3. The duty to provide information
To aid fairness and transparency in the processing of personal data so that the individual’s rights are protected, the GDPR requires data controllers to provide specific information to individuals when asking for their personal information, or when acquiring their personal information for processing. It also specifies what information must be given, and how and when. In addition, there are general rules that apply to the provision of all such information (see box).
General rules for the provision of information
It is the data controller’s duty to provide the information, and also to facilitate the exercise of the data subject’s rights.
The data controller cannot refuse to provide any of the information unless it is unable to identify the data subject.
The information must be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
It can be provided in writing or by other means, and can be sent electronically.