The information is owed at the time the data is obtained, which means the notice has to exist before the first person is assessed.
Why it matters when the plan changes
Transparency is where abstract compliance meets a real person reading a real notice. A participant in an assessment is entitled to understand what is being measured, who will see the result and what it may be used for. Most disputes about assessment at work begin not with the processing itself but with someone discovering a use they were never told about. The obligation exists to close that gap before the first assessment takes place.
The tension is between completeness and comprehension. A notice that lists every legal element in dense prose satisfies the letter and defeats the purpose, because nobody reads it. The obligation asks for information that is concise, intelligible and accessible, which is a writing problem as much as a legal one. For systems informing decisions about people, the duty extends further, covering the existence of that processing and the logic involved.
In practice
Employees complete an assessment after reading a notice that describes team development. Eighteen months later results are used to inform a restructuring. The processing may be compatible with the original purpose or it may not, but the people involved were never told it was possible, and their reaction is what the transparency obligation exists to prevent.
Evidence
At the time data is obtained, the controller must provide the person with the required information about the processing.
Article 13, General Data Protection Regulation (2016)High-risk systems must operate transparently enough for those deploying them to interpret the output and use it appropriately.
Article 13, European Union Artificial Intelligence Act (2024)
What it cannot tell you
The transparency obligation tells a person what will happen to their data; it does not guarantee they will read, understand or act on the notice. It is silent on whether the processing itself is fair, proportionate or accurate, and satisfying it does not make a decision lawful or a system reliable.
Questions
Who the controller is, the purposes and legal basis, who will receive the data, how long it is kept, and their rights. Article 13 of the General Data Protection Regulation (2016) requires this information at the time data is obtained, not afterwards, when decisions are informed by the results.
The employer, as controller. A supplier can and should provide an accurate description of its processing for inclusion, but the notice has to describe the employer's purposes and the employer's uses of the results, which the supplier does not decide.
It means meaningful information about the logic involved and its significance for the person, in language they understand. The European Union Artificial Intelligence Act (2024) requires high-risk systems to be transparent enough for deployers to interpret outputs, not disclosure of source code or scoring keys.
If the new purpose is compatible with the original, the person must still be informed before the further processing. If it is not compatible, it needs its own basis as well. Either way, using results for something participants were never told about is where most complaints begin.
Ask a participant, after reading the notice, to say what is being measured, who will see it and what it may be used for. If they cannot, the notice has failed regardless of its legal completeness. Comprehension is the standard the obligation actually sets.