PolicyPilot — Compliance & policy automation
Sign in Create account

← GDPR · Data subject rights

Art.13 — Information when data is collected from the data subject

high privacy-notice

Requirement

When personal data is collected from the data subject, the controller must at that time provide its identity and contact details, the DPO's contact details, the purposes and lawful basis (including the legitimate interests pursued), recipients, any third-country transfers, the retention period, the data subject's rights including withdrawal of consent and the right to complain to a supervisory authority, and whether providing the data is a statutory or contractual requirement.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of
privacy noticeprivacy policyprivacy statementinformation providedwe informwe tell
Required element 2 — any one of
at the timeat the point of collectionwhen we collectwhen data is collectedat collectionat sign-upbefore collection
Required element 3 — any one of
purposelawful basislegal basisrecipientretention periodrights
Supporting terms — specificity signals
article 13contact detailsdpolegitimate intereststransfercomplainsupervisory authoritywithdraw consentjust in timelayered
Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

no privacy notice

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

FrameworkControlTitleShared topics
CCPA/CPRA 1798.130(a)(5) Privacy policy content and annual update privacy-notice
GLBA Reg P 1016.4-1016.6 Initial and annual privacy notices privacy-notice
NDPA 2023 s.27 Information to be provided to data subjects privacy-notice
CCPA/CPRA 1798.100(a)-(b) Notice at collection privacy-notice
CCPA/CPRA 1798.135 "Do Not Sell or Share" and "Limit the Use" links privacy-notice
SOC 2 CC2.3 External communication privacy-notice
SOC 2 P1.1 Notice and communication of privacy commitments privacy-notice
COPPA 312.4(d) Online notice of children's information practices privacy-notice