In simple words
The consent notice must stand on its own, be clear and plain, list the data item by item, explain each purpose and the service, and give a link to withdraw consent, use your rights and complain to the Board.
- What this means for you
- Look for a clear list of what data is collected and why, and a link to withdraw consent.
- What this means for businesses
- Draft an itemised notice with purpose descriptions and working withdrawal and rights links.
- Everyday example
- A food delivery app's notice lists name, phone, address and order history, each with its purpose, and links to a page where you can withdraw consent.
Who it applies to
Data Fiduciaries giving notices under section 5.
Related sections and Schedules
Official textas notified
Source: MeitY copy of the Gazette, page 24. Printed dashes are shown as colons; the wording is unchanged.
The notice given by the Data Fiduciary to the Data Principal shall:
(a) be presented and be understandable independently of any other information that has been, is or may be made available by such Data Fiduciary;
(b) give, in clear and plain language, a fair account of the details necessary to enable the Data Principal to give specific and informed consent for the processing of her personal data, which shall include, at the minimum,
(i) an itemised description of such personal data; and
(ii) the specified purpose or purposes of, and specific description of the goods or services to be provided or uses to be enabled by, such processing; and
(c) give, the particular communication link for accessing the website or app, or both, of such Data Fiduciary, and a description of other means, if any, using which such Data Principal may:
(i) withdraw her consent, with the ease of doing so being comparable to that with which such consent was given;
(ii) exercise her rights under the Act; and
(iii) make a complaint to the Board.