Article 14 of the GDPR: Information to provide when data is not collected from the data subject

· Updated on · By Bertrand BucelleBertrand Bucelle · 2 min read

Article 14 of the GDPR: Information to provide when data is not collected from the data subject

Article 14 of the GDPR Explained

The data controller must provide the data subject with the following information:

  • Identity and contact details of the data controller,
  • Purposes and legal basis of the processing,
  • Categories of data concerned,
  • Potential recipients,
  • Retention period,
  • Rights of data subjects (access, rectification, erasure, etc.),
  • Right to lodge a complaint with a supervisory authority,
  • Source of the data,
  • Existence of automated decision-making.

This information must be provided within a reasonable period, at the latest within one month, or at the time of the first communication with the data subject, as applicable.

Why This Article is Key to Your GDPR Compliance

Article 14 ensures transparency even in indirect processing operations, particularly in cases of database purchases, commercial partnerships, or delegated processing operations. Omitting this information constitutes a breach of the GDPR.

How to Comply with Article 14 of the GDPR?

  • Incorporate the Article 14 disclosures into your privacy policy documents or into direct communication (email, mail, etc.).
  • Implement a process to identify cases of indirect collection.
  • Inform individuals within the timeframes prescribed by law (1 month maximum).
  • Document this action in your record of processing activities.

Examples of Application of GDPR Article 14

  • A company purchases a prospecting file: it informs the data subjects by email within 30 days.
  • A public body obtains data from another public organisation: it makes a specific information page available on its website.
  • A recruiter consults profiles on LinkedIn: they inform the candidates upon first contact.

Related Resources

Accelerate your compliance in a few clicks

Thanks to our all-in-one solution, you can accelerate and ensure your compliance with ease:

  • Automate your compliance with our GDPR software
  • Supported or outsourced by our DPO experts
  • Raise your teams' awareness with our GDPR training e-learning

👉 Request a demo with an expert

⚡ Evaluate your situation in 15 minutes with our free, no-obligation GDPR self-assessment.

👉 GDPR: Self-assess now