A controller shall provide each consumer with a reasonably accessible and clear privacy notice that includes:

(1) The categories of personal data processed by the controller, including, if applicable, any sensitive data processed by the controller;

(2) The purpose for processing personal data;

(3) How a consumer may exercise a consumer right under sections 87-1107 to 87-1111, including the process by which a consumer may appeal a controller's decision with regard to the consumer's request;

(4) If applicable, any category of personal data that the controller shares with any third party;

(5) If applicable, any category of third party with whom the controller shares personal data; and

(6) A description of each method required under section 87-1111 through which a consumer may submit a request to exercise a consumer right under the Data Privacy Act.