The classic trap
Recital 61 clarifies articles 13 and 14 on the timing of information. The CNPD and CNIL regularly sanction two practices: information delivered too late (legal notice buried in a welcome email sent 48 hours after collection) and total absence of information when the purpose changes. When you buy a prospect file, enrich your customer data via a broker, or reuse CRM data to train an AI model, recital 61 requires proactive information before that further processing, not after.
The four critical moments when information must be delivered
- Direct collection: at the very moment the person enters their data (web form, contract, recorded phone call), without an extra click to access the notice.
- Indirect collection: within a reasonable period, and at the latest one month after obtaining the data (article 14(3)(a)), or upon first communication with the person if sooner.
- First disclosure to a new recipient: inform the person at the time their data is transmitted for the first time to that recipient (bank to debt collector, HR to health insurer).
- Purpose change: before further processing, provide a new information notice on the new purpose and associated legal basis (article 6(4)).
Multiple sources: the blind spot of data-driven organisations
Recital 61 provides that if the origin of the data cannot be traced because multiple sources were used (data lake, progressive enrichment via several brokers, scoring built on 10 connectors), general information is sufficient. But beware: this tolerance is not a blank cheque. The EDPB (guidelines 1/2022 on data subject rights) considers that you must still document the categories of sources, and that the 'multiple sources' argument does not hold if you have the technical means to trace the origin.
How Luxgap automates this risk
Our Luxgap Notice Timing Sentinel eliminates the blind spot of when to inform by continuously monitoring your data flows and automatically triggering the right notice at the right moment. The tool plugs an AI agent into your collection systems (HubSpot, Salesforce, Odoo CRM, M365 Forms, Typeform), your enrichers (B2B brokers, LinkedIn Sales Navigator, Dun & Bradstreet) and your analytical pipelines (Snowflake, BigQuery, Azure Synapse) to detect every recital 61 trigger event.
- Automatically detects each new source of personal data added to your IS (new form, new API connector, new imported file) and identifies whether it is direct or indirect.
- Triggers in real time the dispatch of article 14 information by email, SMS or in-app notification within the reasonable period of recital 61, with cryptographic timestamping of the dispatch proof.
- Monitors purpose changes through semantic analysis of new processing operations declared in your article 30 register and alerts the DPO before the further processing starts.
- Automatically generates the 'multiple sources' notice with traceable origin categories, compliant with EDPB guidelines 1/2022.
- Produces a timestamped audit log, opposable to the CNPD during an inspection, demonstrating that each person received the information at the right moment.
- Alerts via Teams or Slack as soon as a new recipient is added to an existing flow, to trigger the first-disclosure notification.
Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS brick depending on your scope. Request your demonstration and our teams will prepare a proof of value within 48h on your real flows, with a free scan that reveals how many of your indirect collections are currently out of deadline.
