---
title: "Recipient"
description: "Recipient under the GDPR, Article 4(9): anyone to whom personal data are disclosed, third party or not, with one exception for public authorities."
canonical: "https://gencompl.ai/glossary/recipient-gdpr"
language: "en-US"
type: "Glossary term"
published: "2026-10-14T18:23:06.410Z"
modified: "2026-10-14T19:20:49.501Z"
---

# Recipient

‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

Also known as: ontvanger

**What does "recipient" mean under the GDPR?**

Defined in: [Normenkader IBP](https://gencompl.ai/regulations/normenkader-ibp)

[Home](https://gencompl.ai/) › [Glossary](https://gencompl.ai/glossary) › Recipient

> ‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

## Defined in / by

- [GDPR (32016R0679)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), Article 4, point (9)

Last updated: 14 October 2026.

## Wider than a third party

"Whether a third party or not" is the phrase that matters. A processor is a recipient, even though it is not a third party. The definition counts every body that receives the data, which is why the GDPR can ask a controller to say who receives them without first sorting outsiders from insiders.

The term carries duties in two places. Articles 13(1)(e) and 14(1)(e) require the controller to tell data subjects the recipients or categories of recipients of their data. Article 30(1)(d) requires the record of processing activities to list the categories of recipients, including recipients in third countries or international organisations.

The second sentence carves out one group: public authorities that receive data in the framework of a particular inquiry under Union or Member State law are not recipients for these purposes. The data protection rules still apply to what those authorities then do with the data. For a school, a request from an authority conducting a specific investigation can therefore fall outside the list of recipients it gives parents, while regular flows, such as those to a supplier, stay inside it.

> **What we could not establish**
>
> This entry fixes the term as the GDPR words it. It does not decide whether a given processing at your school or organisation meets the Regulation; that is a question for your data protection officer or counsel.

## Questions and answers

### Is a processor a recipient under the GDPR?

Yes. Article 4, point (9), of the GDPR defines a recipient as anyone to whom personal data are disclosed, "whether a third party or not". A processor that receives data from the controller is therefore a recipient, even though it is not a third party.

### Where must a controller list recipients under the GDPR?

In the information given to data subjects under Articles 13(1)(e) and 14(1)(e), and in the record of processing activities under Article 30(1)(d). Both may name categories of recipients rather than each one individually.

## Sources

- [Regulation (EU) 2016/679 (General Data Protection Regulation)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679) (EUR-Lex · 4 May 2016)
- [Normenkader IBP: begrippenlijst](https://normenkaderibp.kennisnet.nl/begrippenlijst/) (Kennisnet)

## Related content

### Regulation

- [Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)](https://gencompl.ai/regulations/normenkader-ibp): The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.