Module 2 of 9Section 56 min including the detail
Notice
Notice is the first duty in the Act and the one most often failed by organisations that believe they have a privacy policy and are therefore finished.
It is given at or before collection, every time
Every route personal data enters your organisation needs a notice at that moment. Most organisations cover the web form and miss the rest.
Routes people forget
- A call centre script
- A bulk import from a partner
- A QR code at a reception desk
- A paper form that gets scanned
- A kiosk or a tablet in a branch
The detail, if you want it
The notice must be given to the person at or before the moment their data is collected. Not on first login, not in an onboarding email a day later, and not only in a policy linked from a footer. Every route by which personal data enters your organisation needs one, including the routes that are not a web form: a call centre script, a bulk import from a partner, a QR code at a reception desk.
It has to be itemised, not general
The test is whether a reader could write a list: this field, for this reason. A sentence about improving services is not a notice.
Find the faults
This notice looks completely normal. Four things are wrong with it.
Tap the underlined phrases. 0 of 4 found.
Create your account
We collect your information to and personalise the offers we show you.
of how we handle your data.
to our terms and to receive updates from us and our partners.
about your data.
The detail, if you want it
The notice must describe the specific personal data being collected and the specific purpose for which it will be processed. A sentence saying you collect information to improve your services does not meet this. The working test is whether a reader could produce a list: this field, for this reason.
It must also tell the person three things they can do. How to withdraw consent. How to exercise their rights. How to complain to the Data Protection Board. All three belong in the notice itself, not in a separate document you could link to.
Language is the person's choice
English plus any Eighth Schedule language, at the person's option. Not at yours.
in the Eighth Schedule, any of which a person may ask for
The obligation is triggered by their choice, not by a market decision about which are worth supporting.
The detail, if you want it
The notice must be available in English and in any language in the Eighth Schedule to the Constitution, at the person's option. There are twenty-two of those. The obligation is triggered by the person's choice, not by a market decision about which languages are worth supporting.
There is also a duty about the past. Where you already hold data collected under consent obtained before the Act, notice has to be given as soon as reasonably practicable. Existing records are not grandfathered, and this is the item organisations miss most completely, because the work does not arise from any new collection.
The three things to remember
- Notice is given at or before collection, on every route in, including phone calls and bulk imports.
- It must itemise: this field, for this purpose. A statement about improving services is not a notice.
- Data you held before the Act needs notice too, as soon as reasonably practicable.
What good looks like
Evidence you could put in front of an auditor, not a policy statement.
- A dated screenshot of the notice at every single collection point, including offline and imported routes.
- The notice text next to a field-by-field mapping of data item to purpose.
- A record of the notice sent to people whose data you held before the Act commenced.
Check what you took in
2 questions, and getting both right completes the module. Nothing is sent to us.
Educational, not legal advice. This module describes what the Act requires of organisations generally; it does not advise on your own circumstances. DPDP Act, 2023: a working foundation.