DPDP privacy notice: what Rule 3 requires, item by item

Most Indian websites already carry a privacy policy. Far fewer carry a notice that is likely to pass Rule 3. The difference is structural: a privacy policy is written once, for everyone, and covers everything. A DPDP notice is shown at the moment you ask for consent, is specific to what you are asking for, and has to make sense without the reader opening anything else.

This guide breaks the notice down element by element, shows an annotated example, and covers the parts teams usually miss: language versions, notices to existing users, and cookie banners. It is written for product, engineering and privacy teams who will build the screens, alongside your legal counsel who will settle the wording.

What must a DPDP privacy notice contain?

The notice requirements sit in two places. Section 5 of the Act sets the core content, and Rule 3 of the DPDP Rules, 2025 adds how it must be presented and the minimum level of detail. Both apply from 13 May 2027, and the notice must be given with or before every request for consent.

Rule 3(b) sets these as the minimum. You can add more, such as how long you keep the data or which categories of processors you use, as long as the notice stays short enough to read.

What does a compliant notice look like?

Here is a mock consent notice for a delivery app, marked up against Rule 3. The numbers on the right map to the list below it.

Two design details carry most of the weight. First, the purpose rows: each one names the data it uses, which is what turns a generic notice into the “fair account” Rule 3(b) asks for. Second, the buttons: “Reject optional” sits next to “Save my choices” at the same size. That is not a specific rule, but it is the most direct way to show that consent was free and given by a clear affirmative action, as section 6(1) on consent requires.

Privacy policy vs privacy notice: do you need both?

Yes. They do different jobs, and the Rules expect both kinds of publishing.

A notice can link to the privacy policy for further reading. It cannot rely on it. If a user has to click through to understand what they are agreeing to, the notice fails Rule 3(a). A “DPDP compliant privacy policy” on its own does not make you compliant with section 5.

Which languages must a DPDP notice be in?

Section 5(3) gives the person the option to access the notice in English or any language specified in the Eighth Schedule to the Constitution. Section 6(3) applies the same choice to the consent request itself. The Eighth Schedule lists 22 languages.

The practical reading most teams adopt: offer the notice in the languages your users actually read, and make the choice visible on the notice itself rather than buried in settings. A pan-India consumer app will need more versions than a B2B tool used by finance teams in three cities. Whatever set you choose, a few rules keep it defensible:

• Each language version carries all Rule 3 elements, not a shortened summary.
• Translations are reviewed by a fluent reader, not only machine output, because “clear and plain” applies to every version.
• Every version has an ID, and your consent record stores which version and language the person saw.
• When the English text changes, the other versions change in the same release.

Do existing users need a new notice?

If you process personal data on the basis of consent given before the Act commenced, section 5(2) asks you to give those people a notice with the section 5 contents as soon as reasonably practicable. For most companies this means a planned notice campaign around 13 May 2027, not a quiet update to the policy page.

A workable approach:

1. From your data inventory, list every purpose that relies on consent gathered before commencement.
2. Write one notice per user group (customers, app users, newsletter subscribers), each meeting Rule 3.
3. Deliver through channels people actually see: in-app on next login, plus email or SMS to registered contacts.
4. Record delivery per person (channel, timestamp, notice version), because section 6(10) puts the burden of proving notice on you.
5. Give a one-tap route to withdraw consent from the notice itself.

How do cookie banners work under DPDP?

No separate cookie rule has been notified under the Act or the Rules. That does not put cookies outside the law. Where cookies, SDKs or pixels collect personal data for a purpose that needs consent, such as analytics tied to a user or advertising, the ordinary section 6 consent standard applies, and the banner is your notice and consent request in one.

Applying section 6 to a banner gives you a clear design brief:

• Consent per purpose. Separate toggles for analytics, personalisation and advertising, because consent must be specific.
• Reject as easy as accept. A “Reject all” at the same level and size as “Accept all”. Withdrawal must be as easy as giving consent (s.6(4)), and the first choice should be treated the same way.
• No pre-ticked boxes. Consent needs a clear affirmative action; a box ticked for the user is not one.
• No tracking before the choice. Tags for consent-based purposes fire only after the person opts in.
• Itemised and specific. Name the data (device identifiers, pages viewed) and the third parties or categories receiving it.
• A way back. A persistent “Cookie choices” link so people can change their mind later.

Cookies your site cannot function without, such as session and security cookies, are a separate question. Document which ones they are and the basis you rely on, and settle that position with your counsel. Children need extra care: section 9(3) prohibits tracking, behavioural monitoring and targeted advertising directed at children, which our children's data guide covers.

A DPDP notice template outline

Use this as the skeleton for each notice. Keep it to one screen on mobile where you can; use expandable rows for detail rather than a second page.

1. Heading and who you are. “How [Company] uses your personal data for [this service]”.
2. What we collect. An itemised list of the personal data in this request (Rule 3(b)(i)).
3. Why we use it. One row per specified purpose, with the goods, service or use it enables and the data items it uses (Rule 3(b)(ii)). Optional purposes off by default.
4. Your choices. Purpose-level toggles, then two equal buttons: save choices and reject optional.
5. Withdrawing consent. Where to do it (link to the exact settings screen) and that it is as easy as giving consent (Rule 3(c)).
6. Your rights. Link to your rights request page: access, correction, completion, updating, erasure and nomination, covered in our data principal rights guide.
7. Grievances and the Board. How to raise a grievance with you, and that a complaint to the Data Protection Board is available after that.
8. Contact. Business contact of your DPO or the person who answers questions (Rule 9).
9. Language and version. Language selector; notice version and date in small print.

If you plan to accept consent through a registered consent manager, your notice still has to meet section 5 and Rule 3. See our consent manager guide for how that model fits.

How to implement this

1. Map consent points. List every screen, form, banner and offline form where you ask for consent. Each one needs a notice.
2. Write notices from the inventory, not the policy. For each consent point, pull the exact data items and purposes from your data map.
3. Design and test. Build the notice as a component with versioning built in. Test it with real users on a small phone screen in at least two languages.
4. Wire it to your consent records. Each consent event stores the notice version and language shown.
5. Plan the existing-user notice. Schedule the section 5(2) campaign and the delivery evidence.
6. Review on change. Any new purpose or new data item means a new notice version, and fresh consent for the new purpose.

Notices are one workstream in the wider implementation roadmap. If you want a team to map your consent points, draft the notices with your counsel and build the components, see our services.

This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.