Writing a DPDP privacy notice: the Rule 3 checklist

Most privacy policies are written to protect the company, not to inform anyone. The DPDP Act flips that: a notice exists so that a person can make an informed decision. If it fails at that, the consent that follows can fail too.

The legal basis

• Section 5 requires a notice at or before the time you ask for consent.
• Rule 3 of the DPDP Rules, 2025 (applicable from 13 May 2027) sets the standard: the notice must be independent of other information, understandable on its own, and in clear and plain language.

What the notice must contain

Under Rule 3, the notice must give, at a minimum:

1. An itemised description of the personal data you’ll process. Not “information you provide”, but “name, mobile number, delivery address”.
2. The specified purpose for each use, with a description of the goods, services or uses it enables.
3. A link or way to withdraw consent, as easy as giving it.
4. How to exercise rights (access, correction, erasure, nomination).
5. How to make a complaint to the Data Protection Board.

Standalone means standalone

A notice buried in clause 27 of your terms of service fails the “independent” test. Show it as a separate page, panel or screen, and link it at the point of consent.

Language

Section 5(3) gives people the option to read the notice in English or any language in the Eighth Schedule to the Constitution. Start with the languages your users actually use. A business in Tamil Nadu might offer Tamil; a national app might add Hindi, Bengali, Marathi and Telugu.

Existing customers

If people gave consent before the Act commenced, section 5(2) requires you to send them a notice as soon as reasonably practicable. You can keep processing until they withdraw consent. Plan this as a project: email, in-app banners and SMS.

Checklist

• ☐ Is the notice a separate document or screen?
• ☐ Does it list each data item, not just categories?
• ☐ Does each purpose map to the data it needs?
• ☐ Is there a working withdrawal link?
• ☐ Does it explain access, correction, erasure and nomination?
• ☐ Does it name the grievance contact and response time?
• ☐ Does it mention the right to complain to the Data Protection Board?
• ☐ Is it available in the languages your users read?
• ☐ Can a 15-year-old understand it? (Plain language is a good test, even though your users are adults.)
• ☐ Is there a version number and date, so you can prove what each person saw?

Good practice beyond the minimum

• Say which processors handle the data and whether it leaves India.
• Say how long you keep each type of data.
• Explain your security measures in plain words.
• Commit to breach notification.

These aren’t all mandatory in Rule 3, but they build trust and make your consent harder to challenge.

Go deeper

Our courses include a notice-drafting workshop with templates. Browse the courses.

This article is for education and is not legal advice.