§ GDPR · Article 14

GDPR Article 14: Obligations, Deadlines & Penalties

Regulation (EU) 2016/679, Article 14 · All obligations · GDPR
At a glance
Article 14 of the GDPR imposes 12 obligations on controller. At least one obligation carries an explicit compliance deadline.
§ Obligations

All obligations under Article 14

Obligation 1
The controller shall provide the data subject with the identity and contact details of the controller and, where applicable, of the controller's representative. Regulation (EU) 2016/679, Article 14, Article 14
Obligated entity
controller
Action required
provide
Deadline
within a reasonable period after obtaining the personal data, but at the latest within one month
Penalty
—
Exemptions
where the data subject already has the information; where provision proves impossible or involves disproportionate effort; where obtaining/disclosure is laid down by law; where data must remain confidential subject to professional secrecy
Obligation 2
The controller shall provide the data subject with the contact details of the data protection officer, where applicable. Regulation (EU) 2016/679, Article 14, Article 14
Obligated entity
controller
Action required
provide
Deadline
within a reasonable period after obtaining the personal data, but at the latest within one month
Penalty
—
Exemptions
where the data subject already has the information; where provision proves impossible or involves disproportionate effort; where obtaining/disclosure is laid down by law; where data must remain confidential subject to professional secrecy
Obligation 3
The controller shall provide the data subject with the purposes of the processing for which the personal data are intended as well as the legal basis for the processing. Regulation (EU) 2016/679, Article 14, Article 14
Obligated entity
controller
Action required
provide
Deadline
within a reasonable period after obtaining the personal data, but at the latest within one month
Penalty
—
Exemptions
where the data subject already has the information; where provision proves impossible or involves disproportionate effort; where obtaining/disclosure is laid down by law; where data must remain confidential subject to professional secrecy
Obligation 4
The controller shall provide the data subject with the categories of personal data concerned. Regulation (EU) 2016/679, Article 14, Article 14
Obligated entity
controller
Action required
provide
Deadline
within a reasonable period after obtaining the personal data, but at the latest within one month
Penalty
—
Exemptions
where the data subject already has the information; where provision proves impossible or involves disproportionate effort; where obtaining/disclosure is laid down by law; where data must remain confidential subject to professional secrecy
Obligation 5
The controller shall provide the data subject with the recipients or categories of recipients of the personal data, if any. Regulation (EU) 2016/679, Article 14, Article 14
Obligated entity
controller
Action required
provide
Deadline
within a reasonable period after obtaining the personal data, but at the latest within one month
Penalty
—
Exemptions
where the data subject already has the information; where provision proves impossible or involves disproportionate effort; where obtaining/disclosure is laid down by law; where data must remain confidential subject to professional secrecy
Obligation 6
Where applicable, the controller shall provide the data subject with information that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision, or reference to appropriate safeguards. Regulation (EU) 2016/679, Article 14, Article 14
Obligated entity
controller
Action required
provide
Deadline
within a reasonable period after obtaining the personal data, but at the latest within one month
Penalty
—
Exemptions
where the data subject already has the information; where provision proves impossible or involves disproportionate effort; where obtaining/disclosure is laid down by law; where data must remain confidential subject to professional secrecy
Obligation 7
The controller shall provide the data subject with the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period. Regulation (EU) 2016/679, Article 14, Article 14
Obligated entity
controller
Action required
provide
Deadline
within a reasonable period after obtaining the personal data, but at the latest within one month
Penalty
—
Exemptions
where the data subject already has the information; where provision proves impossible or involves disproportionate effort; where obtaining/disclosure is laid down by law; where data must remain confidential subject to professional secrecy
Obligation 8
Where processing is based on legitimate interests, the controller shall provide the data subject with the legitimate interests pursued by the controller or by a third party. Regulation (EU) 2016/679, Article 14, Article 14
Obligated entity
controller
Action required
provide
Deadline
within a reasonable period after obtaining the personal data, but at the latest within one month
Penalty
—
Exemptions
where the data subject already has the information; where provision proves impossible or involves disproportionate effort; where obtaining/disclosure is laid down by law; where data must remain confidential subject to professional secrecy
Obligation 9
The controller shall provide the data subject with information on the existence of the right to request access, rectification, erasure, restriction of processing, objection to processing, and data portability. Regulation (EU) 2016/679, Article 14, Article 14
Obligated entity
controller
Action required
provide
Deadline
within a reasonable period after obtaining the personal data, but at the latest within one month
Penalty
—
Exemptions
where the data subject already has the information; where provision proves impossible or involves disproportionate effort; where obtaining/disclosure is laid down by law; where data must remain confidential subject to professional secrecy
Obligation 10
Where processing is based on consent, the controller shall provide the data subject with information on the right to withdraw consent at any time. Regulation (EU) 2016/679, Article 14, Article 14
Obligated entity
controller
Action required
provide
Deadline
within a reasonable period after obtaining the personal data, but at the latest within one month
Penalty
—
Exemptions
where the data subject already has the information; where provision proves impossible or involves disproportionate effort; where obtaining/disclosure is laid down by law; where data must remain confidential subject to professional secrecy
Obligation 11
The controller shall provide the data subject with information on the right to lodge a complaint with a supervisory authority. Regulation (EU) 2016/679, Article 14, Article 14
Obligated entity
controller
Action required
provide
Deadline
within a reasonable period after obtaining the personal data, but at the latest within one month
Penalty
—
Exemptions
where the data subject already has the information; where provision proves impossible or involves disproportionate effort; where obtaining/disclosure is laid down by law; where data must remain confidential subject to professional secrecy
Obligation 12
The controller shall provide the data subject with information on the source from which the personal data originate, and if applicable, whether it came from publicly accessible sources. Regulation (EU) 2016/679, Article 14, Article 14
Obligated entity
controller
Action required
provide
Deadline
within a reasonable period after obtaining the personal data, but at the latest within one month
Penalty
—
Exemptions
where the data subject already has the information; where provision proves impossible or involves disproportionate effort; where obtaining/disclosure is laid down by law; where data must remain confidential subject to professional secrecy
§ Frequently asked

Questions about Article 14

Who must comply with Article 14 of the GDPR? +
controller.
What does Article 14 of the GDPR require? +
provide
What is the compliance deadline for GDPR Article 14? +
within a reasonable period after obtaining the personal data, but at the latest within one month
Need a cross-border briefing on GDPR Article 14?
Search Fontvera ↵
All EU obligation pages  ·  All GDPR articles
Intelligence · Obligations · About · Pricing · Privacy · Terms
100% European infrastructure