Before a data controller collects personal data directly from a data subject, the data controller shall inform the data subject of the —

(a) identity, residence or place of business of, and means of communication with the data controller and its representatives, where necessary;

(b) specific lawful basis of processing under Section 025(1) or 30(1) of this Act, and the purposes of the processing for which the personal data are intended;

(c) recipients or categories of recipients of the personal data, if any;

(d) existence of the rights of the data subject under Part VI;

(e) retention period for the personal data;

(f ) right to lodge a complaint with the Commission in accordance with Section 046 (1) of this Act; and

(g) existence of automated decision-making, including profiling, the significance and envisaged consequences of such processing for the data subject, and the right to object to and challenge such processing.