# GDPR Article 12 — Transparent information, communication and modalities for the exercise of the rights of the data subject - Source: https://support.icompaas.com/compliance/gdpr/article-12-transparent-information-communication-and-modalities-for-the-exercise-of-the - Section: [Compliance](https://support.icompaas.com/compliance) › [GDPR (Regulation (EU) 2016/679)](https://support.icompaas.com/compliance/gdpr) › Articles 11–20 - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **GDPR**·Article `Article 12`·high·Component: **Chapter III: Rights of the Data Subject** ## What this control requires > The controller must provide clear, concise, and accessible information per Articles 13-14, and facilitate data subject rights under Articles 15-22, 34. Information must be free, timely (within one month), and in plain language, with extensions justified. Non-action requires reasoning and complaint options. Excessive requests may incur fees or refusal. This control addresses Data Subject Rights. > > — GDPR, Article Article 12 ### In plain English The controller must provide clear, concise, and accessible information per Articles 13-14, and facilitate data subject rights under Articles 15-22, 34. In practice, this means you can prove you transparent controller-level controls on a defined cadence. ## Why it matters GDPR administrative fines reach the greater of €20 million or 4% of global annual turnover. The European Data Protection Board (EDPB) coordinates supervisory-authority enforcement across the EU/EEA, and DPAs publish enforcement decisions citing specific Articles. This control is rated **high**. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation. ## What an auditor looks for A DPA or privacy auditor expects: a Records of Processing Activities (RoPA) entry, a documented lawful basis, evidence the Article's data-subject right is operationalised end-to-end, a named DPO contact (where required), and Article 30 records that match what the front-end actually does. Within **Chapter III: Rights of the Data Subject**, the assessor will trace your implementation back to the catalogue reference (Article Article 12) and look for objective evidence on the latest two assessment cycles. ## How to implement 1. Write a short policy stating intent, scope and named owner. 2. Encode it as a platform guardrail — SCP, Azure Policy initiative, Organisation Policy, or repository policy. 3. Wire a monitoring signal that catches drift (CSPM rule, SIEM rule, scheduled query, Workspace alert) and ticket it. 4. Review on a documented cadence and capture the review in the risk register or compliance tracker. ### Operational checklist - **Transparent.** Document the trigger, the owner and the cadence. - **Information.** Document the trigger, the owner and the cadence. - **Data.** Document the trigger, the owner and the cadence. - **Communication.** Document the trigger, the owner and the cadence. - **Exercise.** Document the trigger, the owner and the cadence. - **Scope:** controller, rights, information. ## Evidence to collect - **Identity Scan.** IAM / IdP exports — Entra ID, Okta, IAM Identity Center, Workspace directory — showing accounts, roles, MFA state and last sign-in. Identity analytics (Okta, SailPoint, Access Analyzer) demonstrates least-privilege. Focus: Transparent information, communication and modalities for the exercise of the rights of the data subject. ## How it maps to other frameworks Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit. - [**ISO/IEC 27001:2022 A.5.18** — Access rights](https://support.icompaas.com/compliance/iso-27001-2022/a-5-18-access-rights) - [**SOC 2 (2017 TSC) CC1.5** — Accountability for Internal Control Responsibilities](https://support.icompaas.com/compliance/soc-2-trust-services-criteria/cc1-5-accountability-for-internal-control-responsibilities) - [**NIST SP 800-171 Rev. 3 3.13.4** — Information in Shared System Resources](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-4-information-in-shared-system-resources) - [**ISO/IEC 27701:2025 A.3.9** — Access rights](https://support.icompaas.com/compliance/iso-27701-2025/a-3-9-access-rights) - [**CIS Controls v8 9.2** — Use DNS Filtering Services](https://support.icompaas.com/compliance/cis-controls-v8/9-2-use-dns-filtering-services) ## Related controls in GDPR - [**Article Article 13** — Information to be provided where personal data are collected from the data subject](https://support.icompaas.com/compliance/gdpr/article-13-information-to-be-provided-where-personal-data-are-collected-from-the-data) - [**Article Article 26** — Joint controllers](https://support.icompaas.com/compliance/gdpr/article-26-joint-controllers) - [**Article Article 45** — Transfers on the basis of an adequacy decision](https://support.icompaas.com/compliance/gdpr/article-45-transfers-on-the-basis-of-an-adequacy-decision) - [**Article Article 59** — Activity reports](https://support.icompaas.com/compliance/gdpr/article-59-activity-reports) - [**Article Article 92** — Exercise of the delegation](https://support.icompaas.com/compliance/gdpr/article-92-exercise-of-the-delegation) ## References - [European Union — GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - Catalogue identifier: `Article Article 12` Topics: identity accessidentity managementaccess reviewprivileged access ## Related compliance guidance - [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): Start with the full GDPR implementation guide — scope, roadmap, evidence and how the assessment runs. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): The security management system most EU procurement teams ask for alongside a DPA; its controls supply much of the Article 32 evidence. - [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If engineering or support teams sit in India, the same data flows are also subject to India’s Digital Personal Data Protection Act.