Personal Data Protection Act, No. 9 of 2022 60 4. Where the personal data of the data subject has been obtained other than through a direct interaction with the data subject, the controller shall provide the data subject, the source from which the personal data originate, and whether or not it came from publicly accessible source, where applicable in addition to the information required under item 1 of this Schedule. 5. Where the personal data of the data subject has been obtained other than through a direct interaction with the data subject, the controller shall provide the information under items 1 and 4 of this Schedule – (a) within a reasonable period of time after obtaining the personal data, but at least within one month, having regard to the specific circumstances in which the personal data is processed; (b) if the personal data is to be used for communication with the data subject, at least at the time of the first communication to that data subject; or (c) if a disclosure to another recipient is envisaged, at least when the personal data is first disclosed. 6. Items 1 to 4 of this Schedule shall not apply where – (a) the controller has established the fact that the data subject has already been provided with or made aware of the information; or (b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archival purposes in the public interest in the manner provided for by any written law, scientific research, historical research or statistical research purposes, subject to the conditions and safeguards provided in this Act or in so far as the obligation referred to in item 1 of this Schedule is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the rights and freedoms of data subject protected under any written law, including making the relevant information publicly available; or