Module 6 · Article 13 vs Article 14 (direct vs indirect collection)
Last reviewed:
Article 13 governs data collected directly from the data subject - provide the information at the time of collection. Article 14 governs data obtained indirectly, and requires ALL the Article 13 information PLUS the categories of data and the source, within a reasonable period (no later than one month) or at first communication, whichever is earliest. Article 14 has broader exemptions, including impossible or disproportionate effort. The Irish DPC fined WhatsApp €225 million over transparency.
Article 13 applies when data is collected directly from the data subject; Article 14 applies when it is obtained indirectly. Article 14 requires everything in Article 13 plus the categories of personal data and the source.
| Article 13 (direct) | Article 14 (indirect) | |
|---|---|---|
| What to provide | Identity/contact of controller & DPO; purpose & legal basis; recipients; international transfers (adequacy/safeguards + how to get a copy); legitimate interests if relied on; storage period; rights (incl. withdraw consent, complain to an SA); whether provision is a statutory/contractual requirement + consequences; existence of automated decision-making | ALL Article 13 info PLUS the categories of personal data AND the source of the data |
| Timing | At the time of collection | Within a reasonable period (no later than one month); OR at first communication with the data subject; OR at the latest when first disclosed to another recipient - whichever is earliest |
| Exemptions | Essentially only: the data subject already has the information | Data subject already has it; impossible or disproportionate effort, or would seriously impair the purpose; obtaining/disclosure required by law; data must remain secret under a legal obligation |
Key terms - quick answers
What is “Article 13”?
What is “Article 14”?
What is “Disproportionate effort”?
Keep going - free
Every study note on this site is free. So are these: