Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to.
Try Cookiebot Free
Article 14
Information to be provided where personal data have not been obtained from the data subject
Chapter 3|Rights of the data subject|📖 14 min read
1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:
(a) the identity and the contact details of the controller and, where applicable, of the controller's representative;
(b) the contact details of the data protection officer, where applicable;
(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
(d) the categories of personal data concerned;
(e) the recipients or categories of recipients of the personal data, if any;
(f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available.
2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:
(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
(b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;
(c) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability;
(d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
(e) the right to lodge a complaint with a supervisory authority;
(f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;
(g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
3. The controller shall provide the information referred to in paragraphs 1 and 2:
(a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed;
(b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or
(c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.
4. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.
5. Paragraphs 1 to 4 shall not apply where and insofar as:
(a) the data subject already has the information;
(b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available;
(c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interests; or
(d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.
Understanding This Article
Article 14 establishes transparency obligations for situations where personal data is obtained from sources other than the data subject directly - for example, from public records, data brokers, third parties, or through observation. This article ensures individuals are informed about processing even when they didn't directly provide their data to the controller.
Scope and Application:
Article 14 applies to 'indirect' data collection scenarios: purchasing marketing lists, obtaining data from data brokers, scraping public websites, receiving data from business partners, accessing public registers, using credit reference agencies, or any situation where the controller obtains personal data without direct interaction with the data subject. This contrasts with Article 13, which applies when data is collected directly from individuals.
Paragraph 1 - Essential Information:
The information requirements closely mirror Article 13, with one key addition:
(d) Categories of Personal Data: Unlike Article 13 (where data subjects know what they provided), Article 14 requires explicitly stating what categories of data are being processed (e.g., 'contact details, employment history, credit information'). This is crucial because data subjects may not know what information about them has been obtained from third-party sources.
The other requirements match Article 13: controller identity, DPO contacts, purposes and legal basis, recipients, and international transfer information. These ensure data subjects understand who is processing their data and why, even though they didn't directly interact with the controller.
Paragraph 2 - Additional Information:
Paragraph 2 requires further details for fair processing, largely mirroring Article 13(2) but with a critical addition:
(f) Data Source: Controllers must inform data subjects where their personal data originated. If the data came from publicly accessible sources (public registers, published directories, openly available websites), this must be explicitly stated. For example: 'We obtained your professional information from LinkedIn' or 'We obtained your business contact details from the public companies register.' This source transparency is fundamental to Article 14 - it explains how the controller got the data when there was no direct collection.
Other paragraph 2 requirements include: retention periods, legitimate interests (if applicable), data subject rights information, withdrawal of consent rights (if applicable), right to complain, and automated decision-making information. These ensure individuals can exercise their rights and understand how their data is used, regardless of collection source.
Paragraph 3 - Timing Requirements:
Unlike Article 13 (which requires information 'at the time' of collection), Article 14 provides flexible timing because immediate notification isn't always practical when data is obtained indirectly:
(a) General Rule: Information must be provided within a 'reasonable period' after obtaining the data, but no later than one month. What's 'reasonable' depends on circumstances - a marketing company buying a contact list should notify quickly, while a researcher processing archived data might take longer (up to the one-month maximum).
(b) First Communication: If the data will be used to communicate with the data subject (emails, phone calls, letters), information must be provided at the latest during that first communication. This makes sense - the first contact is the natural moment to explain how you got their information and why you're contacting them.
(c) First Disclosure: If the controller plans to share the data with another recipient, information must be provided before or when that disclosure occurs. This ensures data subjects know about data sharing before it happens.
These timing rules balance the need for timely transparency with practical realities of indirect data collection.
Paragraph 4 - Purpose Changes:
Like Article 13(3), if controllers later decide to process the data for a new purpose incompatible with the original purpose, they must inform data subjects before beginning the new processing, including the new purpose and any relevant additional information.
Paragraph 5 - Exceptions:
Article 14 includes broader exceptions than Article 13, recognizing that indirect data collection contexts sometimes make notification impractical:
(a) Existing Information: If data subjects already have the information, repetition isn't required. Perhaps they received it from the source that originally collected the data.
(b) Impossible or Disproportionate Effort: If providing information is impossible (e.g., no contact details available) or would require disproportionate effort (e.g., notifying millions of individuals whose data was obtained from public sources for statistical research), controllers can rely on this exception. However, 'disproportionate effort' has a high threshold - administrative inconvenience alone doesn't suffice. The exception particularly applies to archiving, research, and statistical purposes under Article 89(1) safeguards. Importantly, even when relying on this exception, controllers must take 'appropriate measures' to protect data subject rights, including making information publicly available (e.g., publishing a general notice on their website explaining the processing).
(c) Legal Obligation: If Union or Member State law expressly requires or authorizes obtaining or disclosing the data and provides appropriate safeguards, notification obligations may not apply. For example, laws requiring disclosure to authorities for regulatory purposes.
(d) Professional Secrecy: If data must remain confidential under professional secrecy obligations (medical, legal, or other regulated confidentiality), notification requirements may be waived to preserve confidentiality.
These exceptions recognize legitimate situations where strict notification would be impractical or counterproductive, while still requiring controllers to protect data subject interests.
Practical Challenges:
Article 14 creates practical challenges: controllers must often track down contact details for individuals whose data they obtained from third parties, determine appropriate notification methods, and balance transparency with efficiency. Many controllers struggle with this, sometimes improperly claiming 'disproportionate effort' exceptions. Supervisory authorities scrutinize these claims carefully.
Interaction with Other Provisions:
Article 14 works alongside: Article 12 (communication modalities), Article 13 (direct collection), Articles 15-22 (substantive rights), Article 5 (transparency principles), and Articles 44-50 (international transfers mentioned in transparency notices).
Key Points
Controllers must inform data subjects when personal data is obtained from sources other than the data subject themselves
Information must include data sources (whether from publicly accessible sources or not) and categories of data collected
Information must be provided within one month of obtaining the data, or at first communication, or before first disclosure to another recipient
Exceptions apply when providing information is impossible, involves disproportionate effort, or would impair research/archiving objectives
Controllers must still take appropriate measures to protect data subject rights even when relying on exceptions
Practical Application
Marketing List Purchase Example (Compliant): A company purchases a marketing contact list from a data broker. Within one month, the company sends an email to everyone on the list stating: 'We obtained your contact details from [Data Broker Company] to inform you about our products. Legal basis: our legitimate interest in direct marketing. You can opt-out anytime by clicking here or emailing optout@company.com. We'll keep your email until you opt-out or 2 years of inactivity. You have rights to access, erase, or object to this processing. Contact privacy@company.com for questions or to exercise rights.' This complies with Article 14 by providing information at first communication, disclosing the data source, explaining the legal basis, and informing of rights.
LinkedIn Data Scraping for Recruitment: A recruitment agency scrapes publicly available LinkedIn profiles to identify potential candidates. Before contacting candidates, the agency emails: 'We found your profile on LinkedIn and think you might be interested in [job opportunity]. We obtained your name, job title, and contact details from your public LinkedIn profile. Legal basis: our legitimate interest in recruitment. We'll keep your information for 6 months unless you ask us to delete it sooner. You can request access, correction, or deletion by emailing recruitment@agency.com.' This properly discloses the public source and complies with timing requirements (information at first communication).
Credit Reference Agency Data: A bank obtains credit information from a credit reference agency to assess a loan application. When providing the application decision, the bank includes: 'We obtained credit information about you from [Credit Agency Name] to assess your application. This included credit history, existing debts, and repayment records. Legal basis: our legitimate interest in credit risk assessment. You can request a copy of your credit report from the agency and from us. You have rights to access, rectify, or object to this processing by contacting dpo@bank.com.' This informs about indirect data collection and the source.
Public Register Data for Research: A research institution obtains data from public property registers to study housing patterns. Because notifying thousands of property owners individually would involve disproportionate effort, the institution relies on Article 14(5)(b), but publishes on its website: 'We are conducting research on housing patterns using data from public property registers. This includes property ownership, size, and transaction data. Legal basis: public interest research. Data is pseudonymized and results published only in aggregate. For questions about how your data may be included, contact research@institution.edu.' This uses the disproportionate effort exception but takes appropriate measures by making information publicly available.
Business Partner Data Sharing: Company A shares customer contact details with Company B for a joint marketing campaign. Before Company B uses the data, they send an email: 'Our partner [Company A] shared your contact details with us because you purchased [product category]. We're reaching out about our complementary product [X]. Legal basis: legitimate interest in marketing to customers of related products. Data obtained from: [Company A] in [date]. You can opt-out by clicking here. We won't share your data further without your consent.' This complies with Article 14 timing (information before first communication) and source disclosure requirements.
Data Broker Enrichment: An online retailer enriches existing customer data by purchasing additional demographic and lifestyle information from a data broker. The retailer updates their privacy notice and emails customers: 'We've updated how we use your data. We now supplement the information you provided with demographic data from [Data Broker] to better personalize our service. This includes age range, income bracket, and interests. Legal basis: our legitimate interest in service personalization. You can object to this enrichment in your account settings. Source: [Data Broker Name] matched to your account via hashed email.' This properly notifies about the new data source and changed processing.
Compliance Screening: A financial institution obtains client information from sanctions and politically exposed persons (PEP) screening databases for anti-money laundering compliance. The institution informs clients during onboarding: 'As required by anti-money laundering regulations, we screen your information against PEP and sanctions databases provided by [Screening Provider]. Legal basis: legal obligation under AML regulations. This is mandatory for account opening. Screening occurs regularly while you're our client. Data source: [Screening Provider] databases. You cannot opt-out but can request details of checks performed.' This explains the legal obligation basis and data sources.
Violation Example - No Notification: A marketing company purchases a contact list and immediately starts sending promotional emails without any information about where they got the contacts, who they are, or how to opt-out. This violates Article 14 by failing to provide any of the required information. Recipients have no idea how the company got their data or how to exercise their rights.
Violation Example - Delayed Notification: A company obtains personal data from a public source in January but doesn't inform data subjects until May (4 months later), without qualifying for any Article 14(5) exceptions. This violates the one-month timing requirement in Article 14(3)(a).
Improper Exception Claim: A company claims 'disproportionate effort' to avoid notifying 10,000 individuals whose data it purchased, simply because sending 10,000 emails would be 'expensive and time-consuming.' This likely doesn't qualify for the exception - sending bulk emails isn't truly disproportionate effort for a commercial entity. The exception is intended for genuinely impractical situations, not ordinary business communications.
Public Source Research (Valid Exception): An academic researcher analyzes millions of public social media posts to study language patterns, with full pseudonymization and only aggregate publication of results. Notifying millions of social media users individually would be genuinely impossible and would seriously impair research objectives. The researcher relies on Article 14(5)(b), but publishes a detailed research methodology document explaining the data sources, processing, safeguards, and how individuals can request exclusion. This appropriately uses the exception while protecting data subject interests.
Professional Secrecy Example: A lawyer receives personal data about opposing parties during legal proceedings. Due to legal professional privilege and confidentiality obligations, the lawyer cannot notify those individuals about processing their data as this would breach professional secrecy. Article 14(5)(d) applies, exempting the notification requirement to preserve confidentiality.
Best Practice - Proactive Transparency: When purchasing or receiving data from third parties, immediately establish: (1) What data was obtained? (2) From what source? (3) Are contact details available? (4) What's the most efficient notification method? (5) Do any exceptions apply? (6) How can we make information available even if individual notification is impractical? Proactive planning ensures Article 14 compliance rather than reactive scrambling.
Best Practice - Source Documentation: Maintain records of where each dataset came from, when it was obtained, when notifications were sent, and what exceptions were relied upon. This documentation demonstrates compliance and facilitates responses to data subject inquiries like 'where did you get my information?'
Technology Solution: Some organizations implement automated Article 14 notification systems: when new data enters their systems from third-party sources, the system automatically flags it for notification, generates appropriate transparency messages based on the data source and processing purposes, and tracks notification delivery. This ensures systematic compliance rather than ad-hoc, error-prone manual processes.