Proposal: no information duty in clear, non data-intensive relationships (Article 13(4) GDPR)

What it is about

Controllers would not need to provide Article 13 information where data are collected in a clear and circumscribed relationship, the activity is not data-intensive and there are reasonable grounds to assume the data subject already has the controller's identity and contact details and the purposes. The exemption would not apply where data are transmitted to other recipients or a third country, automated decision-making including profiling is carried out or the processing is likely to result in a high risk within the meaning of Article 35. Recital 36 gives a craftsman and their clients, and associations and sports clubs, as examples. In Joint Opinion 2/2026 of 10 February 2026 the EDPB and EDPS support the direction but ask for sharper definitions of not data-intensive activity and clear and circumscribed relationship, removal of reasonable grounds to assume, and a right to receive the full information on request. As of 15 September 2026 this is still a proposal: the European Parliament committee vote has not taken place and the Council has no mandate yet.

What this means in practice

If adopted, small service providers such as a craftsman or a plumber could omit a privacy notice for simple customer contacts. As soon as you share data with other recipients, transfer it outside the EU, profile or carry out high risk processing, you would still have to inform. The Article 15 right of access remains. The threshold of not data-intensive is still unclear, and according to Recital 36 employment relationships do not qualify.

The GDPR articles concerned

• Article 13: Information to be provided where personal data are collected from the data subject