Rule 3: Notice Given by Data Fiduciary to Data Principal

Quick summary

What Rule 3 says

• The notice must be presented and understandable independently of any other information the Data Fiduciary has made, is making, or may make available — it can't rely on a separate privacy policy to fill the gaps.
• It must give, in clear and plain language, a fair account of the details needed for specific and informed consent, including at minimum: an itemised description of the personal data being collected, and the specific purpose(s) of, and description of the goods/services enabled by, that processing.
• It must give a particular communication link (website or app) for accessing the Data Fiduciary, plus a description of any other means available, through which the Data Principal may: withdraw her consent as easily as she gave it, exercise her rights under the Act, and make a complaint to the Board.

Breaking it down

Three requirements do most of the work here, and each is a common place compliance falls short:

“Stands on its own” rules out a common shortcut. A notice that says “see our Privacy Policy for details” and leaves the actual itemised data list and purposes to that separate document does not meet Rule 3 — the notice itself must be understandable without needing to read something else.

“Itemised” means a specific list, not a category. “We may collect data you provide” is not itemised. “We collect your name, mobile number, delivery address and order history” is. The purpose has to be similarly specific — “to improve our services” is the kind of vague purpose regulators around the world have pushed back on; “to process and deliver your order, and to send delivery-status updates” is specific.

Withdrawal has to be as easy as consent. If signing up took one tap, withdrawing consent that took five steps through a buried settings menu would likely fail this test. The Rules explicitly compare the two: withdrawal should be comparable in ease to how consent was given.

Why this rule matters

Notice is the foundation everything else sits on. If a notice doesn't meet Rule 3, the consent collected alongside it is built on a defective foundation — which is exactly the kind of gap a regulator, or a class of affected users, would look for first.

Real-world example

Who needs to care about this rule

• Product and UX teams designing signup, checkout and consent-collection flows.
• Legal and privacy teams drafting notice copy that has to be both accurate and plain-language.
• Marketing teams collecting data through lead forms or campaigns.

Common questions

Related rules