Rule 3: Notice given by Data Fiduciary to Data Principal

Rule 3 sets out how a Data Fiduciary (an entity determining the purpose and means of processing personal data) must present a notice to a Data Principal (the individual whose data is being processed) when asking for consent. The notice must stand on its own. It must be understandable without requiring the individual to read any other information that the Data Fiduciary has made available or might make available in the future.

The notice must use clear and plain language to give a fair account of what is needed for the individual to give specific and informed consent. At a minimum, this means the notice must include an itemized description of the personal data being collected. It must also state the specific purposes for processing the data and describe the exact goods, services, or uses that the processing will enable.

Finally, the notice must tell the individual how to manage their consent and rights. It must include a specific communication link to the Data Fiduciary's website or app, along with a description of any other available methods. Through these channels, the individual must be able to withdraw their consent just as easily as they gave it, exercise their rights under the Act, and make a complaint to the Board (the Data Protection Board of India).

Key points

• The notice must be understandable on its own, without relying on other information provided by the Data Fiduciary (a).
• It must use clear and plain language to help the Data Principal give specific and informed consent (b).
• The notice must include an itemized description of the personal data to be processed (b)(i).
• It must state the specific purposes of processing and describe the goods, services, or uses enabled by it (b)(ii).
• The notice must provide a link to a website or app, and describe other means, for the Data Principal to withdraw consent, exercise rights, or complain to the Board (c).
• The process to withdraw consent must be as easy as the process used to give it (c)(i).

Common misreadings

• A Data Fiduciary cannot bury the notice details inside a larger privacy policy or terms of service, because the rule requires the notice to be understandable independently of any other information.
• The notice cannot just state a general purpose; it must provide an itemized description of the data and a specific description of the goods or services provided.