To process personal data you must comply with the transparency requirements of the General Data Protection Regulations by making certain information available to the person whose personal data you are processing. More guidance on how to do this is available on the Inside Devon website.
It is good practice to present this clearly in writing in the form of a Privacy Notice to the Data Subject/individual. These should include details of how individuals can access their personal information, and who they should write to if they are unhappy about how their personal information has been processed.
There are a number of circumstances where you will be required to collect personal information, and for each circumstance, you should consider the reason that the information is being captured. This should then be clearly explained in your privacy notice.
There are some exceptions when people should not be told their information is being shared, at the time of the sharing if, for example, it would prejudice the prevention or detection of a crime or put someone at increased risk of harm.