Right to Be Informed

A foundational transparency right requiring organizations to clearly inform individuals about how their personal data will be collected, used, and shared, typically through privacy notices and policies. Under GDPR Articles 13 and 14, required information includes: controller identity and contact details, Data Protection Officer contact (if applicable), processing purposes and legal basis, legitimate interests (if applicable), recipients, international transfers, retention periods, data subject rights, right to withdraw consent, right to lodge complaints, automated decision-making details, and data source (if not collected from the individual). Information must be provided at the time of collection or within one month if obtained indirectly. Under CCPA/CPRA, businesses must provide notice at collection describing categories of personal information collected and purposes. This right empowers informed decision-making—individuals can't meaningfully exercise other rights without knowing what data organizations hold and how it's used. Privacy notices should use clear, plain language, layered formats, and be easily accessible.