; (7) the specific steps an individual may take to minimize the collection or processing by the covered entity of the individual's personal data, and the relevant implications to the individual from minimizing such collection or processing; and (8) the effective date of the privacy policy. (d) Exceptions A covered entity shall not be required to make available a privacy policy under this subsection with respect to the collection or processing of personal data that is reasonably necessary and limited to— (1) an in-person transaction where the personal data is not processed for further purposes incompatible with that transaction; (2) comply a Federal, State, or local law or another applicable legal requirement, including a subpoena, summons, or other properly executed compulsory process; (3) prevent imminent danger to the personal safety of any individual; or (4) protect the rights or data security of the covered entity, a service provider of the covered entity, or any individual, including to investigate a possible crime or to protect against security threats, abuse, fraud, theft, unauthorized transactions, or any other unlawful activity. (e) Material changes (1) In general A covered entity, upon any material change to the privacy policy of the covered entity or a material change to the privacy policy of a service provider that is made at the direction of the covered entity— (A) shall notify each individual whose personal data is collected or processed by the covered entity, or a service provider on behalf of the covered entity, with a description of the material change, including— (i) change to the categories of personal data the covered entity or service provider processes; (ii) change to the purposes for which the covered entity or service provider processes personal data; (iii) change to the manner in which the covered entity or service provider discloses personal data to third parties; and (iv) which, if any, changes are retroactive