| name | indirect-collection-notice |
| title | Providing Indirect Collection Information |
| description | Provides GDPR Article 14 information for personal data obtained from sources other than the data subject, covering timing requirements (within reasonable period, max one month), source disclosure, all required elements, and exemptions under Art. 14(5). Activate for Art. 14, indirect collection, third-party data source, indirect data notice queries. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/indirect-collection-notice |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Providing Indirect Collection Information
Overview
GDPR Article 14 applies when a controller obtains personal data from a source other than the data subject — such as from third-party data brokers, publicly available sources, other controllers, or through automated observation by third parties. The controller must still provide the data subject with comprehensive information about the processing, but the timing and content requirements differ from Art. 13.
Legal Foundation
GDPR Article 14 — Information Where Personal Data Have Not Been Obtained from the Data Subject
Required Information (Art. 14(1)-(2))
All elements required under Art. 13(1)(a)-(f) and Art. 13(2)(a)-(g) PLUS:
| Element | Article | Description |
|---|
| Categories of personal data | Art. 14(1)(d) | The categories of personal data concerned (not required under Art. 13 because the subject already knows what they provided) |
| Source of data | Art. 14(2)(f) | From which source the personal data originate, and if applicable, whether it came from publicly accessible sources |
Timing Requirements (Art. 14(3))
The controller must provide the information:
- Art. 14(3)(a) — Default: Within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed.
- Art. 14(3)(b) — Communication with data subject: If the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject.
- Art. 14(3)(c) — Disclosure to another recipient: If a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.
The earliest applicable deadline governs.
Exemptions Under Art. 14(5)
Art. 14(1)-(4) shall not apply where and insofar as:
- Art. 14(5)(a) — Data subject already has the information: The data subject already has the information.
- Art. 14(5)(b) — Impossible or disproportionate effort: The provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research, or statistical purposes under Art. 89(1). In such cases, the controller must take appropriate measures to protect the data subject's rights and freedoms, including making the information publicly available.
