Rule 3
Notice given by Data Fiduciary to Data Principal
Specifies what a notice under Section 5 must contain: a standalone document, an itemised description of the data, and the routes to withdraw consent, exercise rights and complain.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- (a)
- The notice must be presented and be understandable independently of any other information the Data Fiduciary gives or has given.
- (b)
- It must give, in clear and plain language, a fair account of the details necessary for specific and informed consent, including at minimum an itemised description of the personal data and the specified purposes, with a specific description of the goods, services or uses the processing enables.
- (c)
- It must give the communication link for the Data Fiduciary’s website or app, and describe the other means by which the Data Principal may withdraw consent with comparable ease, exercise her rights under the Act, and make a complaint to the Board.
In practice
Clause (a) is the one that fails most existing sites. A notice buried inside a privacy policy is not understandable independently of other information, and clause (b)’s itemised description defeats the usual catch-all list of data categories. In practice this is a separate, purpose-specific document shown at the point of collection, not a link in a footer.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Rule 3 is not in force yet. If that date moves, or the Board says anything about how it will be read, you will get one email about it and nothing else.