GDPR Articles 13 & 14: What Your Privacy Notice Must Disclose

By CA Neha Tabassum, Chartered Accountant · Checked against the consolidated GDPR text · Updated 27 September 2026

Most privacy notices are written as a list of things the company does, rather than as the list of things the law requires you to say. That is why they read badly and still fail. This guide sets out the actual Article 13 and Article 14 requirements item by item, shows exactly how the two articles differ, and explains the deadline that catches out businesses using bought-in or referral data.

1. Which article applies to you

Start with one question, asked separately for each processing activity: did the person hand you their data, or did you get it from somewhere else?

Small businesses hit Article 14 far more often than they expect. If you buy a mailing list, take over a customer base from a previous trader, use a lead-generation form that collected the name for someone else, or enrich records from a public register, Article 14 applies to that data — and no amount of consent obtained by the original collector transfers to you.

You can end up running both lists at once. A recruitment site collecting applications (Article 13) and sourcing CVs from an external pool (Article 14) is the common example, and the notice needs to handle each separately rather than blurring them.

2. Article 13: the full list, and when

Article 13(1) requires six items at the time the personal data are obtained:

1. Identity and contact details of the controller, and where applicable of the controller's representative in the EU.
2. Contact details of the data protection officer, where one has been designated.
3. The purposes of the processing and the legal basis for each.
4. The legitimate interests pursued, where processing relies on Article 6(1)(f).
5. The recipients or categories of recipients, if any.
6. Third-country transfers: that a transfer is intended, whether an adequacy decision exists or not, or — for transfers under Articles 46, 47 or the second subparagraph of Article 49(1) — a reference to the safeguards and how to obtain a copy.

Article 13(2) then requires six further items, described in the Regulation as necessary to ensure fair and transparent processing:

7. Storage period, or the criteria used to determine it if a period cannot be stated.
8. Existence of the rights to request access, rectification, erasure or restriction, to object to processing, and to data portability.
9. The right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal, where processing relies on Article 6(1)(a) or Article 9(2)(a).
10. The right to lodge a complaint with a supervisory authority.
11. Whether providing the data is a statutory or contractual requirement or necessary to enter into a contract, whether the person is obliged to provide it, and the possible consequences of failing to do so.
12. The existence of automated decision-making including profiling under Article 22(1) and (4), and in those cases at least meaningful information about the logic involved, its significance and the envisaged consequences.

Item 5 is the one most often missed, and it is the one people complain about when a form demands a date of birth with no explanation. If your form cannot run without a field, say so, and say what happens if it is left blank.

3. Article 14: the full list, and the three deadlines

Article 14(1) requires the controller identity and representative, DPO contact details, purposes and legal basis, the categories of personal data concerned, recipients, and the third-country transfer information. Article 14(2) adds the storage period, the legitimate interests where Article 6(1)(f) is used, the existence of the rights, the right to withdraw consent, the right to complain, the source of the data and whether it came from publicly accessible sources, and the automated decision-making information.

So the honest summary of the difference is: Article 14 adds two items (categories of data, and source) and omits one (the obligation to provide and the consequences of refusal). Popular summaries describe Article 14 as "everything in Article 13 plus extra", which is only half right — and the omission matters, because a notice built on that assumption will contain a statement the law does not ask for and will still be missing one it does.

Timing is where Article 14 earns its keep. Article 14(3) gives three alternative deadlines, and the earliest one that applies governs:

Practically, the second and third rows usually bite first. A purchased list you intend to email is governed by the first-communication deadline, which on a monthly mailing cycle means your notice must be ready before the first send — not merely within thirty days of buying the list.

4. Side-by-side: what actually changes

Both articles close the same way: if you intend to process the data for a purpose other than the one you collected them for, you must tell the person before that further processing begins.

5. The four exceptions in Article 14(5)

Article 14 does not apply, in whole or in part, where any of these applies:

1. The person already has the information.
2. It is impossible or would involve a disproportionate effort — particularly for archiving, research or statistical processing under Article 89(1), or where disclosure would defeat the purpose of the processing. In that case you must still take appropriate measures to protect the person's rights and legitimate interests, including making the information publicly available.
3. Obtaining or disclosure is expressly laid down by law, in Union or Member State law, with appropriate measures to protect the person's legitimate interests.
4. The data must remain confidential under a professional secrecy obligation imposed by Union or Member State law, including a statutory obligation of secrecy.

Article 13 has only one exception, at Article 13(4): that the person already has the information. The broader Article 14 exemptions exist because you may have no practical way to reach someone whose data you acquired indirectly — which is precisely why the second exception obliges you to publish the information rather than simply say nothing.

6. How the notice must be written (Article 12)

Meeting the content list is not sufficient on its own, because Article 12(1) sets a standard for the form of the information. It must be given in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular where the information is addressed to a child.

Article 12(2) allows written or other means, including electronic. Article 12(3) allows oral provision where the person asks for it and their identity can be established by other means. Article 12(8) permits standardised icons to convey the information, provided they give a meaningful overview in a visible, intelligible and legible way — and are machine-readable when presented electronically.

"Concise" and "complete" pull against each other, which is the drafting problem every privacy notice faces. The workable approach is a short layer that says what you do and why, followed by the full Article 13 or 14 list underneath. The Regulation permits the information to be layered; it does not permit it to be missing.

7. What non-compliance can cost

Article 83(5) places infringements of Articles 12 to 22 in the highest administrative fine bracket: up to €20,000,000 or 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher. Because Article 13 and Article 14 sit inside that range, a missing or defective disclosure is not a technicality to be treated as a warning — it is an infringement of data subjects' rights.

Two qualifiers keep this proportionate. Article 83(2) requires each case to be judged on its own facts, weighing the gravity and duration of the infringement, whether it was intentional or negligent, the categories of data affected, the number of people affected, and whether you self-reported. Article 83(3) caps the total where a single set of processing infringes several provisions, at the amount specified for the gravest one. A self-identified gap that you fix promptly and log is a materially different position from one found during an inspection.

That is the practical argument for a dated, versioned notice: it evidences that you know what the law requires and when you last checked it.

8. Building a notice that passes

1. List every processing activity and mark each as direct or indirect collection. That single column decides Article 13 versus Article 14.
2. Identify the legal basis for each under Article 6(1), and the specific purpose. Purpose and basis cannot be separated — the basis has to make sense for the purpose stated.
3. Draft the Article 13 list as the base, then adjust per activity.
4. Add the Article 14 extras for indirect data: categories of personal data, and the source including whether it was publicly accessible. Leave out the obligation-to-provide statement, which does not apply there.
5. Check the three Article 14 deadlines against your actual first communication and first disclosure dates, not just the one-month rule.
6. Add retention periods or the criteria used, per purpose rather than as one blanket figure.
7. State the transfer position honestly: where data goes, and on what safeguard.
8. Check the wording against Article 12 — read it as someone with no legal training. If a sentence needs a dictionary, rewrite it.
9. Date it, version it, and log changes.

For a starting draft, the free GDPR Generator produces a notice covering the Article 13 items and runs entirely in your browser. You then add the Article 14 items for any indirect data you actually use, and record the date. You can see a worked example of how a finished notice reads in practice on our own privacy page.

Frequently asked questions

Sources

• Regulation (EU) 2016/679 (GDPR) — Articles 12, 13, 14 and 83 — EUR-Lex, official journal text
• Article 14 verbatim and Article 13 verbatim — used to verify every item and subparagraph reference on this page
• Article 83 verbatim — fine brackets

How this page was verified: every item, subparagraph letter, deadline and fine bracket above was read directly from the consolidated Regulation text on 27 September 2026 rather than from secondary summaries. The GDPR is subject to amendment; check EUR-Lex for the current consolidated version before relying on this for a compliance decision. Corrections are logged in the changelog.