RULE 4 – Notice to inform of processing done where data principal has given consent before commencement of Act
u/s 5(2)
| No | Description |
| 1 | Where a Data Principal has given her consent for the processing of her personal data before the commencement of the Act, the data fiduciary shall as soon as it is reasonably practicable, give to the Data Principal a notice, in the following manner, namely:- |
| (a)The notice shall be made in like manner as is provided for a notice to seek consent and shall be understandable independently of any other information that has been made available by such data fiduciary; and | |
| (b)The notice shall inform, in clear and plain language, the details necessary to enable her to exercise the Rights of the Data Principal, including- (i) Such minimum details as are required in respect of a Notice to seek consent; and (ii) description of the goods or services (including the offering of any service) that were provided or the users that were enabled, as a result of such processing | |
| 2 | A Data Fiduciary may use a Consent Artifact for the purpose of giving the notice to inform of processing done. |
Compliance Checklist — Rule 4 (Processing with Prior Consent)
- Data Principal is informed about processing done before commencement of the Act
- Notice is provided as soon as reasonably practicable
- Notice format is consistent with Rule 3 (clear, standalone, understandable)
- Details of previously processed personal data are clearly disclosed
- Purpose of prior data processing is clearly explained
- Rights of the Data Principal are communicated effectively
- Consent artifacts (if used) are properly maintained and documented