Article 12 GDPR
Transparent information and communication and exercise of rights by data subjects

1. The controller shall take appropriate measures to provide the data subject, in a concise, transparent, intelligible, and easily accessible form, using clear and plain language—in particular when the information is addressed to a child—with all the information referred to in Articles 13 and 14, and to communicate with them pursuant to Articles 15–22 and 34 regarding the processing. The information shall be provided in writing or by other means, including, where appropriate, electronically. If the data subject so requests, the information may be provided orally, provided that the identity of the data subject is verified by other means.

2. The controller shall facilitate the exercise by the data subject of the rights granted to him or her under Articles 15–22. In the cases referred to in Article 11(2), the controller shall not refuse to act upon a request from a data subject wishing to exercise their rights under Articles 15–22, unless the controller demonstrates that it is unable to identify the data subject.

3. The controller shall, without undue delay—and in any event within one month of receiving the request—inform the data subject of the actions taken in response to the request pursuant to Articles 15–22. If necessary, this period may be extended by a further two months due to the complexity of the request or the number of requests. Within one month of receiving the request, the controller shall inform the data subject of such an extension, stating the reasons for the delay. If the data subject submitted the request electronically, the information shall also be provided electronically, where possible, unless the data subject requests another form.

4. If the controller fails to act on the data subject's request, the controller shall promptly - no later than one month after receipt of the request - inform the data subject of the reasons for the failure to act and of the possibility of lodging a complaint with the supervisory authority and pursuing legal remedies before a court.

5. Information provided pursuant to Articles 13 and 14, as well as communications and actions taken pursuant to Articles 15–22 and 34, shall be free of charge. If the data subject’s requests are manifestly unfounded or excessive, in particular because of their repetitive nature, the controller may:

(a) charge a reasonable fee, taking into account the administrative costs of providing information, communicating or taking the requested action; or

(b) refuse to act on the request.

6. Without prejudice to Article 11, if the controller has reasonable doubts as to the identity of the natural person making a request referred to in Articles 15–21, it may request additional information necessary to verify the identity of the data subject.

7. The information provided to data subjects pursuant to Articles 13 and 14 may be accompanied by standardised pictograms that clearly, comprehensibly, and legibly convey the nature of the intended processing. If these pictograms are provided electronically, they must be machine-readable.

8. The Commission shall be empowered to adopt delegated acts in accordance with Article 92 to specify the information to be presented using graphic symbols and the procedures for establishing standard graphic symbols.