GDPR Article 13(3): telling people before a new purpose (Regulation (EU) 2016/679, Art 13(3))
A holder with a direct relationship (its customers, its staff) must update its privacy notice and tell people before it uses their data for AI licensing. Reusing first and informing later is not allowed.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.”
Where it was read
Also read from the same source
- GDPR Article 5(1)(b): purpose limitation (Regulation (EU) 2016/679, Art 5(1)(b))
- GDPR Article 6(1)(f): legitimate interests as a lawful basis (Regulation (EU) 2016/679, Art 6(1)(f))
- GDPR Article 6(4): compatibility test for a new purpose (Regulation (EU) 2016/679, Art 6(4))
- GDPR Recital 50: further processing and the legal basis (Regulation (EU) 2016/679, recital 50)
- GDPR Article 9(1): special categories of personal data (Regulation (EU) 2016/679, Art 9(1))
- GDPR Article 14(5)(b): disproportionate effort (Regulation (EU) 2016/679, Art 14(5)(b))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide