Skip to main content
Privacy Track
Category: Data Subject Rights

Concise, Transparent, Intelligible Form

Also known as: Concise, transparent, intelligible and easily accessible form, Transparency modalities
Simply put

This is a standard for how organisations must present privacy information and communications to individuals. It generally requires that the information be short and to the point, open and honest, easy to understand, and simple to find, using clear and plain language. The goal is to make sure people can actually understand what happens to their personal data rather than being confronted with dense or overly legalistic text.

Formal definition

A qualitative transparency standard associated with Article 12 GDPR (and the corresponding UK GDPR provision) governing how controllers must communicate information under the transparency and information provisions and when responding to data subject rights requests. The information must be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, with a particular emphasis on clarity where information is addressed specifically to a child. This is a modality-of-delivery obligation rather than a standalone legal basis; it shapes how notices and communications are formatted and does not itself expand or limit the substantive content that must be disclosed. Application is context-dependent and subject to assessment, and practitioners should verify the precise wording and article references against the current official GDPR and UK GDPR texts, as well as applicable regulatory guidance.

Why it matters

Transparency is a foundational principle of the GDPR, but disclosure alone is not enough; the information must actually reach and be understood by the individuals it concerns. The 'concise, transparent, intelligible and easily accessible form' standard under Article 12 addresses a common failure mode where organisations publish exhaustive but impenetrable privacy notices that satisfy the letter of disclosure while defeating its purpose. Where communications are dense, buried, or written in legalistic language, individuals cannot meaningfully exercise their rights or make informed choices, and a controller may face criticism from supervisory authorities even if the underlying substance of the notice is complete.

This standard matters because it operates as a modality obligation that sits alongside, rather than replaces, the substantive content requirements found elsewhere in the transparency provisions. A notice can contain every required data point and still fall short if it is not accessible or intelligible to its intended audience. The obligation carries particular weight where information is addressed to children, for whom a higher degree of clarity is generally expected. Because assessment of what is 'concise' or 'intelligible' is context-dependent, controllers should treat readability and accessibility as ongoing design considerations rather than a one-time compliance box.

Practitioners should note that the precise application of this standard continues to be shaped by regulatory guidance, and the boundary between an acceptable and a deficient notice is a matter of judgement rather than a fixed threshold. The reader should verify the current wording and article references against the official GDPR and UK GDPR texts and consult applicable supervisory authority guidance, as interpretations and expectations can evolve.

Who it's relevant to

Data Protection Officers and privacy leads
DPOs and privacy teams are typically responsible for ensuring that privacy notices and rights-request responses meet this modality standard. They should review the format, language, and accessibility of communications, not just their substantive completeness, and reassess as guidance and audiences change.
Legal and compliance functions
Lawyers advising on transparency obligations should distinguish this delivery standard from the substantive content requirements and from legal bases. It shapes how information is communicated but does not expand or limit what must be disclosed. Precise article references should be confirmed against the current official GDPR and UK GDPR texts.
UX writers, designers, and product teams
Because the standard turns largely on clarity, conciseness, and accessibility, those who draft and present notices in interfaces play a central role. Techniques such as layered notices and plain-language drafting are generally relevant, with particular care where content is directed at children.
Organisations processing children's data
Controllers whose services or communications are addressed specifically to children face a heightened expectation of clarity. This audience typically warrants simpler language and presentation, subject to assessment and any applicable member state provisions and regulatory guidance.

Inside Concise, Transparent, Intelligible Form

Concise Form
Information provided to data subjects should be presented in a compact, focused manner that avoids unnecessary length or repetition. This generally supports the transparency obligations that inform the exercise of data subject rights, though the appropriate level of brevity must be balanced against completeness of required information.
Transparent Form
The processing and the associated information should be presented openly and honestly, without concealment or misleading framing, so that data subjects can understand how their personal data is handled. Transparency is generally treated as a component of the fairness and transparency principle.
Intelligible Form
Information should be capable of being understood by an average member of the intended audience. Where processing concerns particular groups, intelligibility is typically assessed by reference to that group's likely level of understanding.
Easily Accessible Form
The information should be readily locatable and reachable by the data subject, so that they do not have to search extensively to find it. Accessibility is generally considered alongside conciseness and intelligibility as part of how transparency information is delivered.
Clear and Plain Language
Communications should avoid overly technical, legalistic, or ambiguous wording. This requirement is generally regarded as reinforced where information is addressed to children or other vulnerable audiences, subject to assessment of the specific context.

Common questions

Answers to the questions practitioners most commonly ask about Concise, Transparent, Intelligible Form.

Does providing a legally accurate but dense privacy notice satisfy the requirement to use a concise, transparent, intelligible form?
Not necessarily. Legal accuracy and intelligibility are distinct requirements. A notice can be technically correct yet fail the transparency principle if it is dense, jargon-heavy, or difficult for the intended audience to understand. The concise, transparent, intelligible standard, which derives from the transparency obligations in the GDPR, generally requires that information be genuinely accessible to the data subject, not merely complete. Regulators and guidance have emphasised that the form of communication matters, so satisfying this element typically involves clear structure and plain language in addition to accuracy.
Does the requirement to be concise mean an organisation can shorten a notice by leaving out required information?
No. Conciseness does not override the substantive information obligations. The standard asks that information be presented in an efficient, non-overwhelming way, but it does not permit omitting details that must be provided to data subjects. In most cases the tension between brevity and completeness is addressed through techniques such as layering, rather than by dropping required content. Conciseness and completeness are intended to operate together, not as a trade-off where one is sacrificed for the other.
How can an organisation reconcile the need to be concise with the need to disclose all required information?
A commonly used approach is a layered privacy notice, where the most important points are presented up front in a short summary, with fuller detail accessible through further layers such as expandable sections or linked pages. This structure allows the top layer to remain concise and intelligible while the underlying layers carry the complete information. The appropriate design generally depends on the context, the audience, and the delivery channel, so organisations typically assess which layering method best serves their particular data subjects.
How should an organisation tailor language when its audience includes children or vulnerable individuals?
Where information is addressed to children or other individuals who may need additional support to understand it, the intelligibility expectation is generally assessed by reference to that audience. In practice this typically means using simpler wording, shorter sentences, and clearer explanations appropriate to the likely comprehension of the intended readers. The suitable approach depends on who is actually being addressed, so organisations often consider the specific characteristics of their audience when drafting and testing the material.
What practical steps can help demonstrate that a notice is intelligible rather than just asserting that it is?
Organisations often use methods such as plain-language review, readability assessment, and user testing with representative audiences to check whether the intended readers can actually understand the information. Keeping a record of how the notice was designed and reviewed can also support the broader accountability expectations under the GDPR. The value of any particular method is context dependent, so organisations typically select techniques proportionate to the sensitivity and complexity of the processing being described.
How does the choice of delivery channel affect meeting this standard?
The form in which information is provided should generally suit the medium through which the data subject interacts with the organisation, such as a website, a mobile app, a device interface, or a voice service. What counts as concise and intelligible can differ across these channels, so an approach that works well in one setting may need adaptation for another. In most cases organisations assess each channel separately and consider techniques appropriate to that context, including how layering or summaries can be presented within the constraints of the interface.

Common misconceptions

A concise privacy notice means the controller can omit legally required information to keep it short.
Conciseness concerns the manner of presentation, not a licence to leave out mandated content. The obligation to be concise is generally understood to work alongside, rather than override, the substantive information duties, and controllers typically address this through layered notices rather than omission. Readers should verify the precise information requirements against the current official text.
Meeting the intelligibility standard is judged solely from the controller's own perspective.
Intelligibility is generally assessed by reference to the understanding of the intended audience of data subjects, and a heightened standard is typically expected where information is directed at children. The exact threshold is context dependent and may be informed by regulatory guidance.
Using clear and plain language is a stylistic preference rather than a compliance obligation.
Clear and plain language is generally treated as an element of the transparency requirements rather than an optional matter of style. That said, the specific expectations can vary with the audience and context, and practitioners should assess each case rather than assume a single fixed standard.

Best practices

Use a layered approach to notices, presenting key information concisely up front with easy access to fuller detail, so conciseness and completeness are reconciled rather than traded off.
Assess intelligibility against the actual intended audience, and apply a heightened plain-language standard where information may reach children or other vulnerable groups.
Review wording to remove unnecessary legal and technical jargon, and consider testing draft communications with representative readers to confirm they are understood.
Ensure transparency information is easily locatable, for example through clearly signposted and readily reachable notices at the relevant points of interaction.
Document the reasoning behind format and language choices so the approach can be justified if questioned by a regulator or during an accountability review.
Periodically re-check notices against current regulatory guidance, since expectations on transparency presentation may evolve and can vary between regulators.