Article 13 requires that the privacy notice should include the following information:

1. the identity and the contact details of the controller
2. the contact details of the data protection officer
3. the purposes and legal basis for the processing
4. where the processing is based on legitimate interests, details of what these are
5. the recipients or categories of recipients of the personal data
6. details of any transfer to a third country and details of the safeguards and the means by which to obtain a copy of them or where they have been made available
7. the retention periods or the criteria used to determine that period
8. details on rights of access to and rectification/deletion of personal data. Rights to object to processing and the right to data portability
9. if processing is based on consent, the right to withdraw consent
10. the right to lodge a complaint with the supervisory authority
11. details on whether the data subject is obliged to provide the personal data and the consequences of failure to provide it
12. details of any automated decision making, including details of the logic used and potential consequences for the individual