According to Article 14 of the GDPR, if the controller obtains personal data from other sources, such

as third parties or publicly accessible sources, the controller must provide the data subject with the

necessary privacy information, such as the identity and contact details of the controller, the purposes

and legal basis of the processing, the categories of personal data concerned, the recipients or

categories of recipients of the personal data, and the rights of the data subject. The controller must

provide this information within a reasonable period after obtaining the personal data, but no later

than one month, having regard to the specific circumstances in which the personal data are

processed. However, there are some exceptions to this rule, such as if the data subject already has

the information, if the provision of the information proves impossible or would involve a

disproportionate effort, if the obtaining or disclosure of the data is expressly laid down by EU or

member state law, or if the personal data must remain confidential subject to an obligation of

professional secrecy12. Reference:

GDPR, Article 14

Free CIPP/E Study Guide, page 19, section 2.5.1

CIPP/E Certification, page 14, section 1.2.1

Art. 14 GDPR - Information to be provided where personal data have not been obtained from the

data subject

Article 14 GDPR - GDPRhub

Reference: https://dataprivacymanager.net/gdpr-exemptions-from-the-obligation-to-provideinformation-to-the- individual-data-subject/