gdpr privacy personal-information
Should the client be informed every time when more personal data is requested under GDPR Article 13?
<p>A SaaS company offers some services, which require registration. Its clients are notified about Terms of Service and  Privacy Policy during the registration process.
Should the company send to the client an email according to GDPR Article 13 after the registration?
If later the client adds some new personal data to her account info (e.g. profile image), should the company again inform the client about obtained new personal data according to GDPR Article 13?</p>

<p>Art 13 GDPR is about information to be provided when data is collected directly from the data subject. This information can be provided directly during/before collection. It is not generally necessary or useful to send the data subject an email with this information.</p>
<p>Usually, a SaaS website will provide the information under Art 13 as part of their privacy policy, and link it in easy to find places. Also consider the <a href="https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227" rel="nofollow noreferrer">EDPB guidelines on transparency</a>, which suggests a layered approach: in addition to a detailed privacy policy, summarize key information directly when the data is collected, e.g. next to an input form.</p>
