Different provisions of the General Data Protection Regulation provide for obligations to inform data subjects – the legal term designating common people – about the processing of their personal information. Controllers – the persons who control the processing of personal data – have to conform to certain requirements regarding how they provide the information to the data subjects, whether beforehand in a privacy notice available to the general public or when they reply to an individual request.

Article 12 addresses first the form of the information that must be provided. It must be communicated “in a concise, transparent, intelligible, and easily accessible form”. The provision further states that controllers should use “clear and plain language” in their communication. All these adjectives seem self-explanatory, but they deserve a closer look to clarify their actual meaning in the context of data protection laws.

Conciseness refers to the fact that the information must be presented briefly but also in a comprehensive manner. Controllers may have a large amount of information to provide to a person depending on the nature of the request, but they have to present it succinctly nonetheless. The principle can be translated in the manner that the information is physically presented and structured (see below). Excluding irrelevant, redundant, or unnecessary information is another way to keep the communication “concise”.

Transparency is one of the key principles of the GDPR [Article 5(1)(a), recital 39, and Guidelines on Transparency]. It must be regarded as a general obligation encompassing openness, honesty, and truthfulness. A company must proactively divulge all the necessary information about how it processes personal data or communicate it when asked for. It should not hide information nor try to bury down important details. The information must be accessible first-handed or freely transmitted when requested.

Intelligibility means that privacy-related information must be comprehensible. The concept overlaps other principles but the main idea is that the information must be easy to understand (recitals 39 and 58) and presented in a form adapted to the audience (adults, children, professionals, special context, etc.). The writing style should be simple, easily accessible words should be preferred and complex terms should be explained. The information communicated should be straightforward, avoid any ambiguity, and leave no room to interpretation.

Ease of access implies that data protection information should be easy to access. The way the information is provided should be adapted to the context or platform where it is presented. A link to the privacy policy can be prominently presented at the bottom of an email or displayed where people usually look for it on a website, in the footer, for example. It should not be hidden in a counterintuitive menu in an application where users will never think to look for it. As a rule of thumb, information about privacy in an application should never be more than “two taps away”, according to the Guidelines on Transparency.

Using clear and plain language coincides with the intelligibility principle. The language used must be adapted and tailored to the audience. Basic and easy to understand words must be preferred. Complex legal terminology should be avoided and if necessary should be clarified. Sentences and paragraphs should be short and the language structure should be kept as simple as possible (Guidelines on Transparency). Special attention must be given to that point when controllers address children (recital 58). The language used should be easily understandable to a child (see our commentary under Article 8).

Information in line with these requirements must be transmitted in “writing” or by any “other means”. The chosen mean depends on the targeted audience and it includes electronic forms such as applications or websites (recital 58). It might be provided, if adapted to the situation, through cartoons, infographics, or flowcharts (Guidelines on Transparency). Another means of providing the information is through a secure “self-service system” which would give an individual access to her/his data (recital 63). Information can even be communicated orally if requested so, provided that the data subject proves her/his identity by other means.

The form and structure of the information are also addressed by the European regulation. Privacy-related information must be clearly differentiated from other legal information such as the general terms of use (Guidelines on Transparency). It can be separated into different logic paragraphs, each one of them preceded with a heading stating its actual content. It is sometimes referred to as the “layered” approach in European documentation. The use of headings, bullets, or indents to logically structure the document – whether it is a privacy notice or an answer to a request – is a pragmatic answer to a legal obligation.

Access to information should be facilitated by controllers. They should maintain mechanisms (recital 59) through which data subjects can exercise their rights (Articles 15 to 22), receive information – where personal data are collected from them (Article 13) or obtained from third parties (Article 14) – or be informed of data breaches (Article 34). The information obligation extends to situations where the exchange of data takes place between two administrative bodies (CJEU, Smaranda Bara e.a./Președintele Casei Naționale de Asigurări de Sănătate).

Facilitating access to information can be done by resorting to a standard form. It could ease the formulation of a request by the data subject, but also the work of the controller who will receive a structured message with the needed information to process the request. It has to be noted that the use of the form cannot be made mandatory, as any other forms of requests are valid (orally, by email, through a letter, etc.).

Controllers must act quickly on data subjects’ requests. Article 12(3) imposes strict delays to provide the information requested or inform data subjects on action taken upon their request. The general rule is that controllers should proceed “without undue delay”, but the GDPR does not define the expression. It must be understood as “as soon as possible”, but at least within a calendar month after receiving the request.

Exceptionally, the period may be extended by two further months. It is possible only if the request is complex or there are many requests to be answered at the same time. The controller in such an event has to inform the data subject within the initial period of one month of her/his intention of prolonging the delay. The computation of the delay starts the day the request is received or, if applicable, after getting the confirmation of the identity of the person requesting the information or the payment of the fee.

There are circumstances where controllers may refuse to answer a request (recital 59). If they deny the request, they have to inform the data subject in the same delays mentioned above of the reasons why they refuse to act. They must also notify the data subject of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy.

A request can be denied if it “manifestly unfounded or excessive” [Article 12 (5)]. It can be the case, for example, when a data subject made repetitive requests over a short period of time. It can also happen if the person is making a request simply to get something in return from the organization or the individual is using data protection laws to harass the organization. The adjective “manifestly” used in the GDPR means that the request must be clearly or obviously excessive or unfounded. The burden to demonstrate that the request is “manifestly” excessive or unfounded rests on the controller’s shoulders.

It would be a better option to open a dialogue with the data subject than refusing to act on the request. A request may seem excessive or unfounded simply because it is not correctly formulated or the data subject does not fully understand her/his rights. Controllers may ask for additional details, for example, to help find the requested information. A refusal to act should be kept for extreme cases to make sure that the controller does not expose herself/himself to sanctions.

Every request should be answered free of charge [Article 12 (5) and recital 59]. A reasonable fee – based on the administrative costs necessary to provide the answer – may be imposed only in cases where the demand is deemed excessive. A data subject’s request will not be deemed excessive if s/he wants to receive additional copies of information already provided, but a fee can be charged in these circumstances. The data subject should be informed about the amount payable and the controller has the right to wait until the payment is cleared before providing the information.

If the controller has a “reasonable doubt” about the identity of the person making the request, s/he may require additional information to confirm that s/he is replying to the right person. The requested information should be proportionate to the aim of completing the identification of the person and not go beyond what is necessary to do so.

ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraphs to article 12 GDPR:

7.3.3 Providing information to PII principals

Control

The organization should provide PII principals with clear and easily accessible information identifying the PII controller and describing the processing of their PII.

Implementation guidance

The organization should provide the information detailed in 7.3.2 to PII principals in a timely, concise, complete, transparent, intelligible and easily accessible form, using clear and plain language, as appropriate to the target audience.

Where appropriate, the information should be given at the time of PII collection. It should also be permanently accessible.

NOTE Icons and images can be helpful to the PII principal by giving a visual overview of the intended processing.

7.3.9 Handling requests

Control

The organization should define and document policies and procedures for handling and responding to legitimate requests from PII principals.

Implementation guidance

Legitimate requests can include requests for a copy of PII processed, or requests to lodge a complaint.

Some jurisdictions allow the organization to charge a fee in certain cases (e.g. excessive or repetitive requests).

Requests should be handled within the appropriate defined response times.

Some jurisdictions define response times, depending on the complexity and number of the requests, as well as requirements to inform PII principals of any delay. The appropriate response times should be defined in the privacy policy.