Point of law

The information duties under Art. 13 and 14 GDPR

The duty to inform arises with the collection of personal data and does not presuppose a contractual relationship. Employers therefore have to inform their staff just as organisations inform their customers. The privacy notice on a website does not usually discharge that duty. Which information has to be provided depends on the source the data came from.

The notice sits on the website, not in the process

The rejection letter to an applicant has been written. Whether she ever learned how long her documents will be kept, and who can see them, nobody knows. The website carries a privacy notice. It is about cookies and the contact form.

Employees and applicants are data subjects like anyone else

Whether employees have to be informed is often answered by pointing to the employment relationship. That misses the provision. Art. 13(1) GDPR attaches to the collection of personal data from the data subject, and an employment contract changes nothing about that.

Section 26(1) BDSG permits the processing of employee data in so far as it is necessary for the employment relationship. A permission is not an exemption from informing. The two sit in different chapters of the regulation and answer different questions.

Art. 13(4) GDPR withdraws the duty in so far as the data subject already has the information. That is a narrow exemption and not a presumption. A sentence about processing in an employment contract conveys nothing about recipients, retention periods or the legal basis.

The catalogue depends on where the data came from

Which items belong in a notice is not decided by the addressee but by the origin of the data. Two provisions sit side by side, and their catalogues do not match.

Collected from the person, or from elsewhere

Art. 13 GDPR	Merkmal	Art. 14 GDPR
Data from the personForm, conversation, application, order.	Occasion	Data from elsewhereCredit agency, intermediary, public source, referral.
At the point of collectionSo alongside the form and not afterwards.	Timing	One month at the latestEarlier where there is communication or disclosure.
Obligation to provideWhether the item is required and what follows from withholding it.	Additional item	Source and categoriesWhere the data came from and which categories are processed.
Prior knowledge onlyParagraph 4, in so far as the person already has the information.	Exemption	Also disproportionate effortParagraph 5, alongside impossibility and statutory exemptions.

An organisation maintaining a single text maintains the catalogue of Art. 13 GDPR and omits the item on the source where data is bought in or passed on. That is the gap which surfaces first in an access request.

Being understandable is not a matter of taste but the wording

How long a notice may run is not decided by the caution of whoever drafts it. Art. 12(1) GDPR requires a concise, transparent, intelligible and easily accessible form, in clear and plain language. A text that names everything and reaches nobody satisfies the provision no better than one that is too short.

Three layers instead of one block

At the point of collection
Two or three sentences right at the form or in the conversation: who processes, for what, for how long, and where to find more.
The full text per context
A separate notice for employees, one for applicants, one for customers, one for camera surveillance. Not one document for all of them.
Detail on request
Lists of recipients, third-country entries and retention periods behind a disclosure element. Art. 12(7) GDPR expressly allows icons for this.

3 von 3

The layered structure is not a relaxation of the duty but its performance. The text stays complete on the second layer, and the first is what makes it easily accessible.

A notice goes stale with the next system

What makes a notice lose its currency is the same event that ages a record of processing. The purposes under Art. 13(1)(c) GDPR and the recipients under point (e) are the same items that appear in the record under Art. 30(1) GDPR.

Six recurring findings

Recipients are missing since a provider was added

The most common finding. A new recruitment system, a new payroll provider, a new ticketing tool, and the notice still lists the recipients of two years ago. It usually surfaces only through an access request under Art. 15 GDPR.

The legal basis stated does not match the practice

The text says consent while the processing actually rests on Art. 6(1)(b) or (f) GDPR. The error costs twice, because it announces a right of withdrawal that does not exist and because the balancing exercise is documented nowhere.

Retention periods appear in the text but in no system

A stated period that no system carries out is a wrong entry, not an incomplete one. Where the period is not yet settled, the criteria that determine it belong there.

The text names processing that does not exist

The consequence of an adopted template. It looks complete, describes newsletters and prize draws that nobody runs, and omits time recording.

The source is missing although data is bought in

Art. 14(2)(f) GDPR requires the item stating the source of the data. An organisation buying in addresses or processing referrals owes it and almost never supplies it.

The notice is not where the data arises

A text in the website footer says nothing about the phone conversation, the application portal or the camera at the entrance. Easily accessible means reachable at the point where the data arises.

Were the notices derived from the same list of processing activities, they would change with it. Kept apart, they drift, and the gap only shows up in an access request.

How we support you with the information obligations

What a revision delivers

A survey of the points in the organisation where data arises, and from whom
One text per context, derived from the record rather than from a template
The split between Art. 13 and Art. 14 GDPR, so the item on the source is not omitted
A short notice at every collection point, linking to the full text
Upkeep tied to the same occasions as the record of processing

Frequently asked questions

Do employees need their own notice?

Yes. Art. 13 GDPR attaches to the collection of data and not to the existence of a contract. Section 26(8) BDSG expressly counts applicants and former employees among employees, so the group is larger than the current payroll.

When does the information have to be given?

Where data is collected from the data subject, at the time of collection, Art. 13(1) GDPR. Where it comes from elsewhere, within a reasonable period and at the latest within one month, but no later than the first communication or disclosure, Art. 14(3) GDPR.

Can the notice be dropped if it takes too much effort?

Only in the case of Art. 14 GDPR. Paragraph 5 lifts the duty in so far as providing the information proves impossible or would involve a disproportionate effort. Art. 13 GDPR has no such exemption. There the duty falls away only in so far as the person already has the information.

Is a link to the website privacy notice enough?

Only where it actually describes the operation. A link to a text about cookies and contact forms says nothing about payroll. Easily accessible within the meaning of Art. 12(1) GDPR means reachable at the point where the data arises.

Get in touch!

Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!

Alternatively you can request a call back.