What does GDPR Article 12 require?

Articles 15 to 22 create the rights. Article 12 decides whether you have actually delivered them. It is the procedural spine of the whole rights chapter, and it is where most enforcement about "we did respond" ends up.

Article 12(1): the standard for how information reads

The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14, and any communication under Articles 15 to 22 and 34, relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child.

Four adjectives and a language standard, and they are legal requirements rather than style advice. A privacy notice that is complete but unreadable does not satisfy Article 12(1).

The delivery rules follow. Information shall be provided in writing, or by other means, including where appropriate by electronic means. Where the data subject requests it, the information may be provided orally, provided the identity of the data subject is proven by other means.

Article 12(2): the duty to facilitate

The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. That is an active obligation, not a passive one. It sits behind supervisory authority findings about hard-to-find request forms and processes designed to discourage.

The second sentence deals with identification. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request unless it demonstrates that it is not in a position to identify the data subject. The burden of that demonstration is on the controller.

Article 12(3): one month, plus two, with a notice condition

The controller shall provide information on action taken on a request under Articles 15 to 22 without undue delay and in any event within one month of receipt of the request.

That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The condition is the same shape as the one in US state law: the controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.

So the extension is claimed, not assumed. Running past one month without having sent that notice is a missed deadline rather than an extension.

Article 12(3) closes with a channel rule. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested.

Article 12(4): refusals have a required content

If the controller does not take action on the request, it shall inform the data subject without delay and at the latest within one month of receipt of the reasons for not taking action, and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Three elements, all mandatory: the reasons, the supervisory authority complaint route, and the judicial remedy. A polite decline that omits the last two is incomplete on the face of the Regulation.

Article 12(5): free by default

Information under Articles 13 and 14, and any communication and actions under Articles 15 to 22 and 34, shall be provided free of charge.

Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs, or refuse to act. And then the sentence that decides most disputes: the controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Articles 12(6) to (8): identity, icons and delegated acts

Article 12(6) allows a controller with reasonable doubts about the identity of the person making an Articles 15 to 21 request to request additional information necessary to confirm identity, without prejudice to Article 11. That is a request for more information, not a ground to refuse.

Article 12(7) permits the Articles 13 and 14 information to be given in combination with standardised icons to provide a meaningful overview of intended processing, and requires machine-readability where they are presented electronically. Article 12(8) empowers the Commission to adopt delegated acts under Article 92 determining the information presented by the icons and the procedures for providing them.

Why Article 12 is worth reading on its own

Teams tend to read Article 15 for access, Article 17 for erasure, and stop. The deadline, the extension condition, the fee rules, the refusal content and the readability standard all live in Article 12 and apply across every one of those rights at once. Getting Article 12 right fixes the same defect in all of them.