See also Recital 50 GDPR: “ [...] In any case, the application of the principles set out in this Regulation […] should be ensured […] ”. As to the information obligation, this is confirmed for ‘further processing’ in Article 13(3) GDPR.