5.2 Principles governing Consent (Art. 2.2(a) NDPR) The following principles shall govern the giving and obtaining of consent: a) Transparency: There must be an explicit privacy policy stating the type of Personal Data collected, how the Personal Data is processed, who processes the Personal Data, the security standard implemented etc.; b) No implied consent: silence, pre-ticked boxes or inactivity do not constitute consent; and c) No bundled consent: consent request from general terms and conditions should be separated from consent request. There must be consent for different types of data uses. 5.3 When Consent is required 5.3.1 Consent is required: a) for any direct marketing activity, except to existing customers of the Data Controllers who have purchased goods or services; b) for the Processing of Sensitive Personal Data; c) for further processing; d) for the processing of the personal data of a minor; e) before personal data is processed in a country which is not in the Whitelist of Countries published by NITDA from time to time. f) before the Data Controller makes a decision based solely on automated Processing which produces legal effects concerning or significantly affecting the Data Subject. 5.3.2 Special category / higher standard consent: Explicit consent is required for the processing of sensitive personal data. 12 | P a g e