GDPR privacy notice checklist: what Article 13 requires

When you collect personal data directly from someone, GDPR Article 13 requires you to tell them, at the time of collection, who you are, why you process the data, on what legal basis, who receives it, how long you keep it and what rights they have. The checklist below follows the article.

Identity and purpose, Article 13(1)

1. Your identity and contact details, and your representative's if you have one.
2. The data protection officer's contact details, if you have one.
3. The purposes of processing and the legal basis for each.
4. If you rely on legitimate interests, what those interests are.
5. The recipients or categories of recipients.
6. Any transfer to a third country or international organisation, whether an adequacy decision exists, the safeguards used and how to obtain a copy.

Fair processing information, Article 13(2)

7. How long data is kept, or the criteria for deciding.
8. The rights to access, rectification, erasure, restriction and objection, and the right to data portability.
9. The right to withdraw consent at any time, where consent is the basis.
10. The right to complain to a supervisory authority.
11. Whether providing the data is a legal or contractual requirement, or needed to make a contract, whether the person must provide it and what happens if they do not.
12. Whether automated decision making or profiling takes place, with meaningful information about the logic, significance and consequences.

When to update

If you later plan to use the data for a new purpose, you must inform the person before the further processing and provide the relevant information. There is no duty to repeat information the person already has.

Making it readable

• Layer it. Put a short summary at the point of collection and the full text one click away.
• Use headings that match the items above, so a reviewer can tick them off.
• Keep sentences short. A notice nobody reads is a weak defence.
• Date it and keep old versions, so you can show what was said when someone signed up.
• Match it to your record of processing. If the notice says 12 months retention and the system keeps data for five years, one of them is wrong.

Where the notice should appear

At the sign up form, in the app settings, in the footer and wherever you collect data by a new route, such as a webinar form or a mobile screen. Each collection point should link to the same maintained text.

What this post does not cover

Article 14 covers data you obtain from other sources, and has its own list. Check it if you buy leads or enrich records from third parties.

Quick check

Sources

• GDPR Article 13, information to be provided where personal data are collected from the data subject

Last reviewed: 19 October 2026.