At what moment do I have to give this information?

Paragraphs 1 and 2 say: at the time the personal data are obtained, so at the moment someone hands them to you, not later (recital 61). If you then want to use the data for another purpose, you inform the person before that new use (paragraph 3). If the person already has the information, you do not need to repeat it (paragraph 4).

Do I have to explain how our algorithm or AI system reaches a decision?

Where automated decision-making takes place, including profiling referred to in Article 22(1) and (4), paragraph 2(f) requires you to state that this happens and, at least in those cases, to give meaningful information about the logic involved, the significance and the envisaged consequences for the data subject. This is explanation that helps the person understand what is happening to them, and recital 60 stresses that people should be informed of profiling and its consequences. Article 12(1) requires you to do this in clear and plain language.

I collected data for a customer account and now want to use them for something else. Do I have to do anything?

Yes. Paragraph 3 requires you to inform the data subject before that further processing about the other purpose and any relevant further information from paragraph 2, such as the retention period and the rights. Recital 61 says the same: information about a new purpose comes before you start. Whether that new use is allowed in itself is not decided by Article 13; that follows from other provisions, such as Article 6.

Article 13: Information to be provided where personal data are collected from the data subjectAI-relevant

Praxikon tracks Article 13 (Information to be provided where personal data are collected from the data subject) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIIn force since 25-05-2018

Article 13 sets out what information you give someone at the moment you collect personal data from that person directly, for example through a form, an account or a job application. You tell them who you are, what you use the data for and on which legal basis, who receives the data and whether they go to a country outside the EU (paragraph 1). You also state the retention period, the data subject's rights, the right to withdraw consent, the right to complain, whether the person is obliged to provide the data and whether automated decision-making takes place (paragraph 2). If you later want to use the data for another purpose, you inform the person beforehand (paragraph 3); if the person already has the information, you need not repeat it (paragraph 4). The article exists because fair and transparent processing requires that people know something is happening with their data and why (recital 60), and that they hear this at the time of collection (recital 61).

Key term: Duty to inform on direct collection: at the moment you collect data from a person directly, you tell them who you are, what you use the data for and what rights they have

Directly affects:controllerdata subjectdata protection officer

Praxikon’s reading of the text and the recitals; the official text below prevails.

AI Act intersection

Information obligation at collection overlaps with transparency requirements for high-risk AI (Art. 13) and AI systems in general (Art. 50 AI Act).

AI Act Art. 13 →AI Act Art. 50 →

Official text

Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (a) the identity and the contact details of the controller and, where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability; (c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (d) the right to lodge a complaint with a supervisory authority; (e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; (f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.

Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

At every point where you collect data from the person directly, you provide the information in paragraphs 1 and 2 at that moment, for example in a privacy notice shown or sent there. If you later want to use the data for another purpose, you inform the person about that new purpose beforehand (paragraph 3). If you use automated decision-making including profiling, for example an AI system that assesses applications, you explain in understandable words the logic involved and what the consequences for the person may be (paragraph 2(f)).

Data Protection Officer

Your contact details are part of the information the data subject receives at the time of collection (paragraph 1(b)), so that people can reach you directly.

Data Subject

At the moment you hand over your data, you are told who processes them, for what purpose, on which legal basis and what rights you have (paragraphs 1 and 2). You are also told whether you are obliged to provide the data and what happens if you do not (paragraph 2(e)). If you already had the information, the controller does not have to give it again (paragraph 4).

Compliance checklist

Whenever data are collected from the data subject directly, that person receives at that moment the identity and contact details of the controller and, where applicable, of the representative and the data protection officer (paragraph 1).The information states the purposes and the legal basis of the processing, and where legitimate interests under Article 6(1)(f) are relied on, which interests those are (paragraph 1).The information names the recipients or categories of recipients and, for transfers to a third country, whether an adequacy decision exists or which safeguards apply and where they can be consulted (paragraph 1).The retention period, or the criteria used to determine it, is included in the information (paragraph 2(a)).The rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent and the right to lodge a complaint with the supervisory authority are mentioned (paragraph 2(b), (c) and (d)).The data subject can read whether providing the data is a statutory or contractual requirement and what the consequences are of not providing them (paragraph 2(e)).Where automated decision-making, including profiling referred to in Article 22, takes place, the information contains meaningful explanation of the logic involved, the significance and the envisaged consequences (paragraph 2(f)).Before data are processed for another purpose, the data subject receives information on that purpose and the related information from paragraph 2 (paragraph 3).

Related recitals

(60)

The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purposes. The controller should provide the data subjec...

(61)

The information in relation to the processing of personal data relating to the data subject should be given to him or her at the time of collection from the data subject, or, where the personal data a...

(62)

However, it is not necessary to impose the obligation to provide information where the data subject already possesses the information, where the recording or disclosure of the personal data is express...

Cross-references

Art. 6: Lawfulness of processing Art. 9: Processing of special categories of personal data Art. 22: Automated individual decision-making, including profiling Art. 46: Transfers subject to appropriate safeguards Art. 49: Derogations for specific situations

Frequently asked questions

← Art. 12: Transparent information, communication and modalities for the exercise of the rights of the data subject Art. 14: Information to be provided where personal data have not been obtained from the data subject →

Connections

Themes where this returns

The counterpart in the other law

Case law

EDPS v SRB: pseudonymised data are not always personal data for everyone, but the information duty applies from collection
2025-09-04 · final, Hof van Justitie van de EU (Eerste kamer), Europese Toezichthouder voor gegevensbescherming (EDPS) tegen Gemeenschappelijke Afwikkelingsraad (SRB)
SCHUFA: a credit score on which third parties draw strongly is automated decision-making
2023-12-07 · final, Hof van Justitie van de EU (Eerste kamer), OQ tegen Land Hessen, met SCHUFA Holding AG als interveniënt

Guidelines

Guidelines on transparency under Regulation 2016/679
2018-05-25 · final, Article 29 Working Party, bekrachtigd door de European Data Protection Board (EDPB)
Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR (legitimate interest)
2024-10-08 · adopted, European Data Protection Board (EDPB)
Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679
2018-05-25 · final, Article 29 Working Party, bekrachtigd door de European Data Protection Board (EDPB)
Guidelines 1/2026 on processing of personal data for scientific research purposes
2026-04-15 · adopted, European Data Protection Board (EDPB)
EDPB and EDPS adopt Joint Opinion 2/2026 on the Digital Omnibus
2026-02-10 · final, European Data Protection Board en European Data Protection Supervisor

Enforcement and fines

10 million euro fine for Uber over unclear retention and transfer information, objection rejected
2023-12-11 · under appeal, Autoriteit Persoonsgegevens
Dutch DPA fines Uber 824.99 million euros for automated driver deactivation
2026-08-21 · under appeal, Autoriteit Persoonsgegevens
Netflix fined 4.75 million euros for failing to properly inform customers
2024-11-26 · under appeal, Autoriteit Persoonsgegevens

Legislation in motion

Proposal: no information duty in clear, non data-intensive relationships (Article 13(4) GDPR)
2025-11-19 · proposal, Europese Commissie
Proposal: definition of scientific research, purpose limitation and information duty for research (Article 4(38), 5(1)(b) and 13(5) GDPR)
2025-11-19 · under negotiation, Europese Commissie
Council: Cyprus Presidency tables negotiating mandate, Coreper vote of 26 June 2026 cancelled
2026-06-22 · under negotiation, Raad van de Europese Unie, Antici-groep (vereenvoudiging) en Coreper
Commission publishes Digital Omnibus proposal COM(2025) 837
2025-11-19 · proposal, Europese Commissie