Right of Information

The data subject right to be informed about data collection and processing before or at the time of data collection, established under GDPR Articles 13 and 14. Organizations must provide transparent information about: controller identity, processing purposes and legal basis, recipients, retention periods, data subject rights, right to lodge complaints, whether providing data is required, and consequences of not providing data. When collecting data directly from individuals, notice must be provided at collection time. When obtaining data from other sources, notice must be given within one month (or first communication if earlier). Information should be concise, transparent, intelligible, and easily accessible using clear, plain language. Privacy notices, cookie banners, and collection notices fulfill this requirement. This right ensures transparency—individuals can make informed decisions about sharing data and understand their rights. The right applies regardless of whether consent is the legal basis. Organizations should layer privacy information, providing key details upfront with links to comprehensive policies.