A privacy notice under India’s Digital Personal Data Protection (DPDP) framework should identify the personal data being processed, explain the specific purpose, and tell people how to withdraw consent, exercise their rights, and complain to the Data Protection Board. Rule 3 adds that the notice must stand on its own and use clear, plain language—but as of 5 October 2026, Rule 3 has been notified and is scheduled to take effect on 13 May 2027, not yet in force.
What the notice must cover
Rule 3 of the Digital Personal Data Protection Rules, 2025 sets out a five-part minimum content checklist. It requires the notice to provide enough detail for a person to give specific and informed consent.
As an Amazon Associate I earn from qualifying purchases.
- Itemise the personal data. Name the categories or fields the organisation actually processes. A broad label may not tell a person what data is involved.
- State each specific purpose. Explain why the data is processed and what goods, services, or uses are provided through that processing.
- Explain how to withdraw consent. Give a usable method, such as the relevant website or app route. Rule 3 says withdrawal must be as easy as giving consent.
- Explain how to exercise rights. Provide an actionable route for making rights requests under the Act, rather than simply stating that rights are available.
- Explain how to complain to the Board. Tell the person how to bring a complaint to the Data Protection Board of India.
These are requirements specific to Rule 3, not a generic privacy-policy template. The exact data list, purpose wording, and user routes depend on the organisation’s processing.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the Act’s notice baseline says
Section 5 of the DPDP Act requires notice of the personal data proposed to be processed and the purpose of processing. It also requires information on how to exercise the specified rights and how to complain to the Board. The notice must be accessible in English or a language specified in the Constitution’s Eighth Schedule.
#1 Best Overall
The Act also says a notice accompanies or precedes the request for consent. In practice, make the relevant notice available when the person is asked to consent, rather than expecting them to piece together essential information from scattered documents.
When Rule 3 takes effect
The Rules were notified on 14 November 2025, but their commencement is phased. The Gazette says Rules 1, 2 and 17–21 took effect on publication; Rule 4 is scheduled to take effect one year after publication; and Rules 3, 5–16, 22 and 23 are scheduled to take effect 18 months after publication. That makes 13 May 2027 the scheduled start date for Rule 3. As of 5 October 2026, its detailed notice checklist and standalone-presentation requirement are notified but not yet in force. Check the official notification for any later change.
The Gazette is the controlling source for the exact wording and commencement dates: Digital Personal Data Protection Rules, 2025. The government’s summary of the rules and consultation is available from the Press Information Bureau.
Recommended Free Tools
How to make the notice usable
Make it understandable on its own
Rule 3 says the notice must be presented independently and understandable without relying on other information the Data Fiduciary provides or makes available. It calls for clear, plain language and sufficient detail for specific and informed consent. Links can direct a person to the withdrawal, rights-request, or complaint route, but should not force them to assemble the notice’s essential meaning from multiple documents.
Match the consent request to the notice
The Act describes consent as free, specific, informed, unconditional and unambiguous, expressed through clear affirmative action. It also limits consent to personal data necessary for the specified purpose. Keep the request and notice aligned: the data and purposes described should make clear what the person is being asked to agree to.
Provide language access and applicable contact details
Consent requests must use clear and plain language and offer access in English or an Eighth Schedule language. The Act also calls for applicable contact details for a Data Protection Officer or another authorised contact. Withdrawal must be as easy as giving consent.
Quick Recap
A practical review before publishing
- Check that the data items and purposes describe the organisation’s actual processing.
- Confirm that withdrawal, rights requests, and Board complaints each have a stated, reachable route.
- Make the notice available with or before the consent request and keep its essential content understandable without other documents.
- Review language access and applicable Data Protection Officer or authorised-contact details.
- Assess other sector-specific duties separately; this general checklist is not a legal determination for a particular organisation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
