Help Center/ Well-Architected Framework/ Well-Architected Framework and Practices/ Security Pillar/ Data Security and Privacy Protection/ SEC08 Data Privacy Protection/ SEC08-02 Proactive Notification to Data Subjects
Updated on 2025-05-22 GMT+08:00
View PDF
Share

SEC08-02 Proactive Notification to Data Subjects

It specifies that the data controller proactively provides data subjects (individuals) with information about data processing activities, such as the data collection purpose, data processing method, data use scope, and data storage period. This notification is usually presented in the form of a privacy policy, user agreement, or prompt message.

  • Risk level

    Medium

  • Key strategies
    • The importance of proactive notification to data subjects is as follows:
      • Transparency and control: Through proactive notification, data subjects can understand how data handlers process their personal data, thereby increasing the transparency and controllability of personal data and enabling them to make informed consent decisions.
      • Compliance: In many privacy protection laws and regulations (such as the GDPR in Europe), proactive notification to data subjects is a legal requirement. Data processors need to provide specific information to data subjects to ensure that data processing activities comply with relevant laws and regulations.
      • Trust building: Data handlers can show their importance to privacy protection to data subjects through proactive notification, thereby building trust relationships.
      • Rights protection: Proactive notification helps protect data subjects' rights, including rights to know, access, and rectification, so that they can exercise their privacy rights.
    • The data controller must provide a privacy statement, which is intended to inform users of the privacy and data protection practices of the product and the options available to users in terms of personal information collection and processing.
    • The privacy statement and personal data description should describe the types, purposes, processing methods, and time limits of all personal data collected by the product.
    • A privacy statement must be provided on the product page to facilitate user access. For example, the link to the privacy statement should be provided on the web page footer.