Art.13 Information to be provided where personal data are collected
Where personal data is collected from the data subject, provide at the time it is obtained the identity and contact details of the controller and any representative, the contact details of the data protection officer, the purposes and the legal basis, the legitimate interests where that is the basis, the recipients or categories of recipient, and any intention to transfer to a third country with the existence or absence of an adequacy decision and, for Article 46, 47 or 49(1) transfers, reference to the safeguards and how to obtain a copy. Provide in addition the storage period or the criteria used to determine it, the existence of the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent where consent is the basis, the right to lodge a complaint with a supervisory authority, whether providing the data is a statutory or contractual requirement and the consequences of not providing it, and the existence of automated decision-making including profiling with meaningful information about the logic involved and its significance and envisaged consequences. Before further processing for a new purpose, provide that purpose and the further information first.
Source: GDPR, Art.13. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.
Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of the point and timing at which the notice is presented for each collection channel, including forms, telephone and in person · Data governance / DLP tooling
- Records showing new purpose information was given before the further processing started, with dates · Document repository
governing documentDocuments that govern the control
- The privacy notice mapped item by item against every information element Article 13 lists · Policy repository / GRC workspace
- The storage periods or criteria as published, reconciled against the actual retention schedule · Policy repository / GRC workspace
- The published description of automated decision-making logic, and the reasoning for why it is meaningful to a data subject · Policy repository / GRC workspace
First move
Common gaps auditors find
- Recipients described only as third parties or trusted partners, which names neither a recipient nor a category
- Retention shown as for as long as necessary, which is neither a period nor a criterion
- The notice linked from a page footer but not presented at the point of collection, so it is not provided at the time the data is obtained
- Automated decision-making logic described in terms that would fit any system, leaving the data subject nothing to contest
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.12 Transparent information, communication and modalities for rights · Art.14 Information where personal data have not been obtained from the data subject