GDPR Article 13: Obligations, Deadlines & Penalties

The controller shall provide the data subject with the identity and contact details of the controller and, where applicable, of the controller's representative at the time when personal data are obtained. Regulation (EU) 2016/679, Article 13, Article 13

The controller shall provide the data subject with the contact details of the data protection officer, where applicable, at the time when personal data are obtained. Regulation (EU) 2016/679, Article 13, Article 13

The controller shall provide the data subject with the purposes of the processing for which the personal data are intended as well as the legal basis for the processing at the time when personal data are obtained. Regulation (EU) 2016/679, Article 13, Article 13

Where the processing is based on point (f) of Article 6(1), the controller shall provide the data subject with the legitimate interests pursued by the controller or by a third party at the time when personal data are obtained. Regulation (EU) 2016/679, Article 13, Article 13

The controller shall provide the data subject with the recipients or categories of recipients of the personal data, if any, at the time when personal data are obtained. Regulation (EU) 2016/679, Article 13, Article 13

Where applicable, the controller shall provide the data subject with the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision, or reference to appropriate safeguards, at the time when personal data are obtained. Regulation (EU) 2016/679, Article 13, Article 13

The controller shall provide the data subject with the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period, at the time when personal data are obtained. Regulation (EU) 2016/679, Article 13, Article 13

The controller shall provide the data subject with information on the existence of the right to request access, rectification, erasure, restriction of processing, objection to processing, and data portability at the time when personal data are obtained. Regulation (EU) 2016/679, Article 13, Article 13

Where the processing is based on consent, the controller shall provide the data subject with information on the existence of the right to withdraw consent at any time at the time when personal data are obtained. Regulation (EU) 2016/679, Article 13, Article 13

The controller shall provide the data subject with information on the right to lodge a complaint with a supervisory authority at the time when personal data are obtained. Regulation (EU) 2016/679, Article 13, Article 13

The controller shall provide the data subject with information on whether the provision of personal data is a statutory or contractual requirement, whether the data subject is obliged to provide the data, and the possible consequences of failure to provide such data at the time when personal data are obtained. Regulation (EU) 2016/679, Article 13, Article 13

The controller shall provide the data subject with information on the existence of automated decision-making, including profiling, and meaningful information about the logic involved, significance, and envisaged consequences at the time when personal data are obtained. Regulation (EU) 2016/679, Article 13, Article 13

Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information. Regulation (EU) 2016/679, Article 13, Article 13