A notice under the DPDP Act is the short, plain statement you give a person before you ask them to consent to the use of their personal data.
It is not the same as your privacy policy. A policy describes your practices in general. A notice is tied to a specific request for consent, and it has to tell the person what they are agreeing to, in words they can follow without reading anything else.
This guide explains what the law asks for, how to write each part, and where businesses most often go wrong.
What the law requires
Section 5 of the DPDP Act 2023 says every request for consent must come with, or after, a notice. The notice must explain:
- Which personal data you will process
- The purpose of the processing
- How the person can exercise their rights
- How they can complain to the Data Protection Board
If you collected data before the Act began, you also need to issue a notice as soon as reasonably practicable.
Rule 3 of the DPDP Rules, 2025 sets the standard for how the notice reads. It must be understandable on its own, use plain language, itemise the data, and name the purposes along with the goods, services or uses they enable. It must also give a link or other means to withdraw consent, make rights requests and complain. Withdrawing consent must be as easy as giving it.
The Rules were notified on 13 November 2025, and Rule 3 applies eighteen months after publication, so confirm dates against the official MeitY sources before you plan your rollout.
The five things every notice should cover
- The personal data you collect
- Why you collect it
- The goods, services or uses it enables
- How to withdraw consent
- How to exercise rights or make a complaint
How to write a notice that holds up
Start with data mapping. List what data you collect, where it goes and which vendors touch it. You cannot describe your processing honestly until you know what it is.
Be specific about purposes. "Business purposes" or "to improve your services" tells the reader nothing. Pair each data category with the exact reason you need it.
Keep purposes separate. Don't fold unrelated uses into one consent. If marketing is optional, say so and ask for it separately from what the service needs to work.
Write for the reader. Short sentences, everyday words, no legal shorthand. The notice should make sense even if the person never opens another page of your site.
Match the notice to reality. If your analytics tools, vendors or consent flows differ from what the notice says, the notice is inaccurate, however well it is worded.
Adapt it to the context
A single template rarely fits every setting.
- Websites and apps: show the notice at the point of collection, not only in the footer.
- E-commerce: cover order, payment, delivery and marketing data as separate purposes.
- HR and employee data: explain what you collect for hiring, payroll and compliance, and why.
- Children's data: the Rules call for verifiable parental consent, so the notice must work for the parent as well as the child.
Common mistakes
- Copying a generic template without checking it against your systems
- Listing broad data categories instead of itemising them
- Making withdrawal harder than giving consent
- Treating the notice as a one-time task
Keep the notice current
Review your notice whenever your data, purposes, products, vendors or consent mechanisms change. Assign one owner for updates, so the notice never falls behind the product.
A quick compliance check:
- Data mapped to purposes
- Each purpose stated in plain, specific words
- Optional uses separated from required ones
- Withdrawal as easy as consent
- Links for rights requests and complaints included
- Notice matches your actual systems and vendors
A notice is one part of a wider compliance framework, alongside consent management, rights handling and security safeguards. Get it right first, because everything else builds on what you have told people.
Tags : .....
