 19, and when controllers may resort to categories rather than named recipients under RW v Österreichische Post AG. Courts have not yet drawn a consistent line. A future CJEU reference clarifying the evidentiary burden for demonstrating impossibility would resolve the divergence. Enforcement authorities, including the AEPD and Garante, are applying recipient concepts in direct-marketing and profiling contexts, adding pressure on controllers to maintain granular recipient records.

Practical Guidance

• Record recipient identities, not just categories. RW v Österreichische Post AG establishes that data subjects are entitled to actual recipient names unless identification is genuinely impossible. Maintain logs that link each disclosure to a identifiable recipient.
• Map every disclosure channel. Because Article 4(9) covers processors, joint controllers, and third parties alike, ensure your records include intra-group transfers and processor sub-processor chains.
• Build Article 19 notification workflows. When rectifying, erasing, or restricting data, have a process to notify each recipient unless you can document that doing so is impossible or disproportionately burdensome.
• Disclose recipients in transparency notices. Article 14(1)(e) requires listing recipients or categories when data were not obtained from the data subject; update notices when recipient relationships change materially.
• Document impossibility claims. If you rely on categories rather than named recipients, record the specific reasons why individual identification was not feasible — this is your evidentiary defence under RW v Österreichische Post AG.