„We are a small company; only large players receive penalties."
Are you sure about that?
Article 4 PDPA
Direct acquisition of personal data Exemption from information
1. To the extent not regulated by Article 14 (5) of Regulation 2016/679, an administrator performing a public task shall not provide the information referred to in Article 14 (1), (2) and (4) of Regulation 2016/679, if it serves the performance of a public task and the failure to perform the obligation referred to in Article 14 (1), (2) and (4) of Regulation 2016/679 is necessary to achieve the purposes referred to in Article 23 (1) of the Regulation, and the provision of such information:
1) will prevent or significantly impede the proper performance of a public task, and the interest or fundamental rights or freedoms of the data subject are not overridden by the interest resulting from the performance of that public task, or
2) will violate the protection of classified information.
2. In the case referred to in paragraph 1, the controller shall provide appropriate measures to protect the interest or fundamental rights and freedoms of the data subject.
3. The controller is obliged to inform the data subject, upon request, without undue delay, but no later than one month from the date of receipt of the request, of the grounds for failure to provide the information referred to in Article 14 (1), (2) and (4) of Regulation 2016/679.
