The right for individuals to be informed under GDPR

There is a need for transparency regarding the gathering and use of data in order to allow EU citizens to exercise their right to the protection of personal data.

Therefore, the General Data Protection Regulation (GDPR) gives individuals a right to be informed about the collection and use of their personal data, which leads to a variety of information obligations by the controller.

Thеrе are 2 types of dаtа you muѕt be aware of gіvіng to іndіvіduаlѕ undеr GDPR lеgіѕlаtіоn:

1. Data that уоu’vе obtained directly frоm an іndіvіduаl themselves
2. Information that hasn’t been оbtаіnеd directly from the іndіvіduаl

At the time of collecting their data, people must be informed clearly about at least: 

• who your company/organisation is (your contact details, and those of your DPO if any);
• why your company/organisation will be using their personal data (purposes);
• the categories of personal data concerned;
• the legal justification for processing their data;
• for how long the data will be kept;
• who else might receive it;
• whether their personal data will be transferred to a recipient outside the EU;
• that they have a right to a copy of the data (right to access personal data) and other basic rights in the field of data protection (see complete list of rights);
• their right to lodge a complaint with a Data Protection Authority (DPA);
• their right to withdraw consent at any time;
• where applicable, the existence of automated decision-making and the logic involved, including the consequences thereof.

The information may be provided in writing, orally at the request of the individual when identity of that person is proven by other means, or by electronic means where appropriate.

Your company/organisation must do that in a concise, transparent, intelligible and easily accessible way, in clear and plain language and free of charge.

When data is obtained from another company/organisation, your company/organisation should provide the  information listed above to the person concerned at the latest within 1 month after your company obtained the personal data; or, in case your company/organisation communicate with the individual, when the data is used to communicate with them; or, if a disclosure to another company is envisaged, when the personal data was first disclosed.

Your company/organisation is also required to inform the individual of the categories of data and the source from which it was obtained including if it was obtained from publicly accessible sources.

Under specific circumstances listed in Articles 13(4) and 14(5) of the GDPR your company/organisation may be exempted from the obligation to inform the individual.

This applies, if providing the information is either impossible or unreasonably expensive, the gathering and/or transmission is required by law, or if the data must remain confidential due to professional secrecy or other statutory secrecy obligations.