In today’s data-driven world, organizations must put transparency at the heart of how they collect and process personal information. The General Data Protection Regulation (GDPR) makes this transparency mandatory, especially under Article 13. This article specifies exactly what information must be provided to individuals when you collect their personal data directly from them.
Whether you are building a website form, onboarding customers, gathering data through a mobile app, or registering employees, Article 13 applies. To comply, organizations must use clear, accessible, and timely privacy notices that explain what is happening with the data — before or at the moment it is collected.
What Is Article 13 GDPR? A Short Overview
Article 13 ensures that individuals know:
- Who is collecting their data
- Why it is being processed
- How long it will be stored
- Who else will receive it
- What rights they have over it
The goal is to give individuals control and prevent secretive or misleading data practices. This requirement applies whenever personal data is collected directly — website forms, retail sign-ups, corporate systems, cookie-based tracking, event registrations, and more.
Failure to comply isn’t optional or minor — it can trigger heavy penalties, up to €20 million or 4% of global turnover, whichever is higher.
The Ultimate Article 13 GDPR Checklist
Below is every requirement organizations must include in a privacy notice when collecting personal data directly from individuals.
You must provide:
✔ 1️⃣ The identity of the data controller
- Official business name
- Legal entity details
- Registered address
✔ 2️⃣ Contact details of the controller
At least one valid communication method:
- Email address
- Phone number
- Mailing address
✔ 3️⃣ Contact details of the Data Protection Officer (if applicable)
Required for:
- Public authorities
- Companies processing large-scale sensitive data
- Entities monitoring individuals systematically
✔ 4️⃣ The purpose of data processing
Explain why the data is needed:
- Account registration
- Contract performance
- Advertising newsletter
- Payment processing
- Customer support
✔ 5️⃣ The legal basis for processing
Every purpose must have one lawful basis:
- Consent
- Contract performance
- Legal obligation
- Vital interests
- Public interest tasks
- Legitimate interests
If legitimate interest is used — you must identify and describe the interest clearly.
✔ 6️⃣ Who receives the data (recipients or categories of recipients)
Examples:
- CRM or newsletter providers
- Payment processors
- Customer support tools
- IT infrastructure vendors
- Delivery services
You don’t always have to list company names, but the categories must be clear.
✔ 7️⃣ International data transfers
If data is transferred outside the EU/EEA:
- Identify the country/region
- Explain protective safeguards:
- Adequacy decisions
- Standard Contractual Clauses
- Binding Corporate Rules
Hidden transfers are one of the most common enforcement issues.
✔ 8️⃣ Data retention period or criteria for determining it
Provide:
- A clear timeline OR
- Justification for how retention is determined
Example:
“We retain customer data for up to 24 months after last interaction unless legal retention duties require longer.”
✔ 9️⃣ Data subject rights
You must inform users of the ability to:
- Access data
- Correct errors
- Request deletion
- Restrict processing
- Object to processing
- Exercise data portability
Also state how rights can be exercised.
✔ The right to withdraw consent at any time
If consent is the lawful basis:
- It must be freely revocable
- Withdrawal must be as easy as giving consent
No forced opt-in, no trick design.
✔ 1️⃣1️⃣ The right to lodge a complaint
Include the name of the supervisory authority in the relevant EU country.
✔ 1️⃣2️⃣ Whether providing data is mandatory
If refusal has consequences:
- Loss of service
- Inability to complete a purchase
- Contract impossible without required info
Explain what fields are optional vs necessary.
✔ 1️⃣3️⃣ Automated decision-making or profiling (if applicable)
If such decisions have legal or significant effects:
- Disclose existence of automation
- Explain logic used
- Inform individuals of their right to human review
This applies heavily in credit scoring, insurance pricing, recruitment platforms, etc.
How to Present Article 13 Information: Practical Rules
Legal obligations are not enough — the presentation matters too.
Article 13 requires information to be:
| Principle | What it means |
|---|---|
| Accessible | No hiding, no digging required |
| Understandable | Written in plain language, not legal jargon |
| Timely | Provided before or during data collection |
| Context-specific | Tailored to each interaction |
| Visible | Not buried behind 20 clicks |
Good placement examples:
- A privacy message directly under a form
- A clear pop-up explaining data uses
- A layered privacy notice (short first, extended via link)
- Transparent cookie banner usage explanations
Bad placement examples:
- Tiny text in footers
- Legal terms hidden post-submission
- Oversized and vague privacy paragraphs
- Automatically checked consent boxes
GDPR compliance is not only legal — it's a user experience requirement.
Where Do Organizations Fail Most Often?
Here are the highest-risk non-compliance patterns:
❌ Collecting data with no justification or unclear purpose
❌ Excessive required fields (phone number when only email needed)
❌ Retaining data indefinitely with no retention policy
❌ Reusing data for unrelated marketing
❌ Bundling consent with terms of service
❌ Cookie banners that hide tracking intentions
❌ Overly complicated withdrawal processes
❌ Third-party integrations without disclosure
Regulators often investigate:
- E-commerce sign-ups
- Newsletter collections
- Job applicant systems
- Loyalty card programs
- Mobile app tracking
- CCTV and biometric systems
Example Scenarios Applying the Checklist
To make the checklist more actionable, below are real implementation examples:
Example A: Website Contact Form
Data collected: name, email, message
Privacy notice must include:
- Who will reply
- Purpose (respond to inquiry)
- Retention time (e.g., 12 months)
- Recipient categories (internal support system)
- Consent withdrawal rights for any marketing
Risk: upselling the user later without informing them → violation
Example B: Mobile App with Location Tracking
Data collected: GPS and behavioral analytics
Checklist requirements include:
- Why location is needed (navigation)
- International transfer details if using cloud services
- Profiling disclosure if used for targeted offers
- Retention tied to app use
Risk: background collection when app is closed → severe fines
Example C: Employee Onboarding
Data collected: contract details, banking, IDs
Controller must disclose:
- Legal obligations requiring data (payroll, tax)
- Retention aligned with employment laws
- Internal role-based access
Risk: reusing employee info for internal marketing → disallowed
How to Apply the Checklist to Business Processes
To fully comply:
Step 1 — Map data collection points
Forms, cookies, chatbots, stores, apps, events.
Step 2 — Assign lawful basis to each purpose
Each purpose must be documented.
Step 3 — Create layered privacy notices
Short and extended versions should always match.
Step 4 — Standardize consent collection
No pre-checking, no coercive designs.
Step 5 — Train staff
Every department that handles data must understand the rules.
What Should a Compliant Article 13 Notice Look Like?
While formats will differ, a template typically includes:
- Who we are (controller + DPO details)
- Why we collect your data
- Legal basis for processing
- Who receives your data
- International transfers info
- Retention schedule
- Data subject rights
- Consent withdrawal instructions
- Complaint procedures
- Requirements for providing data
- Automated decision-making details (if relevant)
Short notices belong everywhere users input data.
Long notices belong:
- In Privacy Policy documents
- In layered disclosures
- In contract documentation
Final Article 13 GDPR Checklist Summary
If you collect personal data directly from individuals, confirm all of the following:
Provided at collection time
☑ Clear legal identity of controller
☑ Contact details available
☑ DPO contact if required
☑ Specific, limited purpose for processing
☑ Correct lawful basis identified
☑ Legitimate interests disclosed (if applicable)
☑ Data recipients defined
☑ International transfers explained
☑ Data retention clearly stated
☑ All relevant rights communicated
☑ Consent withdrawal easily possible
☑ Complaint authority listed
☑ Mandatory vs optional data clarified
☑ Automated decision-making explained
Presented properly
☑ Short, concise, and understandable
☑ Directly available at data collection point
☑ No deception or forced consent
☑ Reviewed regularly as business evolves
If any of these items are missing → not compliant.
Conclusion: Transparency Builds Trust and Prevents Risk
Article 13 is a cornerstone of GDPR compliance and sets the standard for respectful and lawful data collection. When organizations are transparent, people feel safer, more informed, and more willing to engage. When transparency is ignored, trust disappears and regulatory action follows.
Implementing Article 13 effectively is not just legal protection — it’s good business. Clear communication signals professionalism and respect for customer privacy.
Organizations that master this checklist will:
- Reduce legal exposure
- Strengthen brand reputation
- Increase user confidence and conversions
- Build a sustainable privacy-first culture