indirect-collection-notice
Installation
SKILL.md
Providing Indirect Collection Information
Overview
GDPR Article 14 applies when a controller obtains personal data from a source other than the data subject — such as from third-party data brokers, publicly available sources, other controllers, or through automated observation by third parties. The controller must still provide the data subject with comprehensive information about the processing, but the timing and content requirements differ from Art. 13.
Legal Foundation
GDPR Article 14 — Information Where Personal Data Have Not Been Obtained from the Data Subject
Required Information (Art. 14(1)-(2))
All elements required under Art. 13(1)(a)-(f) and Art. 13(2)(a)-(g) PLUS:
| Element | Article | Description |
|---|---|---|
| Categories of personal data | Art. 14(1)(d) | The categories of personal data concerned (not required under Art. 13 because the subject already knows what they provided) |
| Source of data | Art. 14(2)(f) | From which source the personal data originate, and if applicable, whether it came from publicly accessible sources |