Last updated: 24 October 2026
Quick answer: Privacy notice requirements under the GDPR are set by Articles 12, 13 and 14. You must tell people who you are, why and on what legal basis you use their data, who receives it, how long you keep it, and what rights they have, in clear language, at collection or within one month if data comes from elsewhere.
A privacy notice is often the only part of a data protection programme that the public ever reads. It is also one of the first documents a regulator looks at, and transparency failures have led to some of the largest GDPR fines to date.
This guide sets out exactly what Articles 13 and 14 require, when the information must be given, which exceptions apply, how the UK position has moved under the Data (Use and Access) Act 2025, and a checklist you can use to review your own notice.
What are the GDPR privacy notice requirements?
The GDPR requires controllers to give individuals specific information about the processing of their personal data, in a concise, transparent, intelligible and easily accessible form, using clear and plain language. The content depends on whether you collect the data from the person directly (Article 13) or from another source (Article 14).
Article 12 of the GDPR sets the “how”: the information must be provided in writing or by other means, including electronically where appropriate, free of charge, and in language suitable for the audience, with particular care where it is addressed to a child. Articles 13 and 14 set the “what”. Together they form the right to be informed, the first of the data subject rights in Chapter III.
The European Data Protection Board has endorsed the Article 29 Working Party’s Guidelines on transparency (WP260 rev.01), which explain how supervisory authorities interpret these articles, including layered notices and how to communicate changes.
What must a privacy notice include under Articles 13 and 14?
Both articles require the same core information, with Article 14 adding the categories of data and its source. The table below lists each item and which article requires it.
| Information | Article 13 (direct) | Article 14 (indirect) |
|---|---|---|
| Identity and contact details of the controller (and its representative, if any) | Yes | Yes |
| Contact details of the data protection officer, where appointed | Yes | Yes |
| Purposes of processing and the legal basis for each | Yes | Yes |
| Legitimate interests pursued, where that is the legal basis | Yes | Yes |
| Categories of personal data concerned | No | Yes |
| Recipients or categories of recipients | Yes | Yes |
| International transfers and the safeguards relied on | Yes | Yes |
| Retention period, or the criteria used to set it | Yes | Yes |
| Data subject rights (access, rectification, erasure, restriction, objection, portability) | Yes | Yes |
| Right to withdraw consent, where consent is the basis | Yes | Yes |
| Right to lodge a complaint with a supervisory authority | Yes | Yes |
| Whether providing data is a statutory or contractual requirement, and the consequences of not providing it | Yes | No |
| Source of the data, including whether from publicly accessible sources | No | Yes |
| Automated decision-making, including profiling, with meaningful information about the logic and consequences | Yes | Yes |
If you later want to use the data for a new purpose, Articles 13(3) and 14(4) require you to give information about that purpose, and the other relevant information, before the further processing starts.
Common mistake: listing legal bases in one block and purposes in another. Regulators expect you to link each purpose to its legal basis, so a reader can see, for example, that marketing relies on consent while payroll relies on legal obligation. A well-maintained record of processing activities makes this mapping far easier, because each processing activity already carries its purpose, basis, recipients and retention period.
When must privacy information be provided?
Under Article 13, at the time you collect the data. Under Article 14, within a reasonable period and at the latest within one month of obtaining it, or earlier if you first contact the person or disclose the data to someone else.
- Direct collection: at the point of collection, for example on the form, in the app sign-up flow, or at the start of a call.
- Indirect collection, general rule: within a reasonable period, and no later than one month, having regard to the circumstances.
- Indirect collection, used to communicate: at the latest at the time of the first communication with the person.
- Indirect collection, disclosed to another recipient: at the latest when the data is first disclosed.
In practice: “provided” means actively communicated or made easily accessible at the right moment. A link in a website footer may be enough for visitors browsing a site, but it does not reach a job applicant whose CV you received from a recruiter.
Are there exceptions to the right to be informed?
Yes, but they are narrow. Under Article 13 the only exception is that the person already has the information. Article 14 adds exceptions for impossibility or disproportionate effort, obtaining or disclosure required by law, and professional secrecy.
Under Article 14(5), even where providing information would involve disproportionate effort, the controller must take appropriate measures to protect the person’s rights, including making the information publicly available. The UK regulator’s guidance on exceptions to the right to be informed adds that organisations relying on this exception should still publish privacy information and carry out a data protection impact assessment.
How has the UK position changed?
The Data (Use and Access) Act 2025 amended the UK GDPR’s transparency rules. Section 77 of the Act, on information to be provided to data subjects, came into force on 5 February 2026 under the Commencement No. 6 Regulations. According to the ICO, it means organisations do not have to give privacy information for further processing of personal data collected directly for research purposes where that would be impossible or involve disproportionate effort, provided they protect people’s rights in other ways, such as publishing the information.
A separate DUAA change requires UK controllers to handle data protection complaints, a regime that took effect on 19 June 2026. Many organisations now explain in their privacy notice how to complain to them as well as to the ICO.
| Topic | EU GDPR | UK GDPR (as amended) |
|---|---|---|
| Core content | Articles 13 and 14 | Articles 13 and 14, substantively similar |
| Research exception for direct collection | Not in Article 13 | Added by DUAA for further processing for research, where impossible or disproportionate effort |
| Complaint route | Right to complain to a supervisory authority | Complaint to the ICO, plus controller complaint handling since 19 June 2026 |
| Main guidance | EDPB-endorsed WP260 rev.01 | ICO right to be informed guidance, under review after DUAA |
Running notices for both the EU and UK? You can start your 14-day free trial of Enactia’s AI-powered GRC platform to map one set of processing records to both regimes, no credit card needed.
What happens if a privacy notice is not compliant?
Infringing the transparency provisions falls within the higher tier of GDPR fines: up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher, under Article 83(5)(b). Regulators have shown they will use it.
The clearest example is the Irish Data Protection Commission’s decision against WhatsApp Ireland. On 2 September 2021 the DPC announced a EUR 225 million fine following an inquiry into whether WhatsApp had met its GDPR transparency obligations, including information about data sharing with other Facebook companies. The fine was increased after a binding decision of the EDPB, and the DPC also ordered remedial action.
Beyond fines, a weak notice undermines consent, weakens reliance on legitimate interests, and often triggers complaints and access requests. Our article on common mistakes in GDPR compliance covers related pitfalls.
How do you write a compliant privacy notice?
Start from your processing records, not a template. Identify each audience, map purposes to legal bases, write in plain language with a layered structure, and set a review cycle linked to change management.
Privacy notice review checklist
- Know your audiences. Customers, website visitors, employees, candidates and suppliers usually need separate notices or clearly separate sections.
- Start from the ROPA. Pull purposes, legal bases, recipients, transfers and retention from your records, as described in our GDPR ROPA guide.
- Link each purpose to one legal basis. Explain legitimate interests in concrete terms where you rely on them.
- Name recipients meaningfully. Where you use categories, make them specific (for example “payment processors” rather than “third parties”).
- Describe transfers. State where data goes outside the EEA or UK and which safeguard you rely on.
- Give real retention periods. Use periods or clear criteria, not “as long as necessary”.
- Explain rights and how to use them. Link to your data subject request process and give the supervisory authority’s details.
- Cover automated decisions. Explain any profiling or automated decision-making with meaningful information about the logic involved.
- Layer it. Put key points up front, with links to detail, and use just-in-time notices in forms and apps.
- Set ownership and review. Keep the notice under version control in a policy management workflow and review it whenever processing changes, and at least annually.
Where a new project changes processing significantly, update the notice as part of the DPIA process rather than after launch. For a broader view of controller obligations, see our GDPR compliance overview.
Key takeaways
- Articles 12 to 14 of the GDPR set the form, content and timing of privacy information.
- Article 14 adds data categories and source; information must be given within one month at the latest for indirect collection.
- Exceptions are narrow, and disproportionate effort still requires publishing the information.
- In the UK, DUAA transparency changes have applied since 5 February 2026, and controller complaint handling since 19 June 2026.
- Transparency failures sit in the top fine tier, as the EUR 225 million WhatsApp decision shows.
Frequently asked questions
What is the difference between a privacy notice and a privacy policy?
A privacy notice is the external statement that tells individuals how their personal data is used, as required by Articles 13 and 14. A privacy policy is often an internal document setting rules for staff. Many organisations call their public notice a “privacy policy”; the label matters less than whether the content meets the legal requirements.
Do I need a separate privacy notice for employees?
Not legally, but it is usually the clearest approach. Employee processing involves different purposes, legal bases, recipients and retention periods from customer processing, such as payroll, pensions and monitoring. A dedicated notice, given at onboarding and available on the intranet, is easier to understand than a single notice trying to cover every audience.
How quickly must I inform people if I get their data from a third party?
Under Article 14(3), within a reasonable period and no later than one month after obtaining the data. If you use the data to contact the person, you must inform them at the latest at the first communication. If you plan to disclose it to another recipient, you must inform them no later than the first disclosure.
Can a privacy notice be layered?
Yes. Regulators encourage layered notices, where the first layer gives the most important information, such as the controller, purposes, rights and a link to more detail, with further layers providing the full Article 13 or 14 content. Every required item must still be easy to find, and the first layer should not hide anything that would surprise people.
How often should a privacy notice be reviewed?
Review it whenever processing changes, such as a new purpose, supplier, transfer or technology, and at least once a year as part of your accountability programme. For changes that matter to individuals, such as a new purpose, communicate the update actively before the new processing starts rather than silently replacing the text.
Making transparency part of everyday privacy work
The best privacy notices are not written once by a lawyer and forgotten. They are maintained from the same records that drive your ROPA, DPIAs and data subject requests, so that when processing changes, the notice changes with it. That keeps you aligned with the privacy notice requirements in Articles 13 and 14 and gives regulators and individuals an accurate picture.
If you want your privacy notices, processing records and rights requests connected in one place, contact us or book a demo or start your 14-day free trial.
This article is for general information and is not legal advice.
