What is the right to be informed in GDPR?

The right to be informed requires the data controller to explain clearly how it collects and uses personal data, without waiting for individuals to ask.

Information must cover relevant details such as the controller’s identity, processing purposes, lawful basis, recipients, retention periods, individuals’ rights and complaint options. Additional disclosures apply where relevant, including international transfers and certain automated decisions.

Under the GDPR’s transparency and information requirements:

• Data collected directly: provide the information when collecting it.

• Data obtained elsewhere: provide it within a reasonable period, no later than one month. If earlier, provide it at the first communication with the person or first disclosure to another recipient.

For indirectly collected data, the notice must also identify the data categories and source. Exceptions exist, including where the person already has the required information. Information must be concise, accessible and easy to understand.