The obligation to tell data subjects, at the time personal data is collected, who will receive it and why. The CJEU’s reasoning reinforces that later masking does not erase the duty that already existed when the controller first gathered the data.
What Transparency at Collection Requires
Transparency at collection means the notice has to be clear at the moment data is gathered, so people understand the purpose and recipient before the processing starts. The obligation is about timing as much as wording: later disclosure cannot cure an initial failure to inform.
This matters because collection is the point where consent, fairness, and lawful processing expectations are formed. If the recipient or purpose is hidden until after collection, the subject has already lost the chance to make an informed choice about whether to provide the data at all.
Why the Timing of Disclosure Matters
The legal and operational issue is not simply whether a privacy notice exists, but whether it is available when it can still influence the collection decision. A disclosure delivered after the fact may explain the processing, but it does not restore the informational position that should have existed at the outset.
That distinction is important in workflows where data is collected quickly or through layered interfaces. If the notice path is deferred, buried, or conditionally revealed, the controller can technically have a notice and still fail the transparency obligation that attaches to collection itself.
How This Affects Controller Design
Controllers need to treat collection-time transparency as part of the design of the data capture flow, not as a separate policy artifact. The disclosure should be presented where the person makes the submission decision, and it should identify the receiving parties and purpose in a way that is understandable at that moment.
This is especially important where data moves across multiple internal teams or external recipients. A vague statement about “business purposes” is usually not enough if the collection context already implies onward sharing, profiling, or disclosure to another organisation.
Common Failure Modes
The most common breakdown is not total silence, but delayed or obscured notice. That can happen when privacy information sits behind extra clicks, appears only after form submission, or is written so broadly that the actual recipient and use are not intelligible at collection time.
Another failure mode is relying on later masking, suppression, or redaction as if it erases the original duty. It does not. If the initial collection happened without the required disclosure, the transparency gap already exists, even if later processing becomes less visible.
Risk and Threat Considerations
When transparency at collection fails, the main exposure is not just regulatory, it is trust and control loss. People may disclose information without understanding who will receive it or how broadly it may be shared, which increases the likelihood of over-collection, complaints, and legal challenge.
Failure mechanism: The controller collects personal data before giving a clear, timely explanation of the recipients and purpose, or relies on a later notice to retroactively satisfy the obligation.
Impact: The organisation creates a disclosure defect at the moment of collection, which can undermine lawful processing, weaken informed choice, and increase enforcement or remediation risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while GDPR and ISO/IEC 27001:2022 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | N/A — Transparency and information obligations | This term concerns notice at collection under EU data protection law. |
| Recommendation — Provide the required recipient and purpose information at the point of collection. | ||
| NIST SP 800-53 Rev 5 | AR-2 — Privacy Impact and Risk Assessment | Collection-time notice is a privacy governance concern that should be reviewed as part of privacy impact assessment. |
| AP-1 — Authority to Process Personal Data | This term is about governing personal-data collection and disclosure obligations within an authorised privacy program. | |
| Recommendation — Assess collection notices to ensure data subjects receive timely, understandable purpose and recipient disclosure. Document and enforce the conditions under which personal data may be collected and disclosed. | ||
| ISO/IEC 27001:2022 | A.5.34 — Privacy and protection of PII | Transparency at collection is a privacy control requirement tied to handling PII responsibly. |
| Recommendation — Implement privacy notices and collection controls that disclose purpose and recipients before data capture. | ||
Practitioner Guidance
Governance implication: Treat collection-time disclosure as a required control point in the user journey, not a policy footnote. The practical test is whether a data subject can see, at the moment of collection, who will receive the data and why that transfer is happening.
What to watch for: Any collection flow that defers notice until after submission, hides recipients in generic language, or changes the downstream recipient without updating the notice path. Those are the places where the transparency obligation is most likely to fail.
Related resources from NHI Mgmt Group
- How should organisations structure consent and transparency for digital contact tracing data collection?
- When does just-in-time access help most in DORA evidence collection?
- How can organisations reduce manual effort in access certification and evidence collection?
- How do AI transparency requirements change when systems can act autonomously?