§ GDPR · Article 12
GDPR Article 12: Obligations, Deadlines & Penalties
At a glance
Article 12 of the GDPR imposes 12 obligations on controller. At least one obligation carries an explicit compliance deadline.
§ Obligations
All obligations under Article 12
Obligation 1
The controller shall take appropriate measures to provide information and communications relating to processing to the data subject in a concise, transparent, intelligible, and easily accessible form using clear and plain language.
Regulation (EU) 2016/679, Article 12, Article 12
- Obligated entity
-
controller
- Action required
-
provide
- Deadline
-
—
- Penalty
-
—
Obligation 2
The controller shall facilitate the exercise of data subject rights under Articles 15 to 22.
Regulation (EU) 2016/679, Article 12, Article 12
- Obligated entity
-
controller
- Action required
-
facilitate
- Deadline
-
—
- Penalty
-
—
Obligation 3
The controller shall not refuse to act on the request of the data subject for exercising rights unless it demonstrates that it is not in a position to identify the data subject.
Regulation (EU) 2016/679, Article 12, Article 12
- Obligated entity
-
controller
- Action required
-
act
- Deadline
-
—
- Penalty
-
—
- Exemptions
- when controller cannot identify the data subject
Obligation 4
The controller shall provide information on action taken on a request to the data subject without undue delay and in any event within one month of receipt of the request.
Regulation (EU) 2016/679, Article 12, Article 12
- Obligated entity
-
controller
- Action required
-
provide
- Deadline
-
one month of receipt of the request
- Penalty
-
—
Obligation 5
If the response period is extended by two months due to complexity, the controller shall inform the data subject of the extension and reasons within one month of receipt of the request.
Regulation (EU) 2016/679, Article 12, Article 12
- Obligated entity
-
controller
- Action required
-
inform
- Deadline
-
one month of receipt of the request
- Penalty
-
—
Obligation 6
Where the data subject makes the request by electronic means, the controller shall provide information by electronic means where possible, unless otherwise requested.
Regulation (EU) 2016/679, Article 12, Article 12
- Obligated entity
-
controller
- Action required
-
provide
- Deadline
-
—
- Penalty
-
—
- Exemptions
- unless otherwise requested by the data subject
Obligation 7
If the controller does not take action on the request, it shall inform the data subject without delay and at the latest within one month of the reasons and the possibility of lodging a complaint.
Regulation (EU) 2016/679, Article 12, Article 12
- Obligated entity
-
controller
- Action required
-
inform
- Deadline
-
one month of receipt of the request
- Penalty
-
—
Obligation 8
Information and actions taken shall be provided free of charge, unless requests are manifestly unfounded or excessive, in which case the controller may charge a reasonable fee or refuse to act.
Regulation (EU) 2016/679, Article 12, Article 12
- Obligated entity
-
controller
- Action required
-
provide
- Deadline
-
—
- Penalty
-
—
- Exemptions
- manifestly unfounded or excessive requests
Obligation 9
The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of a request if charging a fee or refusing to act.
Regulation (EU) 2016/679, Article 12, Article 12
- Obligated entity
-
controller
- Action required
-
demonstrate
- Deadline
-
—
- Penalty
-
—
Obligation 10
Where the controller has reasonable doubts concerning the identity of the natural person making the request, it may request additional information necessary to confirm the identity.
Regulation (EU) 2016/679, Article 12, Article 12
- Obligated entity
-
controller
- Action required
-
request
- Deadline
-
—
- Penalty
-
—
Obligation 11
Information provided pursuant to Articles 13 and 14 may be provided in combination with standardised icons to give a meaningful overview of the intended processing.
Regulation (EU) 2016/679, Article 12, Article 12
- Obligated entity
-
controller
- Action required
-
provide
- Deadline
-
—
- Penalty
-
—
Obligation 12
Where icons are presented electronically, they shall be machine-readable.
Regulation (EU) 2016/679, Article 12, Article 12
- Obligated entity
-
controller
- Action required
-
ensure
- Deadline
-
—
- Penalty
-
—
§ Frequently asked
Questions about Article 12
Who must comply with Article 12 of the GDPR?
+
controller.
What does Article 12 of the GDPR require?
+
provide facilitate act
What is the compliance deadline for GDPR Article 12?
+
one month of receipt of the request