Articles 12, 13, and 14 of the GDPR oblige controllers to inform data subjects about the processing of their personal data in a concise, transparent, and intelligible form. This must happen at the time the data is collected or, if the data originates from third parties, within a reasonable period. The core of these obligations are privacy notices, for example, for websites, apps, or vis-à-vis customers.