Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsObligation
A notice is the clear, itemised information a Data Fiduciary must give before or with any request for consent, setting out what data, why, and how to exercise rights and complain.
TL;DR
A notice (Section 5) is the clear, itemised information a Data Fiduciary must give before or with any consent request, setting out what data it wants, why, and how to exercise rights and complain. It must be in plain language and available in English or any Eighth Schedule language.
Every request made to a Data Principal under section 6 for consent shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal, informing her, (i) the personal data and the purpose for which the same is proposed to be processed; (ii) the manner in which she may exercise her rights; and (iii) the manner in which the Data Principal may make a complaint to the Board.
Notice is the transparency step before consent. It must state the data sought, the purpose, how to exercise rights, and how to complain to the Board.
It has to be in clear, plain language, available in English or any language in the Eighth Schedule to the Constitution. The Rules set out its standalone, itemised form.
Before a banking app asks you to consent to KYC processing, it must show a notice describing the data it will take and why.
When must notice be given?
With or before any request for consent under Section 6. For pre-Act consent, notice must follow as soon as reasonably practicable.
What must a notice contain?
The personal data and purpose, how to exercise your rights, and how to complain to the Board.
Consultant-led and partner-backed.