1 The information in relation to the processing of personal data relating to the data subject should be given to him or her at the time of collection from the data subject, or, where the personal data are obtained from another source, within a reasonable period, depending on the circumstances of the case. 2 Where personal data can be legitimately disclosed to another recipient, the data subject should be informed when the personal data are first disclosed to the recipient. 3 Where the controller intends to process the personal data for a purpose other than that for which they were collected, the controller should provide the data subject prior to that further processing with information on that other purpose and other necessary information. 4 Where the origin of the personal data cannot be provided to the data subject because various sources have been used, general information should be provided.
This recital of the General Data Protection Regulation clarifies article 13 GDPR (Information to be provided where personal data are collected from the data subject) and article 14 GDPR (Information to be provided where personal data have not been obtained from the data subject).*
