Art.14 Information where personal data have not been obtained from the data subject
Where personal data has not been obtained from the data subject, provide the same identity, contact, purpose, legal basis, recipient and transfer information as Article 13, plus the categories of personal data concerned
5
artefacts
0
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of the notification sent with its date, tested against the one month, first communication and first disclosure triggers · Policy repository / GRC workspace
- The disproportionate effort assessment where the exemption is relied on, showing what was weighed rather than only that a conclusion was reached · Document repository
governing documentDocuments that govern the control
- A source register showing, per dataset, where the data came from and whether the source was publicly accessible · Policy repository / GRC workspace
- The alternative protective measures put in place under that exemption, including where the information was made publicly available · Document repository
- Supplier contract terms requiring the source of the data and the lawfulness of its collection to be disclosed · Vendor register / contract repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Purchased or enriched marketing data used with no Article 14 notification at all, which is the most common finding in this area
- Disproportionate effort claimed because notifying is inconvenient or costly rather than genuinely disproportionate
- The source recorded as a vendor name with no indication of where the vendor itself obtained the data
- Notification sent at the first marketing contact months after the data was obtained, missing the one month limit
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.13 Information to be provided where personal data are collected · Art.15 Right of access by the data subject