1.

Where the data have not been obtained from the data subject, the controller shall at the time of undertaking the recording of personal data or, if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed, provide the data subject with at least the following information, except where he or she already has it: the identity of the controller; the purposes of the processing operation; the categories of data concerned; the recipients or categories of recipients; the existence of the right of access to, and the right to rectify, the data concerning him or her; any further information such as: the legal basis of the processing operation for which the data are intended, the time-limits for storing the data, the right to have recourse at any time to the European Data Protection Supervisor, the origin of the data, except where the controller cannot disclose this information for reasons of professional secrecy, insofar as such further information is necessary, having regard to the specific circumstances in which the data are processed, to guarantee fair processing in respect of the data subject.

← art_12__para · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-27 · Text as adopted (Official Journal); later amendments are not incorporated in this text.