Rule 3 — Notice Given by Data Fiduciary to Data Principal

Section 5 of the Act requires a Data Fiduciary to give the Data Principal notice before or at the time of seeking consent, but leaves what that notice actually has to contain to the Rules. Rule 3 is that content requirement, and it reads less like a checklist and more like three independent tests a notice has to clear at once: it has to stand on its own, say something specific in plain language, and hand the reader a working way to act on what she just read. A notice can be long and still fail all three.

Standalone — Rule 3(a)

The notice has to "be presented and be understandable independently of any other information that has been, is or may be made available by such Data Fiduciary." In practice, that rules out leaning on a separate privacy policy or terms-of-service document to carry the substance of what the notice is supposed to say. A line like "see our Privacy Policy for details" doesn't satisfy Rule 3(a) — it outsources understanding to a document the Data Principal isn't reading at the moment she's asked to consent, which is exactly the moment Rule 3(a) is concerned with.

Clear and plain, with a floor on content — Rule 3(b)

The notice has to give, in clear and plain language, a fair account of what the Data Principal needs to give specific and informed consent — and Rule 3(b) sets a floor under that: at minimum, an itemised description of the personal data being processed, and the specified purpose or purposes of that processing along with a specific description of the goods, services, or uses it enables. A line like "information may be used to improve our services" fails this test on both counts — it names no data and no purpose, so there's nothing concrete for the Data Principal to actually consent to.

Actionable — Rule 3(c)

The notice has to give the specific communication link for the Data Fiduciary's website or app, or a description of other means, through which the Data Principal can withdraw her consent — with the ease of withdrawal comparable to the ease with which she gave it — exercise her rights under the Act, and make a complaint to the Board. This is the sub-clause most notices fall down on: a one-click "I agree" paired with a multi-step withdrawal process, or a withdrawal path that only exists inside a separate settings page nobody links to from the notice itself, doesn't meet the comparable-ease standard the rule sets.

Why this matters in practice

Rule 3 shifts scrutiny away from the consent button and onto the notice that sits behind it. A regulator reviewing a consent flow isn't primarily asking whether a checkbox was ticked — a ticked checkbox with a defective notice behind it is still a defective consent, because Section 6(1) of the Act ties valid consent to notice that meets Section 5's standard, and Rule 3 is what defines that standard in operational terms. The three tests also interact: a notice can be perfectly standalone and still fail 3(b) by being vague about purpose, or nail 3(b)'s specificity and still fail 3(c) by making withdrawal harder than consent.

Illustration: a fitness app's sign-up screen shows a single checkbox reading "I agree to the Terms and Conditions and Privacy Policy," linking out to two separate documents. Even if a user reads both documents in full, the checkbox screen itself isn't a Rule 3-compliant notice — it's neither standalone (3(a), since the substance sits in linked-out documents) nor itemised on data and purpose at the point of consent (3(b)). A compliant version would state, on that same screen, what data is collected (health metrics, location during workouts), the specific purpose (personalised training plans), and a direct link to withdraw consent and reach the Board.

How Rule 3 connects to the rest of the Rules and the Act

Rule 3 operationalises Section 5's notice requirement and feeds directly into Section 6(1)'s definition of valid consent — consent given in response to a defective notice doesn't meet the Act's standard regardless of how it was clicked. It also sits in the same eighteen-month commencement tier as most of the Rules' substantive obligations, per Rule 1(4), so it isn't binding yet — but the notice architecture it describes takes real redesign work, which is a reason to start before the deadline rather than at it.