2

A SaaS company offers some services, which require registration. Its clients are notified about Terms of Service and Privacy Policy during the registration process. Should the company send to the client an email according to GDPR Article 13 after the registration? If later the client adds some new personal data to her account info (e.g. profile image), should the company again inform the client about obtained new personal data according to GDPR Article 13?

Improve this question
1
  • 2
    This Q is asking what then law requires. It is not IMO a request for legal advice and should not be closed as such.
    – David Siegel
    Jan 22, 2021 at 16:22

1 Answer 1

Reset to default
4

Art 13 GDPR is about information to be provided when data is collected directly from the data subject. This information can be provided directly during/before collection. It is not generally necessary or useful to send the data subject an email with this information.

Usually, a SaaS website will provide the information under Art 13 as part of their privacy policy, and link it in easy to find places. Also consider the EDPB guidelines on transparency, which suggests a layered approach: in addition to a detailed privacy policy, summarize key information directly when the data is collected, e.g. next to an input form.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .