Section 12
Deemed consent by notification
of Personal Data Protection Order, 2025
(1)
Subject to subsection (2), an individual is deemed to consent to the collection, use or disclosure of personal data about the individual by an organisation if -
(a} the organisation satisfies the requirements in subsection (3); and
(b)
the individual does not notify the organisation, before the expiry of the period mentioned in subsection (3)(b}(iii), that the individual does not consent to the proposed collection, use or disclosure of the personal data by the organisation.
(2)
Subsection (1) does not apply to the collection, use or disclosure of personal data about the individual for the purpose of sending a direct marketing message.
(3)
For the purposes of subsection (1)(a}, the organisation shall, before collecting, using or disclosing any personal data about the individual -
21
(a} conduct an assessment to determine that the proposed collection, use or disclosure of the personal data is not likely to have an adverse effect on the individual; and
(b)
take reasonable steps to bring the following information to the attention of the individual -
(i)
the organisation's intention to collect, use or disclose the personal data;
(ii)
the purpose for which the personal data will be collected, used or disclosed;
(iii)
a reasonable period within which, and a reasonable manner by which, the individual may notify the organisation that the individual does not consent to the organisation's proposed collection, use or disclosure of the personal data.
(4)
The organisation shall, in respect of the assessment mentioned m subsection (3){a}-
fa} identify any adverse effect that the proposed collection, use or disclosure of the personal data for the relevant purpose is likely to have on the individual;
{b) identify and implement reasonable measures -
(i)
to eliminate the adverse effect;
(ii)
to reduce the likelihood that the adverse effect will occur; or
(iii)
to mitigate the adverse effect; and
{c) comply with any other prescribed requirements.