GDPR Article 13 vs Article 14: Information Obligations Explained

What does Article 13 GDPR require, and when does it apply?

Article 13 GDPR applies when personal data are collected from the data subject, and the required information must be provided at the time of collection, including controller details, purposes, legal basis, rights information, and other transparency details listed in Article 13(1) and 13(2).

In practice, Article 13 is the rule for forms, sign-up pages, account creation, onboarding flows, and other situations where the individual gives their own personal data directly to the controller. Article 13(1) requires the controller to provide its identity and contact details, the representative where applicable, the DPO contact details where applicable, the purposes of processing, the legal basis, recipients or categories of recipients, and third-country transfer information where relevant.

Article 13(1)(d) adds a specific disclosure where the legal basis is legitimate interests under Article 6(1)(f): the controller must state the legitimate interests pursued by the controller or a third party. Article 13(2) then adds the information needed for fair and transparent processing, including the storage period or criteria, data subject rights, the right to withdraw consent where consent is the basis, the right to lodge a complaint with a supervisory authority, whether provision of the data is a statutory or contractual requirement or needed to enter a contract, the consequences of not providing the data, and the existence of automated decision-making including profiling where applicable.

Article 13(3) also matters for exam questions: if the controller later wants to process the same data for a different purpose, it must inform the data subject of that other purpose and provide any relevant further information from Article 13(2) before that further processing. The only exemption in Article 13 is paragraph 4, which says paragraphs 1 to 3 do not apply where and insofar as the data subject already has the information.

• Article 13(1): Controller identity and contact details; representative where applicable; DPO contact where applicable; purposes and legal basis; legitimate interests where Article 6(1)(f) applies; recipients; third-country transfer information where applicable.
• Article 13(2): Storage period or criteria; rights; withdrawal of consent where relevant; complaint right; whether providing data is required and consequences of not providing it; automated decision-making/profiling information where applicable.
• Article 13(3): Prior information is required before processing for a different purpose.
• Article 13(4): No duty where and insofar as the data subject already has the information.

What does Article 14 GDPR require, and when does it apply?

Article 14 GDPR applies when personal data have not been obtained from the data subject, and the controller must provide largely similar transparency information, plus the categories of personal data and the source of the data, within the timing rules in Article 14(3).

This is the article to use where data come from a third party, a publicly accessible source, or another external source rather than directly from the individual. Article 14(1) includes the same basic transparency elements as Article 13 on controller details, DPO contact where applicable, purposes, legal basis, recipients, and third-country transfer information, but it also expressly requires the categories of personal data concerned in Article 14(1)(d).

Article 14(2) then mirrors much of Article 13(2), such as the storage period or criteria, rights, withdrawal of consent where relevant, the complaint right, and automated decision-making information. However, Article 14 also has an extra item in paragraph 2(f): the controller must tell the data subject from which source the personal data originate, and if applicable whether they came from publicly accessible sources.

The timing rule is a classic distinction. Under Article 14(3), the information must be given within a reasonable period after obtaining the personal data and at the latest within one month, taking account of the specific circumstances. If the data are used to communicate with the data subject, the information must be given at the latest at the time of the first communication; if disclosure to another recipient is envisaged, it must be given at the latest when the data are first disclosed. As with Article 13, Article 14(4) also requires prior information before further processing for a different purpose.

• Article 14(1)(d): Must disclose the categories of personal data concerned.
• Article 14(2)(f): Must disclose the source of the data, and whether it came from publicly accessible sources where applicable.
• Article 14(3)(a): Within a reasonable period after obtaining the data, at the latest within one month.
• Article 14(3)(b): If used for communication with the data subject: at the latest at first communication.
• Article 14(3)(c): If disclosure to another recipient is envisaged: at the latest when the data are first disclosed.

What are the key differences between Article 13 and Article 14?

The key differences are scope, timing, two extra disclosure items in Article 14, and the number of exemptions: Article 13 covers direct collection at the time of collection, while Article 14 covers indirect collection and adds categories of data, source of data, and a broader exemption structure.

For exam prep, the easiest way to separate the two articles is to ask one question first: did the controller get the personal data from the individual or not? If yes, Article 13 applies. If no, Article 14 applies. That single distinction explains why Article 14 contains disclosures that would be unnecessary in direct collection cases, especially the categories of personal data and the source of the data.

The timing is the next major contrast. Article 13 requires the information at the time of collection. Article 14 uses a staggered model in paragraph 3: within one month at the latest, but sooner if the controller communicates with the data subject or first discloses the data to another recipient. The final high-value distinction is exemptions: Article 13(4) has only one, while Article 14(5) has four, which makes Article 14 notably more exam-sensitive.

• Scope: Article 13: data collected from the data subject. Article 14: data not obtained from the data subject.
• Timing: Article 13: at the time of collection. Article 14: within one month at the latest, or earlier at first communication or first disclosure where applicable.
• Categories of data: Expressly required only by Article 14(1)(d).
• Source of data: Expressly required only by Article 14(2)(f).
• Exemptions: Article 13(4): one exemption. Article 14(5): four exemptions.
• DPO contact wording: Materially the same in substance: both require DPO contact details where applicable.

What exemptions exist from the information obligation?

The most important exam point is that Article 13 has only one exemption in paragraph 4, but Article 14 has four exemptions in paragraph 5, so the two articles do not share the same exemption list.

Article 13(4) is narrow: paragraphs 1 to 3 do not apply where and insofar as the data subject already has the information. That is the only exemption stated in Article 13. Candidates often over-generalise from Article 14 and wrongly import additional exemptions into Article 13.

Article 14(5) starts with the same idea in point (a): no duty where the data subject already has the information. But Article 14 then adds three further exemptions. Under point (b), the duty does not apply where providing the information proves impossible or would involve disproportionate effort, in particular for archiving in the public interest, scientific or historical research, or statistical purposes subject to Article 89(1), or where the obligation would likely render impossible or seriously impair the achievement of the objectives of the processing; in such cases, the controller must take appropriate measures to protect the data subject's rights, freedoms and legitimate interests, including making the information publicly available.

Article 14(5)(c) adds an exemption where obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject, and that law provides appropriate measures to protect the data subject's legitimate interests. Article 14(5)(d) adds confidentiality covered by a professional secrecy obligation regulated by Union or Member State law, including a statutory obligation of secrecy. For revision, remember this as a core trap: one exemption in Article 13, four in Article 14.

• Article 13(4): Data subject already has the information.
• Article 14(5)(a): Data subject already has the information.
• Article 14(5)(b): Provision impossible or disproportionate effort, including specified Article 89(1)-related contexts, or where the obligation would likely render impossible or seriously impair the processing objectives; protective measures are required.
• Article 14(5)(c): Obtaining or disclosure expressly laid down by Union or Member State law with appropriate protective measures.
• Article 14(5)(d): Data must remain confidential under a professional secrecy obligation regulated by Union or Member State law.

What does this mean in practice for privacy notices and exam prep?

In practice, you should build privacy notices by first identifying how the data were obtained, because that determines whether the notice follows Article 13 or Article 14 and whether you must add categories of data, source information, and Article 14's distinct deadline and exemptions.

For compliance work, a direct-collection notice should track Article 13(1) and 13(2) and be available at the point of collection. An indirect-collection notice should track Article 14(1) and 14(2), adding the categories of personal data and the source of the data, and it must be delivered within the Article 14(3) timetable. If a controller later changes purpose, both Article 13(3) and Article 14(4) require prior information about that other purpose and the relevant further information.

For exam technique, three mistakes are especially common. First, candidates confuse the timing rules and write that Article 14 also applies at the time of collection; it does not, because the data were not collected from the data subject. Second, they forget that Article 14 expressly requires categories of data and the source of the data. Third, they assume the exemption rules are symmetrical, even though Article 13 has one exemption and Article 14 has four.

If you are asked what a privacy notice must contain under GDPR, the safest approach is to anchor your answer to the correct article and paragraph. Mention the core identity, purpose, legal basis, rights, recipients, storage, complaint, transfer, and automated decision-making items, then add the Article 13- or Article 14-specific elements as required by the collection scenario. That article-first method is both exam-safe and operationally useful.

Article 13 vs Article 14 GDPR at a glance

Frequently asked questions