Obligation
A notice is the clear, itemised information a Data Fiduciary must give before or with any request for consent, setting out what data, why, and how to exercise rights and complain.
Every request made to a Data Principal under section 6 for consent shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal, informing her, (i) the personal data and the purpose for which the same is proposed to be processed; (ii) the manner in which she may exercise her rights; and (iii) the manner in which the Data Principal may make a complaint to the Board.
Notice is the transparency step before consent. It must state the data sought, the purpose, how to exercise rights, and how to complain to the Board.
It has to be in clear, plain language, available in English or any language in the Eighth Schedule to the Constitution. The Rules set out its standalone, itemised form.
Before a banking app asks you to consent to KYC processing, it must show a notice describing the data it will take and why.
When must notice be given?
With or before any request for consent under Section 6. For pre-Act consent, notice must follow as soon as reasonably practicable.
What must a notice contain?
The personal data and purpose, how to exercise your rights, and how to complain to the Board.