# Privacy notice — GDPR information duties and legal bases

Status as at 2026-08-05.

**Regulation (EU) 2016/679.** The base text is unamended since 2016, apart from the 2018 corrigendum. A Regulation: Arts 12 to 22 are identical in all 27 member states. What varies is the supervisory authority, the child-consent age under Art 8(1), and the national provisions permitted by Arts 9(4), 10 and 85 to 91.

**Nothing in the Digital Omnibus is in force.** COM(2025) 837 of 19.11.2025 proposes amendments to Arts 5(1)(b) and 22, a new Art 33a single-entry-point breach notification, a 96-hour breach deadline and a new Art 88a on terminal-equipment access. It is at European Parliament committee stage as at 05.08.2026. The EDPB and EDPS adopted Joint Opinion 2/2026 on it on 11.02.2026. Draft to the current text, not to the proposal.

## Art 13 — data collected from the data subject

Provided **at the time the data are obtained**.

Art 13(1):

- (a) identity and contact details of the controller and, where applicable, of the controller's representative
- (b) contact details of the data protection officer, where applicable
- (c) **the purposes of the processing and the legal basis for the processing**
- (d) where processing is based on Art 6(1)(f), the legitimate interests pursued by the controller or by a third party
- (e) the recipients or categories of recipients, if any
- (f) where applicable, that the controller intends to transfer to a third country or international organisation, the existence or absence of an adequacy decision, and for Art 46/47/49(2) transfers, reference to the appropriate safeguards and **the means to obtain a copy of them or where they have been made available**

Art 13(2), additionally, to ensure fair and transparent processing:

- (a) the storage period, or if that is not possible, the criteria used to determine it
- (b) the rights of access, rectification, erasure, restriction of processing, objection, and data portability
- (c) where processing is based on Art 6(1)(a) or Art 9(2)(a), the right to **withdraw consent at any time**, without affecting the lawfulness of processing before withdrawal
- (d) the right to lodge a complaint with a supervisory authority
- (e) whether providing the data is a statutory or contractual requirement, or necessary to enter into a contract, whether the data subject is obliged to provide it, and the consequences of failure
- (f) the existence of **automated decision-making including profiling under Art 22(1) and (4)**, and at least in those cases meaningful information about the logic involved and the significance and envisaged consequences

Art 13(3): before further processing for a **new purpose**, provide information on that purpose plus any relevant Art 13(2) information. Art 13(4): the duty does not apply insofar as the data subject already has the information.

## Art 14 — data not obtained from the data subject

Art 14(1): (a) controller identity and contact details; (b) DPO contact details; (c) purposes and legal basis; **(d) the categories of personal data concerned**; (e) recipients or categories of recipients; (f) third-country transfer information as in Art 13(1)(f).

Art 14(2): (a) storage period or criteria; (b) legitimate interests where Art 6(1)(f) is relied on; (c) the rights of access, rectification, erasure, restriction, objection and portability; (d) the right to withdraw consent where Art 6(1)(a) or Art 9(2)(a) applies; (e) the right to lodge a complaint; **(f) from which source the data originate and, if applicable, whether it came from publicly accessible sources**; (g) automated decision-making under Art 22.

**Art 14(3) timing** — the point most often missed:

- (a) within a reasonable period after obtaining the data, and **at the latest within one month**
- (b) if the data are used to communicate with the data subject, **at the latest at the first communication**
- (c) if disclosure to another recipient is envisaged, **at the latest when the data are first disclosed**

Art 14(5) exceptions: (a) the data subject already has the information; (b) provision proves impossible or would involve a **disproportionate effort**, in particular for archiving in the public interest, scientific or historical research or statistics subject to Art 89(1), or would render the objectives seriously impaired — in which case appropriate measures including public availability of the information are required; (c) obtaining or disclosure is expressly laid down by Union or member state law providing appropriate safeguards; (d) the data must remain confidential under a professional secrecy obligation regulated by law.

Any enrichment, data-broker feed, scraped dataset or CRM import triggers Art 14, not Art 13.

## Art 6(1) — legal bases

| Point | Basis | Practical note |
|---|---|---|
| (a) | consent | must meet Art 4(11) and Art 7; withdrawable at any time |
| (b) | performance of a contract with the data subject, or pre-contractual steps at their request | does not cover analytics, marketing or "service improvement" |
| (c) | compliance with a legal obligation of the controller | the obligation must be Union or member state law; name it |
| (d) | vital interests | rare outside emergencies |
| (e) | public interest or official authority | needs a Union or member state law basis |
| (f) | legitimate interests, unless overridden by the interests or fundamental rights of the data subject, in particular where the data subject is a child | requires a documented three-part test: purpose, necessity, balancing |

Art 6(1)(f) is not available to public authorities in the performance of their tasks.

**EDPB Guidelines 1/2024 on the processing of personal data based on Article 6(1)(f) exist only as a public-consultation draft.** Do not cite them as final guidance. [[UNVERIFIED: whether a final version has since been adopted — check edpb.europa.eu before citing]]

The legal basis is stated **per processing purpose**, not once for the whole site. Art 13(1)(c) requires it, and mixing bases for one purpose ("consent or legitimate interest") is a defect, not a fallback.

## Art 9 — special categories

Art 9(1) prohibits processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person's sex life or sexual orientation.

Exceptions used by ordinary products, from Art 9(2): (a) **explicit consent** — a higher standard than ordinary consent, and member states may provide that the prohibition cannot be lifted by consent; (f) establishment, exercise or defence of legal claims; (h) preventive or occupational medicine, medical diagnosis, health or social care, subject to Art 9(3) professional secrecy; (i) public interest in public health.

**Art 9(4)**: member states may maintain or introduce further conditions, including limitations, on genetic data, biometric data and health data. National layer.

Art 10: criminal conviction and offence data may be processed only under the control of official authority or where authorised by Union or member state law providing appropriate safeguards.

Inference matters. A fitness app that stores workouts, a dating product that reveals orientation, a form field for dietary requirements that reveals religion — all Art 9.

## Art 7 — conditions for consent

Art 4(11) defines consent as any **freely given, specific, informed and unambiguous** indication of the data subject's wishes by which they, by a **statement or by a clear affirmative action**, signify agreement.

- **Art 7(1)**: the controller must be able to **demonstrate** that consent was given
- **Art 7(2)**: where consent is given in a written declaration also concerning other matters, the request must be presented in a manner **clearly distinguishable** from the other matters, in an intelligible and easily accessible form, using clear and plain language; any part infringing the Regulation is not binding
- **Art 7(3)**: the data subject may withdraw at any time; withdrawal does not affect prior lawfulness; the data subject must be informed of this **before** giving consent; **withdrawal must be as easy as giving consent**
- **Art 7(4)**: in assessing whether consent is freely given, utmost account is taken of whether performance of a contract is made conditional on consent to processing that is **not necessary** for that contract

Guidelines 05/2020 on consent under Regulation 2016/679, adopted 04.05.2020, remains the reference.

## Art 8 — child consent for information society services

Art 8(1): where Art 6(1)(a) consent applies to the offer of information society services directly to a child, processing is lawful where the child is **at least 16 years old**. Below that, consent must be given or authorised by the holder of parental responsibility. **"Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years."**

Art 8(2): the controller must make **reasonable efforts to verify** that consent is given or authorised by the holder of parental responsibility, taking into consideration available technology. Art 8(3): Art 8 does not affect national contract law on the validity, formation or effect of a contract in relation to a child.

**Verified national ages**, each read out of the member state's own statute — 14 of 27, status 05.08.2026:

| Member state | Age | Provision |
|---|---|---|
| Austria | **14** | § 4 Abs 4 DSG |
| Belgium | **13** | art. 7, loi du 30 juillet 2018 relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel — below 13 the legal representative must consent |
| Czechia | **15** | § 7 zákona č. 110/2019 Sb.: *"Dítě nabývá způsobilosti k udělení souhlasu … dovršením patnáctého roku věku"* |
| Denmark | **15** | raised from 13 with effect 01.01.2024 |
| Finland | **13** | tietosuojalaki 1050/2018, 5 § |
| France | **15** | article 45 de la loi n° 78-17 — below 15, consent must be given **conjointement** by the minor and the holder(s) of parental authority, which is a French peculiarity: not parental consent instead of the child's, but both |
| Germany | **16** | no derogation — Art 8(1) GDPR default; the BDSG contains no lower age |
| Ireland | **16** | s 31(1) Data Protection Act 2018. **s 31(2) carves out preventative and counselling services** from "information society services" for this purpose |
| Italy | **14** | art. 2-quinquies Codice Privacy |
| Netherlands | **16** | art. 5 UAVG: *"…indien de betrokkene de leeftijd van zestien jaren nog niet heeft bereikt"* |
| Poland | **16** | no derogation — the ustawa z dnia 10 maja 2018 r. (Dz.U. 2018 poz. 1000) contains **no** age provision; consolidated text as at 23.07.2026 checked article by article. Do not cite the Polish act as the source of a "16"; the source is Art 8(1) GDPR |
| Portugal | **13** | artigo 16.º n.º 1 da Lei n.º 58/2019: consent works *"quando as mesmas já tenham completado 13 anos de idade"* |
| Spain | **14** | artículo 7 LO 3/2018: *"únicamente podrá fundarse en su consentimiento cuando sea mayor de catorce años"* |
| Sweden | **13** | 2 kap. 4 § lagen (2018:218) — applies to a child **resident in Sweden** |

Two of these are commonly reported wrongly: **Poland** is 16 by GDPR default, not by national statute, and **Ireland** has a services carve-out that a flat "16" hides.

**[[UNVERIFIED: the digital consent age in the remaining 13 member states — Bulgaria, Croatia, Cyprus, Estonia, Greece, Hungary, Latvia, Lithuania, Luxembourg, Malta, Romania, Slovakia, Slovenia. Attempted 05.08.2026 against the national legislation portals (riigiteataja.ee, slov-lex.sk, pisrs.si, legislatie.just.ro among them); each returned an empty body, a redirect loop or a bot block to automated retrieval. Read the member state's own data protection act before stating a figure — there is no reliable EU-level compilation that is current, and secondary tables disagree with the statutes for several of these.]]**

Consequence for drafting: **never state a single EU-wide age.** A product with users in several member states either applies the highest applicable age across the board as a business decision, or determines the age per member state. Both are legitimate; guessing is not.

## Arts 15–22 — data subject rights

| Article | Right | Note |
|---|---|---|
| 15 | access, including a **copy** of the data | includes the Art 15(1)(a)–(h) information; the copy is not optional |
| 16 | rectification and completion | |
| 17 | erasure | with the Art 17(3) exceptions, incl. freedom of expression and legal claims |
| 18 | restriction of processing | four triggers in 18(1) |
| 19 | notification obligation to recipients | on rectification, erasure or restriction |
| 20 | data portability | only for processing based on **consent or contract** and carried out by automated means |
| 21 | objection | absolute for **direct marketing** (Art 21(2)–(3)); balanced for Art 6(1)(e)/(f) |
| 22 | not to be subject to solely automated decisions with legal or similarly significant effects | with the 22(2) exceptions and the 22(3) safeguards |

**Art 12(3)**: respond **without undue delay and in any event within one month** of receipt. Extendable by **two further months** where necessary, taking account of complexity and number of requests, provided the data subject is informed of the extension and the reasons within one month. **Art 12(4)**: if no action is taken, inform the data subject within one month of the reasons and of the right to complain and to a judicial remedy. **Art 12(5)**: information and action are free of charge; only where requests are **manifestly unfounded or excessive, in particular because of their repetitive character**, may the controller charge a reasonable fee or refuse — and the controller bears the burden of demonstrating that.

## Art 3 — territorial scope

Art 3(1): processing in the context of the activities of an establishment in the Union, regardless of where the processing takes place. **Art 3(2)**: processing by a controller or processor **not established in the Union**, where the processing relates to (a) the offering of goods or services to data subjects in the Union, irrespective of whether payment is required, or (b) the monitoring of their behaviour as far as it takes place within the Union.

Art 3(2) is what pulls a non-EU SaaS product into the GDPR, and Art 27 then requires an EU representative. See `gdpr-internal.md`.

## Template — privacy notice skeleton

```html
<!-- DRAFT – NOT LEGALLY APPROVED -->
<h1>Privacy notice</h1>
<p>Last updated: [[DATE]]</p>

<h2>Who is responsible</h2>
<p>
  Controller: [[LEGAL NAME]], [[ADDRESS]], [[EMAIL]].
  [[Where Art 27 applies: EU representative: NAME, ADDRESS, EMAIL.]]
  [[Where appointed: Data protection officer: CONTACT.]]
</p>

<h2>What we process, why, and on what basis</h2>
<table>
  <thead>
    <tr>
      <th>Processing</th><th>Data</th><th>Purpose</th><th>Legal basis</th>
      <th>Retention</th><th>Recipients</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td>[[e.g. server logs]]</td><td>[[CATEGORIES]]</td><td>[[PURPOSE]]</td>
      <td>[[Art 6(1)(x) — for (f): the concrete legitimate interest]]</td>
      <td>[[PERIOD OR CRITERIA]]</td><td>[[NAMED RECIPIENTS]]</td>
    </tr>
  </tbody>
</table>

<h2>Where data comes from</h2>
<p>[[Art 14 only: sources, and whether publicly accessible sources were used.]]</p>

<h2>International transfers</h2>
<p>[[See the transfers table; state the basis per recipient and how to obtain a
copy of the safeguards.]]</p>

<h2>Automated decision-making</h2>
<p>
  [[Either: We do not use automated decision-making within Art 22(1).
  Or: description, the logic involved, and the significance and envisaged
  consequences.]]
</p>

<h2>Your rights</h2>
<p>
  Access, rectification, erasure, restriction, objection and data portability
  (Arts 15–20). You may object at any time to processing for direct marketing
  (Art 21(2)). Where processing is based on consent, you may withdraw it at any
  time with the same effort as giving it, without affecting prior lawfulness
  (Art 7(3)). We respond within one month (Art 12(3)).
</p>
<p>
  You may lodge a complaint with a supervisory authority:
  [[MISSING: supervisory authority name, address and website — member state]].
</p>

<h2>Is providing data required</h2>
<p>[[Statutory / contractual / necessary to conclude the contract, and the
consequences of not providing it.]]</p>

<h2>Children</h2>
<p>
  [[Where the service is directed at children: the applicable age under the
  national implementation of Art 8(1) GDPR, and how parental consent is obtained
  and verified.]]
</p>
```

## Checkpoints

- [ ] Reachable without consent and without login, from every page
- [ ] Every processing listed with purpose, **legal basis**, recipients, retention (Art 13(1)(c), 13(2)(a))
- [ ] Legitimate interests named concretely, with a written balancing test on file (Art 13(1)(d))
- [ ] Recipients named, not only "service providers" — and matched against an actual network trace
- [ ] Third-country transfers listed per recipient with the Chapter V basis and how to obtain a copy of the safeguards (Art 13(1)(f))
- [ ] Data not collected from the data subject covered by Art 14, including the **source** (Art 14(2)(f)) and the one-month / first-communication / first-disclosure timing (Art 14(3))
- [ ] Full rights list including objection to direct marketing and consent withdrawal (Art 13(2)(b), (c))
- [ ] Correct supervisory authority named with a working address (Art 13(2)(d))
- [ ] Statutory or contractual requirement to provide data, and the consequences, stated (Art 13(2)(e))
- [ ] Automated decision-making either ruled out explicitly or described with the logic and consequences (Art 13(2)(f), Art 22)
- [ ] Special categories identified, including data revealed by inference, with an Art 9(2) exception per purpose
- [ ] Child-consent age stated per member state with the national statute, or reported as `[[MISSING]]` — never a single EU figure
- [ ] Consent, where used, meets Art 4(11) and Art 7, is logged, and is withdrawable with equal effort
- [ ] Response process meets the Art 12(3) one-month deadline with the documented two-month extension route
- [ ] No reference to the Digital Omnibus proposal as if it were law
- [ ] All `[[…]]` placeholders resolved or reported as open