1The controller shall take appropriate measures to provide any information referred
to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34
relating to processing to the data subject in a concise, transparent, intelligible
and easily accessible form, using clear and plain language, in particular for any
information addressed specifically to a child. 2The information shall be provided
in writing, or by other means, including, where appropriate, by electronic means.
3When requested by the data subject, the information may be provided orally,
provided that the identity of the data subject is proven by other means.
1The controller shall facilitate the exercise of data subject rights under Articles
15 to 22. 2In the cases referred to in Article 11(2), the controller shall not
refuse to act on the request of the data subject for exercising his or her rights
under Articles 15 to 22, unless the controller demonstrates that it is not in a
position to identify the data subject.
1The controller shall provide information on action taken on a request under
Articles 15 to 22 to the data subject without undue delay and in any event within
one month of receipt of the request. 2That period may be extended by two further
months where necessary, taking into account the complexity and number of the
requests. 3The controller shall inform the data subject of any such extension
within one month of receipt of the request, together with the reasons for the
delay. 4Where the data subject makes the request by electronic form means, the
information shall be provided by electronic means where possible, unless otherwise
requested by the data subject.
If the controller does not take action on the request of the data subject, the
controller shall inform the data subject without delay and at the latest within one
month of receipt of the request of the reasons for not taking action and on the
possibility of lodging a complaint with a supervisory authority and seeking a
judicial remedy.
1Information provided under Articles 13 and 14 and any communication and any
actions taken under Articles 15 to 22 and 34 shall be provided free of charge.
2Where requests from a data subject are manifestly unfounded or excessive, in
particular because of their repetitive character, the controller may either
charge a reasonable fee taking into account the administrative costs of providing
the information or communication or taking the action requested; or
refuse to act on the request.
3The controller shall bear the burden of demonstrating the manifestly unfounded or
excessive character of the request.
Without prejudice to Article 11, where the controller has reasonable doubts
concerning the identity of the natural person making the request referred to in
Articles 15 to 21, the controller may request the provision of additional
information necessary to confirm the identity of the data subject.
1The information to be provided to data subjects pursuant to Articles 13 and 14 may
be provided in combination with standardised icons in order to give in an easily
visible, intelligible and clearly legible manner a meaningful overview of the
intended processing. 2Where the icons are presented electronically they shall be
machine-readable.
The Commission shall be empowered to adopt delegated acts in accordance with
Article 92 for the purpose of determining the information to be presented by the
icons and the procedures for providing standardised icons.