Transparency is one of the key principles of the GDPR. As a result, the Regulation gives data subjects the right to be informed about any processing activities pertaining to their data. There are two cases here: when the data is collected directly from the data subject and when the data is obtained indirectly.
If the data is obtained from the data subject, informing them of the processing activities must be done immediately when the data is obtained. Information that should be provided includes: the processing purposes, the legal basis, the legitimate interests - if any, the intention to transfer data to third countries, the duration of storage, the rights of the data subject, and if automated-decision making or profiling will be used.
On the other hand, if the data is not obtained directly from the data subjects, they will be informed without undue delay, but not later than a month after obtaining the data. If the data will be used to contact the data subject, he/she should be informed of this immediately. In any case, the information to be provided to the data subject is the same as in the previous case. In addition, the controller should also provide information on the sources for collecting the data.
The information provided to the data subject has to be in an easily accessible form, in a language that is easy to understand. It can be handed either in writing or in electronic form.