What information must be supplied?
The Law sets out the information that you should supply and when individuals should be informed.
The information you supply is determined by whether or not you obtained the personal data directly from individuals. If a processor obtains the personal data directly from the data subject on your behalf it is as if you have obtained it directly from the data subject.
See the table below for further information on this.
The information you supply about the processing of personal data must be:
The table below summarises the information you should supply to individuals and at what stage.
When should we provide this information to individuals?
When you collect personal data from the data subject it relates to, you must provide them with this information at the time you obtain their data.
When you obtain personal data from a source other than the data subject it relates to, you need to provide the data subject with this information:
You must actively provide this information to individuals. You can meet this requirement by putting the information on your website, but you must make individuals aware of it and give them an easy way to access it.
When collecting personal data from individuals, you do not need to provide them with any information that they already have.
When obtaining personal data from other sources, you do not need to provide data subjects with this information if:
If you are using any of the above as a reason for not providing this information to a data subject you must be able to justify use of or reliance upon that condition. This reasoning could be scrutinised by supervisory authorities if a complaint is made by a data subject.