According to Article 14 of the GDPR, when a controller collects personal data from a source other than the data subject, the controller must provide the data subject with certain information, such as the identity and contact details of the controller, the purposes and legal basis of the processing, the categories of personal data concerned, the recipients or categories of recipients of the personal data, and the rights of the data subject. This information must be provided within a reasonable period after obtaining the personal data, but at the latest within one month, or at the time of the first communication with the data subject, or before disclosing the data to another recipient. The purpose of this provision is to ensure fair and transparent processing of personal data and to respect the right of the data subject to be informed. Reference:
Article 14 of the GDPR, which specifies the information to be provided where personal data have not been obtained from the data subject.
ICO guidance, which explains the requirements and exceptions of Article 14 of the GDPR.
EDPB guidelines, which provide further guidance on the application of Article 14 of the GDPR.