Article 13 GDPR: privacy notice missing required items

The rule

That is twelve lettered items, which is the rubric the scan uses. Paragraph 4 removes the duty “where and insofar as the data subject already has the information”, so a notice does not have to repeat what a person was already told.

Article 14 is the companion for data “not obtained from the data subject”. It repeats most of the list, adds the categories of data and the source, and sets a deadline of at most one month. The UK article, UK-07, reads the UK text of both.

Penalties sit in the upper tier. Article 83(5)(b) covers “the data subjects’ rights pursuant to Articles 12 to 22”, with a ceiling of EUR 20 million or 4% of worldwide annual turnover, whichever is higher. The ceiling comes from Article 83(5)(b); the content list itself sits in Article 13.

What PeekWell checks and how

EU-08 asks one question: does the privacy notice the site links to say what Article 13 lists? The scan answers it from the text of the notice, not from what the company does.

The scan finds the privacy notice linked from the public pages it visited and fetches it. A language model reads the text and maps it to the twelve-item rubric. For each item it records present, partial or missing, with the sentence it relied on. Code then scores the coverage. Three items carry the most weight because they are the ones regulators tend to look at first: the right to complain to a regulator, the legal basis for each purpose, and the transfer mechanism.

The decision is made by code from that evidence. The model reads and quotes, and a partial mark always shows the sentence behind it. Severity starts at medium, because the rubric needs judgment about wording, and the report treats the finding as corroboration. The three first-filter items weigh most in the coverage score.

The scan has limits, and the report says so. It reads the notice as written. It cannot see what data your systems actually collect, who really receives it or how long it is kept, so it cannot say whether a notice is accurate. Those mismatches belong to other checks, such as EU-05 and EU-04. It does not read your contracts, and a notice that sits behind a sign-in or in a separate app is outside what it sees. A Passed means the expected items were found on the pages scanned. It does not say the notice is complete in law.

Why it matters for a company

Authorities have treated a thin notice as a problem on its own, and also as a first thing they check when a complaint arrives. The WhatsApp decision is the clearest example: the information on legal basis, recipients, transfers and retention was examined item by item, and the fines were split across Articles 5(1)(a), 12, 13 and 14.

Smaller companies appear in the record too. The Garante inspected Confalonieri’s website and recorded a privacy notice that cited rules no longer in force, and a cookie policy that cited repealed provisions and did not identify the recipients. It ordered the cookie banner reconfigured and the privacy notice supplemented with the cookie processing, and issued a warning, with no fine. In Romania, the ANSPDCP warned a company that did not show who operated its site and ordered the policy completed with the Article 13(1)(a) information. In the Romanian decision the policy was ordered completed; in the Italian one the notice was ordered supplemented for cookies.

A missing item is easy to see from outside, since the notice is public. In both smaller-company decisions the notice finding came together with a cookie finding, which is why EU-08 is often read alongside EU-01.

Smaller companies and larger companies

The duty has no size threshold. Article 13 applies to a sole trader with a contact form in the same way as to a listed group. What differs is how the gaps arise.

In a small company the notice is usually a template or a generator’s output, pasted in once and never revisited. It names no recipients because nobody listed them, it cites a law that has since changed, or it says nothing about retention. The Garante’s record of a privacy notice citing rules no longer in force, and of a cookie policy that cited repealed provisions and did not identify recipients, fits this pattern.

In a larger company the notice is long and has many authors. Legal writes the purposes, marketing adds a tracker, and a vendor change alters the recipients without anyone updating the text. The risk is vagueness: every legal basis listed, “may” in every sentence, the same rights described in three places. The WhatsApp decision criticised exactly this, including information on the right to withdraw consent set out in slightly different words in three areas of the Privacy Policy, and retention information scattered across sections and documents.

How to fix it

1. Write down what you actually do with personal data. List each purpose, such as orders, newsletters, analytics and support, the data used for each, who receives it and where it goes. A notice can only be as accurate as this list.
2. Match the notice to the twelve items. Open Article 13 and tick each item against your text, from controller contact details through to automated decisions.
3. Tie each legal basis to a purpose. A table with purpose, basis and retention in each row is easier to read and to check than a paragraph that names every basis.
4. Replace vague wording. Swap “may use your data to improve our services” for what you do. Replace “as long as necessary” with a period or the rule you use to set it.
5. Name recipients and transfers. Name each processor or group of processors by category at least, and say which countries data goes to and what safeguard covers it.
6. Make it easy to reach. Link the notice at the point where data is collected, such as a form or checkout, and from the footer of every page. Keep it in the language of the site.
7. Keep it current. When you add a vendor or a purpose, update the notice the same week.
8. Re-scan. Run a scan again and check the item list. Each missing or partial item shows the sentence behind it, so you can see what changed.

Whether a notice satisfies a given authority is a question for your legal adviser, and Peeky reports only what it reads.