No. 3 Data Protection before processing the personal data of the data subject. 11 (2) where a data controller seeks consent from a data subject on several matters in the form of a written declaration, each matter on which consent is sought shall be presented in a clearly distinguishable manner. (3) a data subject may, at any time, withdraw consent given to a data controller and the withdrawal of the consent shall, where practicable, be in the same manner the consent was provided. (4) where a data subject withdraws consent in accordance with subsection (3), the withdrawal shall not affect the legality of the data processing that occurred before the withdrawal of the consent. (5) where a question arises on whether consent was freely provided, consideration shall be taken of whether the performance of a contract between the data controller and the data subject or the delivery of a good or a service by the data controller to the data subject is conditional on provision of the consent. 15.__(1) a data controller who collects personal data from a data subject shall, at the time of collecting the data, provide the following information to the data subject— (a) the identity and contact details of the data controller or representative of the data controller; Provision of information to a data subject (b) the legal basis for processing the personal data; (c) the purpose for processing the personal data; (d) where possible, the storage period for the personal data; (e) the existence of automated decision-making, including profiling; (f) the rights of the data subject provided under Part IV; (g) the right to lodge a complaint with the authority under section 44; and (h) whether the data controller intends to transfer the personal data to a place outside Malawi. (2) where a data controller obtains personal data of a data subject from a person other than the data subject, in accordance with any of the grounds under section 8(2)(b), the data controller shall, within fourteen days of obtaining the personal data, provide the information specified in subsection (1) to the data subject. 16.__(1) a data controller and data processor shall not process sensitive personal data of a data subject unless— Processing of sensitive personal data