UK GDPRUK · retained 2016/679
Digiphile
Regulation (EU) 2016/679 as retained in UK law (UK GDPR) – Article 12 – Transparent information, communication and modalities for the exercise of the rights of the data subject

Articles

Article 12Transparent information, communication and modalities for the exercise of the rights of the data subject

1. The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication [F1made under or by virtue of Articles 15 to 22D] and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.
2. The controller shall facilitate the exercise of data subject rights [F2arising under or by virtue of Articles 15 to 22D]. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising [F3those rights], unless the controller demonstrates that it is not in a position to identify the data subject.
3. The controller shall provide information on action taken on a request [F4made under or by virtue of Articles 15 to 22D] to the data subject without undue delay and in any event [F5before the end of the applicable time period (see Article 12A)]. F6... Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
4. If the controller does not take action on the request of the data subject, the controller shall inform the data subject [F7without undue delay, and in any event before the end of the applicable time period (see Article 12A),] of the reasons for not taking action and on the possibility of [F8making a complaint to the controller under section 164A of the 2018 Act, making a complaint to the [F9Commission] under section 165 of that Act] and seeking a judicial remedy.
5. [F10Subject to Article 15(3),] information provided under Articles 13 and 14 and any communication and any actions taken [F11under or by virtue of Articles 15 to 22D] and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:
  • (a)
    charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or
  • (b)
    refuse to act on the request.

The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

6. Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request [F12made under or by virtue of Articles 15 to 22D], the controller may [F13—
  • (a)
    ] request the provision of additional information necessary to confirm the identity of the data subject [F14, and
  • (b)
    delay dealing with the request until the identity is confirmed.]
6A. [F15 The [F16Commission] may publish (and amend or withdraw)—
  • (a)
    standardised icons for use in combination with information provided to data subjects under Articles 13 and 14;
  • (b)
    a notice stating that other persons may publish (and amend or withdraw) such icons, provided that the icons satisfy requirements specified in the notice as to the information to be presented by the icons and the procedures for providing the icons.
6B. The [F16Commission] must not publish icons or a notice under paragraph 6A unless satisfied (as appropriate) that the icons give a meaningful overview of the intended processing in an easily visible, intelligible and clearly legible manner or that the notice will result in icons that do so.]
7. [F17If standardised icons are published as described in paragraph 6A (and not withdrawn), the information] to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with [F18the icons]. Where the icons are presented electronically they shall be machine-readable.
8. F19 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Amended text

This Article is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations and footnotes

Textual Amendments

  1. F1 Words in Art. 12(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 2(2); S.I. 2026/82, reg. 2(z8) (with reg. 5)
  2. F2 Words in Art. 12(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 2(3)(a); S.I. 2026/82, reg. 2(z8) (with reg. 5)
  3. F3 Words in Art. 12(2) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 2(3)(b); S.I. 2026/82, reg. 2(z8) (with reg. 5)
  4. F4 Words in Art. 12(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 2(4); S.I. 2026/82, reg. 2(z8) (with reg. 5)
  5. F5 Words in Art. 12(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 76(2)(a)(i), 142(1); S.I. 2026/82, reg. 2(h) (with reg. 4)
  6. F6 Words in Art. 12(3) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 76(2)(a)(ii), 142(1); S.I. 2026/82, reg. 2(h) (with reg. 4)
  7. F7 Words in Art. 12(4) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 76(2)(b), 142(1); S.I. 2026/82, reg. 2(h) (with reg. 4)
  8. F8 Words in Art. 12(4) substituted (19.6.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 10 para. 2; S.I. 2026/82, reg. 3(b) (with reg. 7)
  9. F9 Word in Art. 12(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(a); S.I. 2026/1015, reg. 2(c)
  10. F10 Words in Art. 12(5) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 5; S.I. 2025/904, reg. 2(y)
  11. F11 Words in Art. 12(5) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 2(5); S.I. 2026/82, reg. 2(z8) (with reg. 5)
  12. F12 Words in Art. 12(6) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 2(6); S.I. 2026/82, reg. 2(z8) (with reg. 5)
  13. F13 Words in Art. 12(6) renumbered as Art. 12(6)(a) (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 76(2)(c)(i), 142(1); S.I. 2026/82, reg. 2(h) (with reg. 4)
  14. F14 Art. 12(6)(b) and word inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 76(2)(c)(ii), 142(1); S.I. 2026/82, reg. 2(h) (with reg. 4)
  15. F15 Art. 12(6A)(6B) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 11(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  16. F16 Word in Art. 12(6A)(6B) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(a); S.I. 2026/1015, reg. 2(c)
  17. F17 Words in Art. 12(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 11(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  18. F18 Words in Art. 12(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 11(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  19. F19 Art. 12(8) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 11(5) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)

Related recitals

Rec. 38Rec. 58Rec. 59Rec. 60Rec. 73

https://uk-gdpr.digiphile.law/article/article-12.html

Text as at 17 September 2026.

This is an unofficial convenience version of the UK GDPR (Regulation (EU) 2016/679 as retained in UK law). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.