Rule 9: Contact information of person to answer questions about processing

Rule 9 requires every Data Fiduciary (the entity that decides how and why personal data is processed) to provide specific contact information so that a Data Principal (the individual to whom the data relates) can ask questions about how their personal data is being handled. The Data Fiduciary must share the business contact information of its Data Protection Officer, if it is required to have one. If it does not have a Data Protection Officer, it must provide the contact details of another person who is capable of answering questions on behalf of the Data Fiduciary regarding the processing of personal data. This contact information must be prominently published on the Data Fiduciary's website or app. Additionally, the Data Fiduciary must include these contact details in every response it sends when a Data Principal communicates to exercise their rights under the Act.

Key points

• A Data Fiduciary must provide business contact information for someone who can answer questions about personal data processing.
• This person must be the Data Protection Officer, if applicable, or another capable representative.
• The contact information must be prominently published on the Data Fiduciary's website or app.
• The contact information must also be included in every response to a Data Principal exercising their rights under the Act.

Common misreadings

• Assuming every Data Fiduciary must appoint a Data Protection Officer to fulfill this rule; the rule allows for another person to answer questions if a Data Protection Officer is not applicable.
• Believing that just publishing the contact information on a website is enough; it must also be included in every response to a Data Principal exercising their rights.