Article 13

5. In Article 13, paragraph 4 is replaced by the following: 4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’

5. In Article 13, paragraph 4 is replaced by the following: 4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’

5. In Article 13, paragraph 4 is replaced by the following: 4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’

5. In Article 13, paragraph 4 is replaced by the following: 4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’

4. Paragraphs 1, 2 and 3 shall not apply where: (a) the data subject already has the information; or (b) the following conditions are met: (i) the personal data have been collected by a micro, small, and medium-sized enterprise or an organisation employing fewer than 250 employees; (ii) the personal data are necessary under point (b) of paragraph 1 of Article 6 in the context of a clear and circumscribed relationship between the data subjectssubject and a controller exercisingwhich anthe activitydata thatsubject fully comprehends and which is not data-intensive; (iii) the controller is not required to appoint a data protection officer pursuant to Article 37(1); (iv) the personal data are not special categories of personal data pursuant to Article 9 or personal data relating to criminal convictions and offences pursuant to Article 10; (v) there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unlessand the information remains available to the data subject; (vi) the controller transmitsdoes not transmit the data to other recipientscontrollers, or categories of recipients, transferstransfer the data to a third country,; (vii) carriesthe controller does not carry out automated decision-making, including profiling, referred to in Article 22(1),; orand (viii) the processing is not likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35. In those cases, the controller may alternatively provide information solely through the icons referred to in Article 12 paragraph 7, as long as the complete information remains easily and readily available to the data subject.

4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.Paragraphs 1, 2 and 3 shall apply only where and insofar as the controller can demonstrate that the data subject already has the information referred to in points (a) and (c) of paragraph 1 and, where the processing is based on point (f) of Article 6(1), the information referred to in point (d) of paragraph 1, in a concise, transparent, intelligible and easily accessible form. This exemption shall apply only where the personal data are collected in the context of a direct, ongoing and clearly circumscribed relationship between the data subject and the controller, for purposes that are strictly connected to and reasonably expected in that relationship, and where the processing is not likely to result in a high risk to the rights and freedoms of data subjects, nor involve complex processing operations, systematic monitoring, profiling, the processing of large amounts of personal data, special categories of personal data, or personal data relating to criminal convictions and offences. The controller shall make the information referred to in paragraphs 1, 2 and 3 available to the data subject in an easily accessible and durable form at the time of collection and shall document the assessment under this paragraph. The first, second and third subparagraphs shall not apply where the controller intends to process the data collected from the data subject for other purposes, transmits the data to other recipients or categories of recipients, transfers the data to a third country or to an international organisation, combines the data with personal data obtained from other sources, processes the data for direct marketing purposes, carries out automated decision-making, including profiling, referred to in Article 22(1), or where the processing requires a data protection impact assessment under Article 35 or is otherwise likely to result in a high risk to the rights and freedoms of data subjects.

4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.

4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, or where the provision of such information proves impossible or would involve a disproportionate effort, taking into account the nature, scope, context and purposes of the processing, the size and resources of the controller, and the risk to the rights and freedoms of natural persons, unless the controller transmits the data to other recipients or categories of recipients for purposes other than those directly related to the clear and circumscribed relationship with the data subject, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35. In such cases, the controller shall take appropriate measures to protect the rights and freedoms and legitimate interests of the data subject, including, where appropriate, making the information publicly available in an easily accessible form.

Justification

Information obligations are essential for transparency, but they should remain proportionate and workable in low-risk situations. The Commission proposal rightly introduces an exemption for clear and circumscribed relationships where the controller does not carry out data-intensive activities. However, the exemption should also cover situations where individual information proves impossible or would involve a disproportionate effort, provided that appropriate safeguards are maintained. In addition, the mere transmission of data to recipients should not automatically exclude the exemption where such transmission is directly related to the existing relationship with the data subject, for example in the context of associations, non-profit organisations, craft businesses or small enterprises. This amendment preserves transparency while reducing unnecessary administrative burdens.

4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’Paragraphs 1, 2 and 3 shall not apply only where the controller can demonstrate that the data subject already has the respective information in his or her possession. At the time the data are collected, the controller shall make the information referred to in paragraphs 1, 2 and 3 permanently available to the data subject in an easily accessible form.’

4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and therethe arecontroller reasonableis groundsable to assumedemonstrate that the data subject already has the information referred to in points (a), (c) and (cd) of paragraph 1,. unlessWhere the controller transmitsintends to carry out processing for which the information referred to in points (e) and (f) of paragraph 1 is required, such as transmitting the data to other recipients or categories of recipients, transferstransfering the data to a third country, carriescarrying out automated decision-making, including profiling, referred to in Article 22(1), or where the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35, the controller shall provide that information to the data subject. This exemption shall not apply where processing concerns data relating to health, data inferred from medicine- or pharmacy-related interactions, profiling, direct marketing or disclosure to another recipient.

4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has, or the data controller has taken reasonable steps available to it, taking into account relevant technical and organisational means to provide the data subject with the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipientsdata processors or categories of recipientscontrollers, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.

4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.

4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information or where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensivea high risk to the data subject and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.

4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information or where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’

4a. In Article 13, the following paragraph is inserted:

Justification

Extends the derogation from the information obligation to circumscribed relationships in which the controller’s activity is not data-intensive: associations, sport clubs, micro, small and medium-sized enterprises where processing is confined to the management of membership, communication with members, the organisation of activities or the performance of a contract. The derogation is expressly excluded where the controller engages in data brokerage, which is by nature data-intensive.

5a. In Article 13, paragraph 1, the following points are added:

Justification

RISK-BASED APPROACH #8: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.

6. In Article 13, paragraph 5 is added: 5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available.’

6. In Article 13, paragraph 5 is added: 5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available.’

6. In Article 13, paragraph 5 is added: 5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available.’

6. In Article 13, paragraph 5 is added: 5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available.’

6. In Article 13, paragraph 5 is added: 5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available.’

5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available.’

5. When the further processing takes place for scientific research purposes, provided it is not used for commercial product development, advertising, marketing, profiling or the training of data processing models for commercial deployment, and where the controller does not possess or cannot reasonably obtain the contact details of the data subject without disproportionate effort, and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall document the reliance of this exception, make such documentation available to the supervisory authority upon request, and take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including makingannoucing the information publiclypublicy availableor informing the data subject without undue delay as soon as the conditions of this paragraph have ceased to exist.

5. When the processing takes place for scientific research purposes, including scientific research in the public interest aiming to further a commercial interest, and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort, including cases where the change of purpose could not have been anticipated at the time of collection, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available. This scenario shall apply equally to the obligations under Article 14(5)(b).

5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available. This paragraph is without prejudice to the conditions and safeguards applicable to the processing of personal data in AI regulatory sandboxes and in testing in real world conditions under Articles 59, 60 and 61 of Regulation (EU) 2024/1689, which continue to apply.

Justification

The exemption from the information obligations for scientific research purposes must not operate to the detriment of the safeguards applicable to the processing of personal data in the context of AI development. This amendment specifies that paragraph 5 is without prejudice to the conditions and safeguards laid down in Articles 59, 60 and 61 of Regulation (EU) 2024/1689 governing AI regulatory sandboxes and testing in real world conditions — in particular the requirements relating to isolated processing environments, monitoring and response mechanisms, deletion of data, and informed consent — which continue to apply. This ensures the coherence of the Union acquis and prevents the research exemption from being used to circumvent the risk-control obligations of the Artificial Intelligence Act.

5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort, including cases where the change of purpose could not have been anticipated at the time of collection, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available.

5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort, taking into account the relevant technical and organisational circumstances, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available.

6a. In Article 13, paragraph 4a is added:

Justification

Article 13 information obligations are essential for transparency, but they can create disproportionate administrative burdens for small non-profit organisations where the processing relationship is clear, direct and limited to internal administrative purposes. Associations, foundations and other non-profit organisations should therefore be allowed to fulfil transparency obligations through publicly accessible information where processing is limited to members, volunteers, donors or beneficiaries, does not involve systematic monitoring, is not likely to result in a high risk and is not used for commercial third-party sharing. This targeted clarification supports civic engagement and volunteer work while preserving the substance of the right to information.

6a. In Article 13, paragraph 4a is added: