When information must be provided (timing)
Timing is one of the key practical differences between the two Articles. Under Article 13 the information must be given at the time the personal data are obtained. Under Article 14(3), where data come from another source, the information is due within a reasonable period and at the latest within one month, or at the first communication with the subject, or at the first disclosure to a recipient - whichever applies earliest. Two cross-cutting rules: the right to object must reach the subject by the first communication, and information about the right to withdraw consent must be given before consent is given.
| Scenario | Latest point to provide information |
|---|---|
| Article 13 - data collected directly | At the time the personal data are obtained |
| Article 14 - data from another source (general) | Reasonable period, at the latest within one month |
| Article 14 - data used to communicate with the subject | At the latest at the first communication |
| Article 14 - disclosure to another recipient envisaged | At the latest when the data are first disclosed |
| Right to object (Art 21(4)) | At the latest at the first communication with the subject |
| Right to withdraw consent (Art 7(3)) | Before the data subject gives consent |
| New purpose (further processing) | Before the new processing begins, with enough notice |
Article 13 = at the time of collection. Article 14 = within one month at the outer limit (or first communication / first disclosure if sooner). Withdraw-consent info = before consent.