Skip to main content

Rule 3: Notice by Data Fiduciary to Data Principal

Rule 3 requires every Data Fiduciary to provide a clear and accessible notice to the Data Principal before processing personal data. The notice must be a separate and easily understandable document, and not hidden within lengthy terms and conditions.

The notice should contain the following information:

  • The categories of personal data that will be collected.
  • The specific purpose for which the personal data is being processed.
  • The contact details of the Data Protection Officer, where appointed, or the person responsible for responding to queries regarding data processing.
  • The manner in which a Data Principal may exercise their rights under the Act, including the right to withdraw consent.

Language and Accessibility
The notice must be provided in clear language that can be easily understood by an average user, avoiding technical or legal jargon.
It must also be available in English and in such languages specified in the Eighth Schedule of the Constitution of India, as may be necessary to ensure accessibility.

This requirement ensures that individuals are informed in advance about how their personal data will be used, enabling them to make a genuine and informed choice.