Collection is the obtaining of personal data about a person and at the same time the first step of any processing.
Collection from the data subject and from other sources
Where data is collected directly, it comes from the data subject themselves, for example through a form or in conversation. Where it is collected from third parties, it comes from other sources, for example credit agencies, business partners or public directories.
Different information obligations apply depending on the situation: for direct collection at the time the data is obtained, for collection from other sources within a reasonable period, at the latest after one month.
What already applies at the point of collection
The purpose and legal basis must already be established when the data is collected. Only the data necessary for that purpose may be collected.
Legal provisions
- Art. 4(2) GDPR
- Collection as a form of processing.
- Art. 5(1)(b) and (c) GDPR
- Purpose limitation and data minimisation.
- Arts. 13 and 14 GDPR
- Information obligations for direct collection and collection from other sources.
Related terms.
Processing of personal data Processing is any operation performed on personal data, from collection through storage and use to erasure. Art. 4(2) GDPR 
Information obligations Information obligations require controllers to inform data subjects transparently about who processes their data, for what purpose and on what basis. Art. 12 GDPR Data minimisation Data minimisation is the principle that only as much personal data may be processed as is necessary for the purpose in question. Art. 5(1)(c) GDPR
All terms from A to Z Information obligations Information obligations require controllers to inform data subjects transparently about who processes their data, for what purpose and on what basis. Art. 12 GDPR Data minimisation Data minimisation is the principle that only as much personal data may be processed as is necessary for the purpose in question. Art. 5(1)(c) GDPR 