Notice At Collection

Expanded Definition

Notice at collection is a privacy disclosure that must be presented before or at the moment personal information is gathered. It tells individuals what categories of data are being collected, the business purpose, whether the data may be sold or shared, and any other disclosures required by applicable law. In NHI and agentic AI environments, the same principle applies to system-generated collection points, such as telemetry, prompts, API event data, and service-account activity records, where transparency determines whether downstream processing is lawful and defensible.

Definitions vary across jurisdictions and privacy regimes, but the operational purpose is consistent: create an informed decision point before data flows into storage, analytics, or automation. This is distinct from a privacy policy, which is broader and often static, and from consent, which may be a separate legal basis depending on the framework. For program design, NIST Cybersecurity Framework 2.0 reinforces the need for transparent governance and traceable data handling, even when notice obligations come from privacy law rather than security standards. The most common misapplication is treating a generic website privacy policy as sufficient notice, which occurs when collection happens through embedded forms, APIs, or embedded agents without a point-of-collection disclosure.

Examples and Use Cases

Implementing notice at collection rigorously often introduces user-experience and engineering constraints, requiring organisations to balance legal completeness against friction at every intake point.

• A SaaS onboarding form displays a short notice before account creation, explaining the data fields collected, retention period, and whether data is shared with processors.
• An AI assistant logs prompt content and tool outputs only after showing a notice that clarifies collection for quality, security, or model improvement purposes.
• A mobile app provides notice before location or device telemetry is captured, making clear whether the data supports fraud detection, analytics, or personalisation.
• A business-to-business workflow using service accounts records API activity after publishing an internal notice describing what operational metadata is collected and why.
• A breach investigation confirms that a vendor forgot to present notice at a hidden collection point, echoing the operational exposure seen in the Schneider Electric credentials breach where identity and access controls became central to the response.

For implementation guidance, teams often align notice language with the data inventory, retention schedule, and purpose registry, so the disclosure reflects actual processing rather than marketing copy. That alignment is especially important when collection is indirect, such as via logs, telemetry, or third-party embedded services.

Why It Matters in NHI Security

Notice at collection matters in NHI security because autonomous systems and service identities often generate or forward personal data without a human reading the surrounding interface. When collection points are opaque, organisations lose the ability to prove lawful processing, explain data purpose, or constrain secondary use. In practice, weak notice design also hides where identity-adjacent data enters pipelines, making secrets, logs, and event streams harder to govern. NHI Management Group research shows that 79% of organisations have experienced secrets leaks, with 77% of those incidents resulting in tangible damage, a reminder that poor visibility at collection time can cascade into broader operational exposure.

Good notice practice supports accountability across privacy, security, and governance. It helps teams document what an agent collects, who can access it, and whether it is retained for troubleshooting, compliance, or model training. That is why privacy disclosure should be treated as part of the control surface, not as a legal footnote. Organisational failures typically surface after a complaint, audit, or incident review, at which point notice at collection becomes operationally unavoidable to correct.

Related resources from NHI Mgmt Group

• When does just-in-time access help most in DORA evidence collection?
• How can organisations reduce manual effort in access certification and evidence collection?
• Why do tags matter in SOC 2 evidence collection?
• Who should own SOC 2 evidence collection and remediation?