Where data comes from another source, the Controller must give similar notice plus the categories and source of the data within the applicable period, unless a stated exemption applies.
Interpretation and application must be checked against the official text and current version.