In short. GDPR Article 14 requires information about indirect personal data collection, including its source, with deadlines and narrowly interpreted exceptions.
Definition: GDPR Article 14 requires information to be provided to people when personal data about them is obtained from another source, including publicly accessible websites, subject to specified exceptions. Personal data means information relating to an identified or identifiable person.
Key facts
- GDPR Article 14(2)(f), reproduced by the CNIL, requires information about the source of personal data and, where applicable, whether it is publicly accessible.
- The Article 29 Working Party's transparency guidelines explain that the normal notice deadline is a reasonable period after collection, with a maximum of one month; earlier communication or disclosure can shorten it.
- In its January 2026 guidance for AI development, the CNIL treats web scraping, file downloads and reuse of existing datasets as examples of indirect collection covered by information duties.
What information must the collector provide?
The controller is the person or organisation that determines why and how personal data is processed, as defined in GDPR Article 4. A website operator collecting personal data for its own purposes must therefore assess its information duties as controller.
Article 14 requires the controller's identity and contact details, its representative and data protection officer where applicable, the purposes and legal basis, and the categories of personal data. The notice also covers recipients and applicable international transfer arrangements.
Further information includes retention periods or their determining criteria, applicable rights and complaint routes, legitimate interests when relied on, withdrawal of consent where relevant, and the data's source. Where the specified automated decision-making provisions apply, information includes the logic, significance and envisaged consequences.
The following references locate the source and timing duties:
GDPR Article 14(2)(f): source and public accessibility
GDPR Article 14(3)(a): reasonable period, at most one month
GDPR Article 14(3)(b): first communication with the person
GDPR Article 14(3)(c): first disclosure to another recipient
When and how must people receive information?
The transparency guidelines, paragraphs 27 and 28, explain that the one-month limit continues to apply even if the first communication or disclosure happens later. Where either happens sooner, information is due by that earlier event. The deadline runs from obtaining the data.
Under Article 12, information must be concise, intelligible, easily accessible and expressed in clear language. Article 14(4) requires information about a new purpose before further processing for that purpose, subject to the article's exceptions.
When can a public notice replace individual information?
Article 14(5)(b) covers situations where providing information proves impossible, requires disproportionate effort, or is likely to make the processing objectives impossible or seriously impair them. It requires appropriate protection for people's rights and interests, including publicly available information.
The transparency guidelines, paragraph 64, call for a documented balance between the effort of informing people and the impact on them of receiving no information. The guidelines say the exceptions should generally be interpreted narrowly.
For AI development, the CNIL's guidance requires a case-specific assessment considering contact options, privacy intrusion and safeguards. Data volume alone is insufficient. Its example of a controller reusing customers' data while retaining their email addresses calls for individual information by email.
Other Article 14 exceptions cover information the person already has, obtaining or disclosure expressly prescribed by qualifying law, and regulated professional secrecy. Public accessibility itself is absent from that list.
Related terms
- GDPR lawful basis for web data
- CNIL guidance on AI web scraping
- GDPR right to object
- GDPR data minimisation
FAQ
Does publishing a privacy policy fulfil the duty?
The CNIL's guidance says information must normally be brought to people's attention individually. If you rely on disproportionate effort, document the assessment and publish the required information with appropriate safeguards.
Can the original website inform people for a collector?
The same CNIL guidance encourages this approach where the original publisher remains in contact with people. If you reuse data, ensure the information covers your own processing, including its purpose and controller identity.
Can people request the source of collected data?
Article 15(1)(g) gives you access to available information about the source when personal data comes from elsewhere.
Sources
- CNIL, "CHAPITRE III - Droits de la personne concernée", 23 May 2016
- CNIL, "CHAPITRE I - Dispositions générales", 23 May 2016
- Article 29 Working Party, "Guidelines on transparency under Regulation 2016/679", revised 11 April 2018
- CNIL, "Informing data subjects", 5 January 2026
Check how a page reads to answer engines. Open the GEO score analyzer