Data controllers must continue to provide transparent information to data subjects.
This must be done at the time the personal data is obtained. However, existing forms of fair processing notice will have to be re-examined as the requirements in the GDPR are much more detailed than those in the current Directive. For example, the information to be provided is more comprehensive and must inform the data subject of certain of their rights (such as the ability to withdraw consent) and the period for which the data will be stored.
Controllers will need to consider their forms of fair processing notice with these new obligations in mind, and check in that they are providing the information in a clear way and in an easily accessible format.