If your organisation is collecting the personal data directly from individuals, it must provide the necessary information at the time of collection.
In case of indirect collection of personal data, your organisation must provide the information at the latest within one month after the personal data has been initially obtained. This maximum period of one month can be reduced:
- if the personal data is used for the purpose of communication with the data subject. In that case, you must inform the data subject at the latest at the time of the first communication to the data subject;
- if the data is transmitted to another recipient, the organisation informs the data subjects of this at the latest when the personal data is transferred.
More information: