This article provides general informational guidance. See Legal Disclaimer.
Short answer. Each time you collect personal data, Articles 13 and 14 GDPR require you to tell people who you are, why you use their data and on what legal basis, who receives it, whether it leaves the EEA, how long you keep it and which rights they hold. Article 13 covers data you collect from the person. Article 14 covers data you obtain elsewhere and adds two items: the categories of data and their source. Article 12 governs the form: concise, clear and easy to find. This year, 25 European data protection authorities are checking these duties in a coordinated action. Recent CNIL decisions point to three recurring faults: purposes with no stated legal basis, missing retention periods and out-of-date transfer information.
- Article 13 (direct collection): 13 mandatory items to provide at the moment of collection, from controller identity and purpose-by-purpose legal bases to retention periods and rights.
- Article 14 (indirect collection): adds the categories of personal data (Art. 14(1)(d)) and their source (Art. 14(2)(f)), due within one month at most or earlier at first contact or disclosure.
- Article 12 (form and accessibility): layered notices (short notice at collection + one-click access to the full policy) and dated written records.
- 2026 coordinated enforcement: 25 supervisory authorities are checking Articles 12 to 14 GDPR, where breaches carry fines up to €20 million or 4% of worldwide annual turnover (Art. 83(5)(b)).
Privacy notices under review in 2026
On 19 March 2026 the European Data Protection Board (EDPB) launched its fifth coordinated enforcement action. Twenty-five supervisory authorities are assessing how controllers meet Articles 12, 13 and 14 GDPR. In France, the CNIL coordinates the work with the EDPB and checks whether the information people receive is transparent and complete. The authorities will pool their findings, and the EDPB will publish a report with follow-up recommendations.
The stakes sit in the higher fine tier. Under Article 83(5)(b) GDPR, a breach of Articles 12 to 14 can cost up to €20 million or 4% of worldwide annual turnover, whichever is higher. Regulators scale the amount to the company: in one recent case the CNIL fined a small firm €40,000 and cited its financial situation and size.
The Article 13 checklist
Article 13 applies when you collect data from the person: a web form, a contract, a job application, an account sign-up. You give the information at the moment of collection.
| # | Your notice must state | GDPR | What to check |
|---|---|---|---|
| 1 | Your identity and contact details, and those of your EU representative if you have one | Art. 13(1)(a) | The legal entity's name next to the brand, and a contact channel someone answers |
| 2 | The contact details of your data protection officer, where you have one | Art. 13(1)(b) | A dedicated channel; you need not name the DPO |
| 3 | Each purpose of processing and its legal basis | Art. 13(1)(c) | One legal basis per purpose, stated next to it. The CNIL sanctioned a notice that did not link the two |
| 4 | The legitimate interests pursued, where you rely on them | Art. 13(1)(d) | You name the interest for each purpose that relies on Art. 6(1)(f) |
| 5 | The recipients or categories of recipients | Art. 13(1)(e) | The list matches your real processors and partners, advertising and analytics platforms included |
| 6 | Transfers outside the EEA and the safeguards used | Art. 13(1)(f) | You name a mechanism in force today and tell people how to get a copy of the safeguards |
| 7 | How long you keep the data, or the criteria you use to set the period | Art. 13(2)(a) | A period or concrete criteria for each purpose. “As long as necessary” gives the reader nothing to check |
| 8 | The rights of access, rectification, erasure, restriction, objection and portability | Art. 13(2)(b) | All six rights, and the route to exercise them |
| 9 | The right to withdraw consent at any time | Art. 13(2)(c) | Stated for every purpose based on consent |
| 10 | The right to lodge a complaint with a supervisory authority | Art. 13(2)(d) | Name the competent authority, such as the CNIL in France |
| 11 | Whether the person must provide the data, under law or contract, and what happens if they do not | Art. 13(2)(e) | Your forms explain which fields are mandatory, and why |
| 12 | Any automated decision-making, including profiling, with meaningful information on the logic and consequences | Art. 13(2)(f) | Check this as soon as an AI or scoring tool makes decisions about people |
| 13 | Any new purpose, before you reuse the data for it | Art. 13(3) | You inform people before the reuse starts |
Data from other sources: Article 14
Article 14 applies when data reaches you from a partner, a purchased list, a group company or a public source. It repeats most Article 13 items and adds two:
- the categories of personal data concerned (Art. 14(1)(d));
- the source of the data, including whether it came from publicly accessible sources (Art. 14(2)(f)).
You get more time, within limits. Article 14(3) gives you a reasonable period of one month at most, brought forward to your first contact with the person or your first disclosure to another recipient. Article 14(5) lists narrow exceptions, for instance where informing people proves impossible or would take disproportionate effort.
Article 12: the form counts
Article 12(1) GDPR requires information that is concise, transparent, intelligible and easily accessible, in clear and plain language. The transparency guidelines of the Article 29 Working Party, endorsed by the EDPB, recommend layered notices online: the essentials at the point of collection and a link to the full text. For you, that means three things:
- Keep the notice one step away. In a decision published in January 2026, the CNIL criticised a company whose visitors had to navigate several documents to find out how it used their data.
- Add a short notice at each collection point. Forms, job applications and sign-up pages carry the essentials and link to the full notice. The CNIL's practical sheet on informing people (in French) includes model wording.
- Keep a dated written record. You need to show which information people received, and when.
Two CNIL decisions
€3.5 million, 30 December 2025 (deliberation SAN-2025-017). A company shared its loyalty-programme members' contact details with a social network for targeted advertising. On information, the CNIL found that the website did not link purposes to their legal bases. The notice left out the advertising purpose and the retention period for loyalty members, and still relied on the EU-US Privacy Shield, which the Court of Justice struck down in 2020.
€40,000, 19 December 2024. A small real estate company monitored its employees' computers. Its written documents gave staff too little information about the monitoring software. The company argued that it had briefed employees orally; with no written trace, the CNIL held that it could not show the information was complete.
In both cases the information failure sat alongside other breaches, and the CNIL established it from the company's own documents.
Check your notice in six steps
- List your processing activities. Customers, prospects, website visitors, employees and candidates all need coverage, and staff and candidates usually need their own notice.
- Give each purpose a legal basis and a retention period. One line per purpose. An empty cell means your notice is missing that item.
- Compare recipients and transfers with your supplier list. Include cloud, email, analytics, payroll and AI tools.
- Review the rights section. Six rights, consent withdrawal where relevant, and the right to complain.
- Test where the notice appears. At every collection point, and one step from any page of your site.
- Date and version each notice. Keep earlier versions so you can show what applied on a given date.
For the rest of your GDPR obligations, see our GDPR compliance checklist for SMEs. If your teams use generative AI on personal data, read ChatGPT, Copilot and the GDPR.
A proposed exemption
The Council of the EU agreed its position on the Digital Omnibus on 21 October 2026. It proposes a new Article 13(5) that would lift the information duty where people already know who you are and why you process their data, and the processing is not high risk. The Council's example is a craftsman and their clients. Complex processing, large data volumes, sensitive data and the employment context stay outside it. The text is a proposal and binds no one today: see what the Digital Omnibus would change for SMEs.
Themio and your privacy notice
Themio is preparing its GDPR and AI Act modules for launch. You upload your privacy notice and related policies. Themio maps them against GDPR articles and flags the required items your documents leave out. Each finding cites the clause in your document and the article concerned, and you can export the results with a prioritised action plan as a PDF.
Themio does not use your documents to train models, and processes them in the EU. It supports compliance readiness and does not give legal advice; for interpretation, complex cases or country-specific questions, involve a lawyer or your DPO.
Frequently Asked Questions
Sources
- Regulation (EU) 2016/679 (GDPR), Articles 12, 13, 14 and 83, EUR-Lex
- EDPB, CEF 2026: EDPB launches coordinated enforcement action on transparency and information obligations under the GDPR, 19 March 2026
- CNIL, Les contrôles en 2026 : recrutement, répertoire électoral unique et fédérations sportives, 3 April 2026
- CNIL, Informer les personnes, practical sheet
- CNIL, Transmission de données à un réseau social à des fins publicitaires : sanction de 3,5 millions d'euros, 22 January 2026; deliberation SAN-2025-017
- CNIL, Surveillance excessive des salariés : sanction de 40 000 euros, 4 February 2025
- Article 29 Working Party, Guidelines on transparency under Regulation 2016/679 (WP260 rev.01), endorsed by the EDPB
- Council of the EU, Mandate for negotiations with the European Parliament, ST 14756/26, 22 October 2026
This article gives general information, current at the date shown, and is not legal advice. For decisions about your organisation, consult a lawyer or your DPO. To report an error, contact the Themio Team.