The controller must provide data subjects with crucial information when collecting personal data, including their identity, contact details, and the purposes and legal basis for processing. This includes detailing any legitimate interests, categories of recipients, and any intent to transfer data internationally along with the applicable safeguards.

Additionally, to ensure fair processing, the controller should communicate the data retention period, rights to access or erase data, and the existence of any automated decision-making. If data is to be processed for a new purpose, further information must be disclosed, unless the data subject is already informed.