Part 4: Intelligence services processing Chapter 3: Rights of data subjects Section 93: Right to information
A controller is required to provide a data subject with specified information about the processing of personal data by the controller. This includes the identity and contact details of the controller, the purposes and legal basis for which personal data may be processed, and information about the data being processed. Such information may be made generally available, for example, through the controller’s website.
	This obligation does not apply if the data subject already has the relevant information. Nor does it apply where data is collected from a third party source (that is, not from the data subject), if the processing is authorised under an enactment, or if providing the information is impossible or would involve disproportionate effort.