Privacy Notices under GDPR Data obtained Data not directly directly from data obtained from data subject subject What information must be supplied? Not required when Not required when the data the data subject has subject has the info. Not the information required when derogations in art 14(5)(b) to (d) apply e.g. disproportionate effort for archiving in the public interest. Identity and contact details of the controller and where applicable, the controller’s representative and DPO Purpose of the processing and the legal basis for the processing The legitimate interests of the controller or third party, where applicable Categories of personal data Any recipient or categories of recipients of the personal data Details of transfers to third country and safeguards Retention period of criteria used to determine the retention period The existence of each of the data subject’s rights The right to withdraw consent at any time, where relevant The right to lodge a complaint with a supervisory authority The source the personal data originated from and whether it came from publically accessible sources Whether the provision of personal data part of a statutory or contractual requirement or obligation and possible consequences of failing to provide the personal data When should it be provided? At the time the data Within a reasonable period is obtained (1 month) of obtaining the data. If the data used to communicate with the individual, no later than when the 1st coms takes place. If the disclosure to another recipient is envisaged, at the latest,
Privacy Notices under GDPR Data obtained directly from data subject Data not directly obtained from data subject What information must be supplied? Not required when the data subject has the information Not required when the data subject has the info. Not required when derogations in art 14(5)(b) to (d) apply e.g. disproportionate effort for archiving in the public interest. Identity and contact details of the controller and where applicable, the controller’s representative and DPO Purpose of the processing and the legal basis for the processing The legitimate interests of the controller or third party, where applicable Categories of personal data Any recipient or categories of recipients of the personal data Details of transfers to third country and safeguards Retention period of criteria used to determine the retention period The existence of each of the data subject’s rights The right to withdraw consent at any time, where relevant The right to lodge a complaint with a supervisory authority The source the personal data originated from and whether it came from publically accessible sources Whether the provision of personal data part of a statutory or contractual requirement or obligation and possible consequences of failing to provide the personal data When should it be provided? At the time the data is obtained Within a reasonable period (1 month) of obtaining the data. If the data used to communicate with the individual, no later than when the 1st coms takes place. If the disclosure to another recipient is envisaged, at the latest,
GDPR%20Guidance%20Note%204%20Privacy%20Notices.docx