Certified Information Privacy Professional – Europe (CIPP/E) — Question 167

According to Article 14 of the GDPR, how long does a controller have to provide a data subject with necessary privacy information, if that subject’s personal data has been obtained from other sources?

Answer options

• A. As soon as possible after obtaining the personal data.
• B. As soon as possible after the first communication with the data subject.
• C. Within a reasonable period after obtaining the personal data, but no later than one month.
• D. Within a reasonable period after obtaining the personal data, but no later than eight weeks.

Correct answer: C

Explanation

The correct answer is C because GDPR Article 14 states that a controller must provide privacy information within a reasonable period after obtaining personal data, but this period cannot exceed one month. Options A and B are incorrect because they do not specify a time limit and may not ensure compliance. Option D is incorrect as it exceeds the one-month limit set by the GDPR.