Article 12

Information to be supplied where the data have not been obtained from the data subject 1. Where the data have not been obtained from the data subject, the controller shall at the time of undertaking the recording of personal data or, if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed, provide the data subject with at least the following information, except where he or she already has it: the identity of the controller; the purposes of the processing operation; the categories of data concerned; the recipients or categories of recipients; the existence of the right of access to, and the right to rectify, the data concerning him or her; any further information such as: the legal basis of the processing operation for which the data are intended, the time-limits for storing the data, the right to have recourse at any time to the European Data Protection Supervisor, the origin of the data, except where the controller cannot disclose this information for reasons of professional secrecy, insofar as such further information is necessary, having regard to the specific circumstances in which the data are processed, to guarantee fair processing in respect of the data subject. 2. Paragraph 1 shall not apply where, in particular for processing for statistical purposes or for the purposes of historical or scientific research, the provision of such information proves impossible or would involve a disproportionate effort or if recording or disclosure is expressly laid down by Community law. In these cases the Community institution or body shall provide for appropriate safeguards after consulting the European Data Protection Supervisor. SECTION 5 RIGHTS OF THE DATA SUBJECT

← 2. · All articles · art_12__para →

Source: EUR-Lex (Cellar) · retrieved 2026-10-27 · Text as adopted (Official Journal); later amendments are not incorporated in this text.