At what moment do I have to give this information?

Paragraphs 1 and 2 say: at the time the personal data are obtained, so at the moment someone hands them to you, not later (recital 61). If you then want to use the data for another purpose, you inform the person before that new use (paragraph 3). If the person already has the information, you do not need to repeat it (paragraph 4).

Do I have to explain how our algorithm or AI system reaches a decision?

Where automated decision-making takes place, including profiling referred to in Article 22(1) and (4), paragraph 2(f) requires you to state that this happens and, at least in those cases, to give meaningful information about the logic involved, the significance and the envisaged consequences for the data subject. This is explanation that helps the person understand what is happening to them, and recital 60 stresses that people should be informed of profiling and its consequences. Article 12(1) requires you to do this in clear and plain language.

I collected data for a customer account and now want to use them for something else. Do I have to do anything?

Yes. Paragraph 3 requires you to inform the data subject before that further processing about the other purpose and any relevant further information from paragraph 2, such as the retention period and the rights. Recital 61 says the same: information about a new purpose comes before you start. Whether that new use is allowed in itself is not decided by Article 13; that follows from other provisions, such as Article 6.

Article 13: Information to be provided where personal data are collected from the data subjectAI-relevant

Praxikon tracks Article 13 (Information to be provided where personal data are collected from the data subject) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIIn force since 25-05-2018

Article 13 sets out what information you give someone at the moment you collect personal data from that person directly, for example through a form, an account or a job application. You tell them who you are, what you use the data for and on which legal basis, who receives the data and whether they go to a country outside the EU (paragraph 1). You also state the retention period, the data subject's rights, the right to withdraw consent, the right to complain, whether the person is obliged to provide the data and whether automated decision-making takes place (paragraph 2). If you later want to use the data for another purpose, you inform the person beforehand (paragraph 3); if the person already has the information, you need not repeat it (paragraph 4). The article exists because fair and transparent processing requires that people know something is happening with their data and why (recital 60), and that they hear this at the time of collection (recital 61).

Key term: Duty to inform on direct collection: at the moment you collect data from a person directly, you tell them who you are, what you use the data for and what rights they have

Directly affects:controllerdata subjectdata protection officer

Praxikon’s reading of the text and the recitals; the official text below prevails.

AI Act intersection

Information obligation at collection overlaps with transparency requirements for high-risk AI (Art. 13) and AI systems in general (Art. 50 AI Act).

AI Act Art. 13 →AI Act Art. 50 →

Official text

Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (a) the identity and the contact details of the controller and, where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability; (c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (d) the right to lodge a complaint with a supervisory authority; (e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; (f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.

Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

At every point where you collect data from the person directly, you provide the information in paragraphs 1 and 2 at that moment, for example in a privacy notice shown or sent there. If you later want to use the data for another purpose, you inform the person about that new purpose beforehand (paragraph 3). If you use automated decision-making including profiling, for example an AI system that assesses applications, you explain in understandable words the logic involved and what the consequences for the person may be (paragraph 2(f)).

Data Protection Officer

Your contact details are part of the information the data subject receives at the time of collection (paragraph 1(b)), so that people can reach you directly.

Data Subject

At the moment you hand over your data, you are told who processes them, for what purpose, on which legal basis and what rights you have (paragraphs 1 and 2). You are also told whether you are obliged to provide the data and what happens if you do not (paragraph 2(e)). If you already had the information, the controller does not have to give it again (paragraph 4).

Compliance checklist

Whenever data are collected from the data subject directly, that person receives at that moment the identity and contact details of the controller and, where applicable, of the representative and the data protection officer (paragraph 1).The information states the purposes and the legal basis of the processing, and where legitimate interests under Article 6(1)(f) are relied on, which interests those are (paragraph 1).The information names the recipients or categories of recipients and, for transfers to a third country, whether an adequacy decision exists or which safeguards apply and where they can be consulted (paragraph 1).The retention period, or the criteria used to determine it, is included in the information (paragraph 2(a)).The rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent and the right to lodge a complaint with the supervisory authority are mentioned (paragraph 2(b), (c) and (d)).The data subject can read whether providing the data is a statutory or contractual requirement and what the consequences are of not providing them (paragraph 2(e)).Where automated decision-making, including profiling referred to in Article 22, takes place, the information contains meaningful explanation of the logic involved, the significance and the envisaged consequences (paragraph 2(f)).Before data are processed for another purpose, the data subject receives information on that purpose and the related information from paragraph 2 (paragraph 3).

Related recitals

(60)

The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purposes. The controller should provide the data subjec...

(61)

The information in relation to the processing of personal data relating to the data subject should be given to him or her at the time of collection from the data subject, or, where the personal data a...

(62)

However, it is not necessary to impose the obligation to provide information where the data subject already possesses the information, where the recording or disclosure of the personal data is express...

Cross-references

Art. 6: Lawfulness of processing Art. 9: Processing of special categories of personal data Art. 22: Automated individual decision-making, including profiling Art. 46: Transfers subject to appropriate safeguards Art. 49: Derogations for specific situations

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (5)

18 June 2026 · C-484/24 · CJEU
NTH Haustechnik
A court using evidence containing personal data processes it under a legal obligation, provided clear national case law sets the conditions. Unlawfully obtained evidence is not automatically excluded, but before disclosing it further the court must limit the data to what is necessary.
11 July 2024 · C-757/22 · CJEU
Meta Platforms Ireland (duty to inform)
A consumer association can bring a representative action for breach of the duty to inform about the purposes and recipients of processing.
1 October 2019 · C-673/17 · CJEU
Planet49
A pre-ticked checkbox does not give valid consent for cookies. Users must also be told how long cookies operate and whether third parties can access them.
29 July 2019 · C-40/17 · CJEUDirective 95/46
Fashion ID
A website embedding a Facebook button is a joint controller, but only for collecting and transmitting visitor data. Consumer associations may bring proceedings on behalf of data subjects.
1 October 2015 · C-201/14 · CJEUDirective 95/46
Bara
A public body may not pass data to another public body for further processing without first informing the data subjects.

Guidelines and decisions (3)

13 October 2026 · Statement 1/2026 · EDPB
Statement 1/2026 on smart glasses
Preliminary reflections: a narrow exemption for purely personal use, the producer and the provider of a linked service (including AI) can be controllers, and bystanders must notice at that moment that recording is taking place.
19 November 2025 · COM(2025) 837 · European Commission
Digital Omnibus: proposal amending the GDPR
Legislative proposal that would introduce, among other things, a relative definition of personal data, breach notification only for high risk and cookie rules within the GDPR itself. It is a proposal, not law in force.
29 January 2020 · v2.1 · EDPB
Guidelines 3/2019 on processing of personal data through video devices
Covers video surveillance under the GDPR, including the household exemption, legal basis, biometric data, transparency duties and storage periods.

Fines (8)

30 April 2025 · Data Protection Commission (Ireland)€530,000,000
TikTok: transfers of data to China
Staff in China had remote access to European users' data, without TikTok verifying and demonstrating that the data received essentially equivalent protection there. Its privacy policy also failed to clearly name the countries the data went to.
Decision of 30 April 2025, announced on 2 May 2025. TikTok appealed to the Irish courts, which stayed the orders to suspend the transfers pending the outcome.
26 November 2024 · Dutch Data Protection Authority€4,750,000
Netflix: unclear information to customers
Between 2018 and 2020 Netflix's privacy statement and its replies to access requests did not clearly explain the purposes and legal bases of its processing, who data were shared with, how long data were kept, and how transfers outside Europe were safeguarded.
Decision of 26 November 2024, announced on 18 December 2024. Netflix objected to the fine.
22 October 2024 · Data Protection Commission (Ireland)€310,000,000
LinkedIn: behavioural analysis and targeted advertising
LinkedIn used members' data for behavioural analysis and targeted advertising without a valid legal basis: consent was not valid, and neither legitimate interest nor contract applied. Members were also not properly informed about the legal bases relied on.
Decision of 22 October 2024, announced on 24 October 2024. LinkedIn appealed to the Irish High Court.
1 September 2023 · Data Protection Commission (Ireland)€345,000,000
TikTok: children's accounts public by default
Children's accounts were public by default and the Family Pairing feature was poorly safeguarded, while children were not properly informed. At the EDPB's direction, deceptive design choices were also found to breach the fairness principle.
Decision of 1 September 2023, announced on 15 September 2023. TikTok challenged the decision before the EU General Court (case T-1030/23) and the Irish High Court.
31 December 2022 · Data Protection Commission (Ireland)€390,000,000
Meta: contract as legal basis for behavioural advertising
Meta relied on its terms of service as the legal basis for behavioural advertising on Facebook and Instagram, which the binding EDPB decision held was not a valid basis. Users were also not clearly told which legal basis applied to which processing.
Two decisions of 31 December 2022 (EUR 210 million for Facebook, EUR 180 million for Instagram), announced on 4 January 2023. Meta announced it would appeal both the substance and the fines.

Show 3 more

20 August 2021 · Data Protection Commission (Ireland)€225,000,000
WhatsApp: insufficient transparency
WhatsApp did not properly inform users and non-users about the processing of their data, including the sharing of data with other Facebook companies. Following a binding EDPB decision the DPC had to increase its proposed fine.
The DPC lists 20 August 2021 as the decision date; announced on 2 September 2021. WhatsApp challenged the decision in the Irish courts and before the EU General Court.
15 July 2021 · CNPD (Luxembourg)€746,000,000
Amazon: targeted advertising without a valid legal basis
Amazon processed personal data for interest-based advertising on the basis of legitimate interest, which was not a valid legal basis. It also fell short on informing users and on honouring rights such as access, rectification and erasure.
The administrative tribunal upheld the fine on 18 March 2025. On appeal, the Administrative Court annulled the decision on 12 March 2026 and sent the case back to the CNPD, because the CNPD had not assessed whether Amazon acted intentionally or negligently and had not weighed which corrective measure was most appropriate. The core findings of infringement were confirmed; the Article 21 complaints were held to fall outside the scope of the inquiry.
21 January 2019 · CNIL (France)€50,000,000
Google: transparency and consent on Android
When creating a Google account on an Android phone, information about the processing was scattered and unclear. Consent to personalised advertising was not sufficiently informed, specific or unambiguous.
The Conseil d'État dismissed Google's appeal on 19 June 2020; the fine is final.

Checked on 5 November 2026

Frequently asked questions

← Art. 12: Transparent information, communication and modalities for the exercise of the rights of the data subject Art. 14: Information to be provided where personal data have not been obtained from the data subject →

Connections

Themes where this returns

Where this meets the other law

Informing people that a high-risk system is used on them, alongside the GDPR information
applies alongside
The AI notice in Article 50 comes on top of the GDPR information duty
applies alongside

The counterpart in the other law

Case law

EDPS v SRB: pseudonymised data are not always personal data for everyone, but the information duty applies from collection
2025-09-04 · final, Hof van Justitie van de EU (Eerste kamer), Europese Toezichthouder voor gegevensbescherming (EDPS) tegen Gemeenschappelijke Afwikkelingsraad (SRB)
SCHUFA: a credit score on which third parties draw strongly is automated decision-making
2023-12-07 · final, Hof van Justitie van de EU (Eerste kamer), OQ tegen Land Hessen, met SCHUFA Holding AG als interveniënt

Guidelines

Guidelines on transparency under Regulation 2016/679
2018-05-25 · final, Article 29 Working Party, bekrachtigd door de European Data Protection Board (EDPB)
Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR (legitimate interest)
2024-10-08 · under consultation, European Data Protection Board (EDPB)
EDPB Statement 1/2026 on smart glasses
2026-10-13 · final, European Data Protection Board (EDPB)
Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679
2018-05-25 · final, Article 29 Working Party, bekrachtigd door de European Data Protection Board (EDPB)
Guidelines 1/2026 on processing of personal data for scientific research purposes
2026-04-15 · under consultation, European Data Protection Board (EDPB)
EDPB and EDPS adopt Joint Opinion 2/2026 on the Digital Omnibus
2026-02-10 · final, European Data Protection Board en European Data Protection Supervisor

Enforcement and fines

10 million euro fine for Uber over unclear retention and transfer information, objection rejected
2023-12-11 · under appeal, Autoriteit Persoonsgegevens
Dutch DPA fines Uber 824.99 million euros for automated driver deactivation
2026-08-21 · under appeal, Autoriteit Persoonsgegevens
Netflix fined 4.75 million euros for failing to properly inform customers
2024-11-26 · under appeal, Autoriteit Persoonsgegevens
Dutch DPA study: algorithms and AI at debt collection agencies
2026-10-29 · final, Autoriteit Persoonsgegevens

Legislation in motion

Proposal: no information duty in clear, non data-intensive relationships (Article 13(4) GDPR)
2025-11-19 · proposal, Europese Commissie
Proposal: definition of scientific research, purpose limitation and information duty for research (Article 4(38), 5(1)(b) and 13(5) GDPR)
2025-11-19 · under negotiation, Europese Commissie
Council: Cyprus Presidency tables negotiating mandate, Coreper vote of 26 June 2026 cancelled
2026-06-22 · under negotiation, Raad van de Europese Unie, Antici-groep (vereenvoudiging) en Coreper
Commission publishes Digital Omnibus proposal COM(2025) 837
2025-11-19 · proposal, Europese Commissie