A controller materially expands processing from account administration into behavioural advertising but never updates the privacy notice or otherwise informs data subjects. What ongoing transparency duty is breached?

Transparency is continuous. When purposes or processing operations change materially, controllers should provide updated information consistent with Articles 12–14 and purpose-limitation principles before or as the new processing proceeds. Vague original wording, waiting for enforcement, or assuming account creation ends notice duties does not justify silence about behavioural advertising expansions.