What it asks for. When personal data are obtained from a source other than the individual, the controller must provide information similar to Article 13, plus the categories of data and the source. This must be done within a reasonable period, at the latest within one month, or at first communication or disclosure if earlier. Exceptions apply, for example where providing the information proves impossible or would involve disproportionate effort, with safeguards.
In practice. Organisations identify indirect collection, such as purchased lists, data shared by partners, public sources and threat intelligence, and plan how individuals will be informed. Where an exception is relied on, the reasoning is documented and alternative measures such as publishing information are taken. Evidence includes notices, timing records and documented exception assessments.
Common gaps. Indirectly obtained data is often overlooked entirely. The disproportionate effort exception is sometimes relied on without assessment or compensating measures.