Recipient (Article 4(9) GDPR)

The concept of the recipient is one of the central foundational terms of the GDPR. It is deliberately broad and covers every body to which personal data are disclosed, including bodies within the same organization. Whether a disclosure is permissible is not determined by the concept of the recipient itself, but by the general requirements for the lawfulness of processing.

1. Overview

Article 4(9) GDPR defines a recipient as any natural or legal person, public authority, agency or another body to which personal data are disclosed, whether that body is a third party or not. The provision contains an exception for certain public authorities in its second sentence.

The concept is tied to the act of disclosure. Disclosure means any communication, transmission, making available or other form of making accessible, as contained in the concept of processing under Article 4(2) GDPR. What is decisive is that another body obtains, or is able to obtain, access to the data.

The broad scope of the term is intentional: the GDPR refers to recipients in numerous places (Article 13(1)(e), Article 14(1)(e), Article 15(1)(c), Article 19, Article 30(1)(d) GDPR) and attaches information, documentation and notification obligations to that concept. These obligations apply regardless of whether the receiving body is, in organizational terms, a third party or belongs to the same organization.

2. Scope of the concept

2.1 Recipient and third party

There is an overlapping relationship between the recipient and the third party: every third party to which data are disclosed is at the same time a recipient. Conversely, not every recipient is a third party. Bodies that receive data but are not regarded as third parties are nevertheless recipients.

The data subject itself is not a recipient. Where the controller provides the data subject with information under Article 15 GDPR, this does not constitute a disclosure to a recipient within the meaning of Article 4(9) GDPR.

2.2 The processor as a recipient

The processor processes personal data on behalf of and on the instructions of the controller. It is not a third party within the meaning of Article 4(10) GDPR, but it is indeed a recipient within the meaning of Article 4(9) GDPR. The same applies to persons who act under the direct authority of the controller or the processor and have access to personal data, such as employees who use certain systems or access data.

2.3 Comparison table

The following overview contrasts the most important constellations:

3. Public authorities acting under a particular inquiry

Article 4(9) second sentence GDPR expressly excludes public authorities from the concept of the recipient where they receive personal data within the framework of a particular inquiry in accordance with Union or Member State law. The transmission of data then does not follow the general disclosure regime, but is subject to the data protection rules applicable to the public authority in question.

Recital 31 GDPR explains the background to this rule: it covers, in particular, tax and customs authorities, financial investigation units and financial market supervisory authorities. Data should be transmitted to such bodies only on a written, reasoned and occasional request; the transmission should not concern entire filing systems or lead to the interconnection of filing systems (Recital 31 GDPR, https://dsgvo-gesetz.de/erwaegungsgruende/nr-31/).

The privileged treatment does not apply to any and every request for data by a public authority, but only to requests within the framework of a specific, statutorily defined inquiry. The exception is not applicable to general supervisory or monitoring activity without a specific inquiry.

4. Categories of recipients

In addition to the term "recipient", the GDPR regularly uses the term "categories of recipients". This refers to the abstract grouping of recipients of the same kind, such as all department heads of a company, all statutory health insurance funds or all commissioned IT service providers.

The record of processing activities under Article 30(1)(d) GDPR expressly requires only the indication of the categories of recipients, not the naming of each individual recipient. This abstract approach takes account of the fact that, in ongoing operations, recipients may change without this triggering an obligation to update the record.

The proactive information obligations under Article 13(1)(e) and Article 14(1)(e) GDPR likewise allow the indication of categories. The position is different in the case of the reactive obligation to provide access (on this, see 5. below).

5. Recipients under the right of access

The right of access under Article 15(1)(c) GDPR obliges the controller to provide information about the recipients or categories of recipients to whom the personal data have been or will be disclosed.

The CJEU has clarified that the data subject is in principle entitled to be told the specific recipients. A limitation to categories of recipients is permissible only by way of exception: where the identity of the recipients is not yet ascertainable, or where the request for access is manifestly unfounded or excessive within the meaning of Article 12(5) GDPR (CJEU, judgment of 12 January 2023, C-154/21, RW v Österreichische Post, paras. 46, 48).

The CJEU bases this on the principle of transparency under Article 5(1)(a) GDPR: only knowledge of the specific recipients enables the data subject to effectively exercise its further rights, in particular to rectification, erasure and restriction of processing, vis-a-vis all parties involved. The right of access relates in this respect to disclosures that have actually taken place; disclosures that are still outstanding and merely planned may be described in categories.

For practice, it follows that anyone who wishes to answer requests for access quickly and completely should record, in the internal data protection management system, not only the categories of recipients but also the specific recipients, even though the record of processing activities under Article 30 GDPR requires only categories.

6. Disclosure to recipients and purpose limitation

The fact that a body is a recipient says nothing about whether the disclosure is permissible. Every disclosure to a recipient is a processing operation and must be based on a legal basis.

Purpose limitation is of particular importance here: personnel data, for example, may be disclosed to superiors only insofar as this is necessary for the employment relationship; a disclosure solely because it appears useful or practical is not sufficient. Necessity and proportionality, not mere usefulness, are the yardstick.

Under Article 19 GDPR, the controller must, in addition, inform all recipients to which personal data have been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort. On request by the data subject, the controller must inform it about which recipients have been notified.