Privacy notice
DPDP Privacy Policy and Notice: What Rule 3 Requires
By Kaivan Tech · Published 4 November 2026 · Updated 4 November 2026 · Checked against the official Act and Rules
Short answer
A DPDP-compliant privacy notice must stand on its own in clear, plain language and give an itemised description of the personal data collected, the specific purposes and the goods, services or uses they enable, and a link and other means to withdraw consent as easily as it was given, exercise rights and complain to the Data Protection Board (Section 5 and Rule 3). It must be available in English or any Eighth Schedule language.
- Legal basis
- Section 5 of the Act and Rule 3 of the DPDP Rules, 2025
- When
- With or before every request for consent
- Languages
- English or any language in the Eighth Schedule (Section 5(3))
- Applies from
- 13 May 2027
What the notice must contain
Section 5(1) and Rule 3 together require the notice to include at least:
| Requirement | Source |
|---|---|
| Understandable on its own, independent of other information | Rule 3(a) |
| Clear and plain language | Rule 3(b) |
| An itemised description of the personal data | Rule 3(b)(i), Section 5(1)(i) |
| The specified purposes, and the goods, services or uses they enable | Rule 3(b)(ii) |
| A link to your website or app, and other means, to withdraw consent as easily as it was given | Rule 3(c)(i), Section 6(4) |
| How to exercise rights under the Act (access, correction, erasure, grievance, nomination) | Rule 3(c)(ii), Sections 11–14 |
| How to make a complaint to the Data Protection Board | Rule 3(c)(iii), Section 5(1)(iii) |
| Option to read it in English or any Eighth Schedule language | Section 5(3) |
Privacy policy vs privacy notice
A privacy policy is a long, general document about all your processing. A DPDP notice is shown at the point of collection, with or before the consent request, and covers the specific data and purpose of that collection. Most websites need both: short notices on each form or sign-up flow, linked to a full policy. Section 8(9) also requires publishing the business contact details of a Data Protection Officer, if applicable, or of a person who can answer questions about processing, and Section 8(10) requires an effective grievance mechanism.
Notice checklist for websites and apps
- One short notice per collection point (contact form, sign-up, checkout, job application)
- Fields listed item by item, with the purpose next to each group of data
- Consent checkbox unticked by default, separate for optional purposes like marketing
- A visible “withdraw consent” link that works as easily as opting in
- Links to the rights request form and the grievance contact
- A sentence on how to complain to the Data Protection Board
- A language switcher for at least English plus the languages your customers use (for example Hindi or Gujarati)
- Version number and date on every notice, stored with each consent record
- For consents given before the Act commenced, a notice sent as soon as reasonably practicable (Section 5(2))
Need this done in your own systems?
Kaivan Tech assesses websites, apps and business systems against the DPDP Act and Rules, then implements the fixes: consent and notice flows, rights workflows, logging, retention and breach readiness.
See our DPDP compliance servicesFrequently asked questions
What must a DPDP privacy notice contain?+
An itemised description of the personal data, the specified purposes and the goods, services or uses they enable, and how to withdraw consent, exercise rights and complain to the Data Protection Board, in clear and plain language that is understandable on its own (Section 5 and Rule 3).
Does the DPDP notice have to be in Hindi or other Indian languages?+
The Data Fiduciary must give the option to access the notice in English or any language specified in the Eighth Schedule to the Constitution (Section 5(3)).
Is a privacy policy enough for DPDP compliance?+
No. You need notices at each point where personal data is collected, valid consent, working withdrawal and rights processes, a grievance mechanism, published contact details and security and retention controls, in addition to a privacy policy.
Do existing customers need a new notice?+
Yes. Where consent was given before the Act commenced, Section 5(2) requires the Data Fiduciary to give a notice as soon as reasonably practicable describing the data, purpose, rights and how to complain.
Related guides
Sources
This guide explains the law in general terms and is not legal advice. Have a qualified Indian legal professional confirm how the Act and Rules apply to your organisation.