Appendix C – Terms of Order to bring processing operations into compliance, made pursuant to Article 58(2)(d

Action Required Deadline for Compliance

1. Take the action required such that the information prescribed by Article 14 is provided to those non-users whose personal data is being processed by WhatsApp. When doing so, WhatsApp must ensure that the information is provided in a manner that complies with the requirements of Article 12(1), noting the comprehensive assessment, guidance and commentary that has been provided by the Commission in Parts 2 and 3 of this Decision (and, in particular, paragraphs 163, 164, 166 and 167). The period of 3 months, commencing on the day following the date of service of this order

2. Take the action required to provide the information prescribed by Article 13(1)(c) to users, in a manner that complies with Article 12(1), noting the comprehensive assessment, guidance and commentary that has been provided by the Commission in Parts 2 and 3 of the Decision. The information to be provided, in this regard, and the manner in which it should be provided, is detailed in paragraphs 301 to 302 and 325 to 399 and 539 to 592 of this Decision. The period of 3 months, commencing on the day following the date of service of this order

3. Take the action required to provide the information prescribed by Article 13(1)(d) to users, in a manner that complies with Article 12(1), noting the comprehensive assessment, guidance and commentary that has been provided by the Commission in Parts 2 and 3 of the Decision, in particular paragraphs 411 to 416 and 539 to 592 of this Decision. The period of 3 months, commencing on the day following the date of service of this order

4. Take the action required to provide the information prescribed by Article 13(1)(e) to users, in a manner that complies with Article 12(1), noting the comprehensive assessment, guidance and commentary that has been provided by the Commission in Parts 2 and 3 of the Decision. The information to be provided, in this regard, and the manner in which it should be provided, is detailed in paragraphs 422 to 434 and 539 to 592 of this Decision. The period of 3 months, commencing on the day following the date of service of this order

5. Take the action required to provide the information prescribed by Article 13(1)(f) to users, in a manner that complies with Article 12(1), noting the comprehensive assessment, guidance and commentary that has been provided by the Commission in Part 2 of the Decision. The information to be provided, in this regard, and the manner in which it should be provided, is detailed in paragraphs 443 - 457 of this Decision. The period of 3 months, commencing on the day following the date of service of this order

6. Take the action required to provide the information prescribed by Article 13(2)(a) to users, in a manner that complies with Article 12(1), noting the comprehensive assessment, guidance and commentary that has been provided by the Commission in Part 2 of the Decision. The deficiencies to be remedied, in this regard, are detailed in paragraphs 464 – 476 of this Decision. The period of 3 months, commencing on the day following the date of service of this order

6. Take the action required to provide the information prescribed by Article 13(2)(c) to users, in a manner that complies with Article 12(1), noting the comprehensive assessment, guidance and commentary that has been provided by the Commission in Part 2 of the Decision. The deficiencies to be remedied, in this regard, are detailed in paragraphs 486 - 496 of this Decision. The period of 3 months, commencing on the day following the date of service of this order

7. Take the action required to provide the information prescribed by Article 13(2)(e) to users, in a manner that complies with Article 12(1), noting the comprehensive assessment, guidance and commentary that has been provided by the Commission in Part 2 of the Decision and, in particular, paragraphs 507 to 520. The period of 3 months, commencing on the day following the date of service of this order

8. Take the action required to incorporate reference to the existence of the right to lodge a complaint with a supervisory authority in the “How You Exercise Your Rights” section of the Privacy Policy. The period of 3 months, commencing on the day following the date of service of this order