Article 13 vs Article 14 GDPR
Last reviewed: · By Victor Humenhuk (CIPP/E certified)
Article 13 applies where personal data is collected directly from the data subject; Article 14 applies where it is obtained from any other source, such as a data broker, a public register, a credit reference agency or another company. Article 13 information must be given at the time the data is obtained, while Article 14 information must be given within a reasonable period and at the latest within one month, or at the first communication with the person, or when the data is first disclosed to another recipient - whichever comes first. Article 14 also demands two items that Article 13 does not: the categories of personal data concerned and the source of the data, including whether it came from publicly accessible sources. Only Article 14 carries the substantive exemptions in Article 14(5), including impossibility and disproportionate effort.
Article 13 vs Article 14 at a glance
| Feature | Article 13 | Article 14 |
|---|---|---|
| Trigger | Data collected from the data subject | Data obtained from any other source |
| Typical scenario | Sign-up form, application, in-store purchase, CCTV notice | Purchased list, public register, referral, screening provider, another group company |
| Timing | At the time the data is obtained | Within a reasonable period, at the latest one month; or at first communication; or at first disclosure - whichever is earliest |
| Unique item one | Whether provision is a statutory or contractual requirement and the consequences of not providing it (Art 13(2)(e)) | The categories of personal data concerned (Art 14(1)(d)) |
| Unique item two | - | The source of the data and whether it came from publicly accessible sources (Art 14(2)(f)) |
| Exemptions | Only where the data subject already has the information (Art 13(4)) | The four grounds in Art 14(5), including disproportionate effort |
What must be provided under both articles?
The overlapping core is substantial, and the safest way to learn it is as one list with additions on each side.
- Identity and contact details of the controller and, where applicable, its representative.
- Contact details of the data protection officer, where one exists.
- The purposes of the processing and the lawful basis for each.
- Where legitimate interests are relied on, the specific interests pursued.
- The recipients or categories of recipients of the personal data.
- Any transfer to a third country or international organisation, the adequacy decision or safeguard relied on, and how to obtain a copy of it.
- The retention period, or the criteria used to determine it.
- The rights to request access, rectification, erasure, restriction and portability, and to object.
- Where consent is the basis, the right to withdraw it at any time without affecting the lawfulness of processing already carried out.
- The right to lodge a complaint with a supervisory authority.
- The existence of automated decision-making, including profiling, under Article 22, with meaningful information about the logic involved and the significance and envisaged consequences.
Both articles also require you to inform the person before any further processing for a new purpose, under Articles 13(3) and 14(4).
When are you exempt from providing the information?
Article 13(4) has a single exemption: no obligation where and insofar as the data subject already has the information. Article 14(5) is much broader, which is the main reason the two articles are worth separating in your head.
- Article 14(5)(a) - the data subject already has the information.
- Article 14(5)(b) - provision proves impossible or would involve a disproportionate effort, in particular for archiving in the public interest, scientific or historical research or statistical purposes subject to Article 89(1) safeguards, or where notification would render impossible or seriously impair the achievement of those objectives. In that case you must take appropriate measures to protect the person's rights, including making the information publicly available.
- Article 14(5)(c) - obtaining or disclosure is expressly laid down by Union or member state law that provides appropriate safeguards.
- Article 14(5)(d) - the data must remain confidential because of a professional secrecy obligation regulated by Union or member state law.
The WP29 transparency guidelines read disproportionate effort narrowly: it is not a cost complaint. You are expected to balance the effort against the impact on the individual and to record that balancing, and where you rely on it you should still publish the information and consider alternatives such as a targeted notice.
How the two articles interact in practice
Most organisations trigger both. If you collect an application form from a candidate and then obtain a reference or a screening report from a third party, Article 13 governs the form and Article 14 governs the screening data, with its own one-month clock and its own source disclosure.
Two practical points follow. First, a passive privacy policy sitting on a website will rarely satisfy Article 14 on its own: the information has to be actively brought to the person's attention, which usually means an email or a letter within the deadline. The Article 14(5)(b) fallback of publishing the information is exactly that, a fallback, and only available once the exemption is properly made out. Second, layering is encouraged rather than penalised - Article 12(1) requires concise, transparent, intelligible and easily accessible information in clear and plain language, and regulators accept a short front layer that expands into detail.
Work through the detail in the notes on what must be provided under Articles 13 and 14.
Related study notes
- Article 13 vs Article 14 - what must be provided
- Module 6 · Article 13 vs Article 14 (direct vs indirect collection)
- When information must be provided (timing)
- Exemptions to the obligation to provide information
- Situations requiring additional information
Frequently asked questions
What if the same person's data comes from both routes?
Both articles apply to their respective data sets. Deal with the directly collected data at the point of collection under Article 13, and give the Article 14 information for the indirectly obtained data within its own deadline, including the source and the categories of data concerned.
How long do I have to comply with Article 14?
A reasonable period after obtaining the data and at the latest one month, having regard to the specific circumstances. That deadline shortens if you communicate with the person first, or disclose the data to another recipient first - the information is due at the earliest of the three points.
Do I have to name the exact source of the data?
Article 14(2)(f) requires the source and, where applicable, whether it came from publicly accessible sources. The WP29 transparency guidelines expect the specific source to be named where possible; where data comes from many sources, the nature and type of sources should be given in enough detail for the person to understand what happened.
Does Article 13 apply to observed data such as CCTV or website analytics?
Yes, where it is collected from the individual themselves, including by observation. Article 13 covers data you obtain from the data subject directly, not only data they consciously type into a form, which is why CCTV signage and layered cookie information sit under Article 13.
Test yourself
Try the free CIPP/E practice questions, or read the full CIPP/E study guide - free.