Skip to main content
Glossary termPublished inNormenkader IBP

Recipient

Also known as ontvanger

What does "recipient" mean under the GDPR?

‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

Defined in / by

Last updated: 14 October 2026.

Wider than a third party

"Whether a third party or not" is the phrase that matters. A processor is a recipient, even though it is not a third party. The definition counts every body that receives the data, which is why the GDPR can ask a controller to say who receives them without first sorting outsiders from insiders.

The term carries duties in two places. Articles 13(1)(e) and 14(1)(e) require the controller to tell data subjects the recipients or categories of recipients of their data. Article 30(1)(d) requires the record of processing activities to list the categories of recipients, including recipients in third countries or international organisations.

The second sentence carves out one group: public authorities that receive data in the framework of a particular inquiry under Union or Member State law are not recipients for these purposes. The data protection rules still apply to what those authorities then do with the data. For a school, a request from an authority conducting a specific investigation can therefore fall outside the list of recipients it gives parents, while regular flows, such as those to a supplier, stay inside it.

Questions and answers

Is a processor a recipient under the GDPR?

Yes. Article 4, point (9), of the GDPR defines a recipient as anyone to whom personal data are disclosed, "whether a third party or not". A processor that receives data from the controller is therefore a recipient, even though it is not a third party.

Where must a controller list recipients under the GDPR?

In the information given to data subjects under Articles 13(1)(e) and 14(1)(e), and in the record of processing activities under Article 30(1)(d). Both may name categories of recipients rather than each one individually.

Regulations

  • Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)

    The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.

    Next
    Every board knows its position against the Normenkader through a self-evaluation, and has a plan to meet all norms