What evidence do auditors commonly ask for on Art.14 Information where personal data have not been obtained from the data subject?

A source register showing, per dataset, where the data came from and whether the source was publicly accessible; Evidence of the notification sent with its date, tested against the one month, first communication and first disclosure triggers; The disproportionate effort assessment where the exemption is relied on, showing what was weighed rather than only that a conclusion was reached; The alternative protective measures put in place under that exemption, including where the information was made publicly available; Supplier contract terms requiring the source of the data and the lawfulness of its collection to be disclosed.

What is the most common gap auditors find on Art.14?

Purchased or enriched marketing data used with no Article 14 notification at all, which is the most common finding in this area

GDPR · Chapter III - Rights of the Data Subject

`Art.14` Information where personal data have not been obtained from the data subject

Where personal data has not been obtained from the data subject, provide the same identity, contact, purpose, legal basis, recipient and transfer information as Article 13, plus the categories of personal data concerned and the source the data came from including whether it was a publicly accessible source. Provide it within a reasonable period and at the latest within one month of obtaining the data, or at the latest at the first communication with the data subject if the data is used to communicate with them, or at the latest when the data is first disclosed to another recipient. The obligation does not apply where the data subject already has the information, where provision proves impossible or would involve disproportionate effort in which case appropriate protective measures including making the information publicly available must be taken, where obtaining or disclosure is expressly laid down by Union or Member State law with appropriate safeguards, or where the data must remain confidential under an obligation of professional secrecy.

Source: GDPR, Art.14. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.

Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.

artefacts

held by a system

at each review

hard

to go live

Policy repository / GRC workspace

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

Evidence of the notification sent with its date, tested against the one month, first communication and first disclosure triggers · Policy repository / GRC workspace
The disproportionate effort assessment where the exemption is relied on, showing what was weighed rather than only that a conclusion was reached · Document repository

governing documentDocuments that govern the control

A source register showing, per dataset, where the data came from and whether the source was publicly accessible · Policy repository / GRC workspace
The alternative protective measures put in place under that exemption, including where the information was made publicly available · Document repository
Supplier contract terms requiring the source of the data and the lawfulness of its collection to be disclosed · Vendor register / contract repository

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

Purchased or enriched marketing data used with no Article 14 notification at all, which is the most common finding in this area
Disproportionate effort claimed because notifying is inconvenient or costly rather than genuinely disproportionate
The source recorded as a vendor name with no indication of where the vendor itself obtained the data
Notification sent at the first marketing contact months after the data was obtained, missing the one month limit

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

Art.13 Information to be provided where personal data are collected · Art.15 Right of access by the data subject