Understand the transparency principle and know the key components and purpose of privacy notices, including layered privacy notices.

A car dealership records buyers' contact details directly from them at the point of sale to administer the purchase. Two years later, the marketing team wants to start using those same details for a new purpose, profiling buyers to send tailored offers for accessories. The dealership did not mention this profiling when it first collected the data. Under the GDPR transparency rules, what must the dealership do before beginning the new profiling?

• ANothing further, because the data was originally collected lawfully and the new use is merely a refinement of the existing customer relationship
• BObtain fresh consent from every buyer, because any change of purpose automatically requires consent as the lawful basis
• CUpdate the privacy notice on its website only, since publishing the revised purposes there discharges the obligation to inform existing buyers
• DProvide the buyers with information on that further purpose, and any relevant additional information, before carrying out the new processingcheck_circle Correct

Why A is wrong: This treats compatibility of further processing as removing the transparency duty, but even where a new purpose is permitted the controller must still inform the data subject about it; lawful collection does not waive the notice obligation for a later, different purpose.

Why B is wrong: A change of purpose triggers a transparency duty, not an automatic switch to consent; the controller may have another compatible lawful basis, so consent is not mandated and conflates the lawful-basis question with the notice requirement.

Why C is wrong: A passively published notice does not satisfy the duty to inform individuals of a new purpose; Article 13(3) requires the controller to provide that further-purpose information to the data subjects before the new processing, not merely post it where they may never see it.

Why D is correct: Article 13(3) requires a controller that intends to further process data for a purpose other than the one it was collected for to provide the data subject, prior to that further processing, with information on the new purpose and any relevant further information.