The rule.
“at the time when personal data are obtained, provide the data subject with all of the following information”
Verbatim extract, read on 4 November 2026 from the source below. Everything else on this page is NorthPoint’s plain-English reading.
What it requires.
- At the time of collection: the controller's identity and contact details, the DPO's contact details where applicable, the purposes and legal basis, the legitimate interests where 6(1)(f) is used, recipients, and any transfer outside the EU (13(1)).
- Also: retention period, the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent, the right to complain, whether providing the data is required, and any automated decision-making (13(2)).
Who it applies to.
Controllers collecting personal data directly from the person — sign-up forms, lead magnets, event registration, chat widgets.
Common violations in marketing copy.
Email field + 'Get early access' button, nothing else
No information at the point of collection, and no link to it.
Privacy policy that omits a new ad-audience upload
Recipients and purposes have changed; the notice has not.
Non-compliant vs compliant.
“Enter your email to join the waitlist.”
“Enter your email to join the waitlist. [Company] uses it to send launch news (consent). Unsubscribe any time. Full notice: [privacy link].”
Related rules.
-
GDPR Article 21(4) · European Union
-
GDPR Article 6(1)(a) · European Union
-
GDPR Article 7(3) · European Union
-
GDPR (Regulation (EU) 2016/679) and the ePrivacy Directive 2002/58/EC.
Source.
| Instrument | Regulation (EU) 2016/679 (General Data Protection Regulation) |
|---|---|
| Provision | GDPR Article 13(1)–(2) |
| Primary source | https://www.legislation.gov.uk/eur/2016/679/article/13/adopted |
| Official text | https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng |
| Read from | legislation.gov.uk's as-adopted copy of the Official Journal text (/eur/2016/679/article/N/adopted) |
| Checked |
This page is general, sourced information for marketing teams, not legal advice. The examples are written by NorthPoint to illustrate the rule; for a binding view on your own promotion, retain qualified counsel in the jurisdiction concerned.