DPDP Compliance September 23, 2026

Notice Under the DPDP Act

The Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a notice-based approach to obtaining informed consent for the processing of personal data. For businesses, the notice is not merely a privacy-policy document—it is an important compliance mechanism that communicates what personal data is being processed, why it is being processed, and how individuals can exercise their rights.

Get a callback

With the Digital Personal Data Protection Rules, 2025 now notified, organisations should understand the distinction between the statutory requirement under Section 5 of the DPDP Act and the more detailed requirements prescribed under Rule 3 of the DPDP Rules, 2025.

This guide explains the legal requirements, practical structure, drafting principles, common mistakes and implementation considerations for preparing a DPDP-compliant notice.

Important: This article is intended for general compliance information and should not be treated as legal advice. Organisations should assess their specific processing activities, applicable laws and implementation timelines before relying on a particular notice.

1. What Is a Notice Under the DPDP Act?

Under the DPDP Act, a Data Fiduciary must provide a notice to the Data Principal when seeking consent for processing personal data.

Section 5 of the DPDP Act provides that every request made to a Data Principal for consent must be accompanied or preceded by a notice.

The notice must inform the Data Principal about:

The personal data proposed to be processed;
The purpose for which the personal data is proposed to be processed;
How the Data Principal can exercise applicable rights;
How the Data Principal can make a complaint to the Data Protection Board.

The statutory provision also addresses personal data for which consent was obtained before commencement of the Act, requiring the Data Fiduciary to provide a notice as soon as reasonably practicable.

The notice therefore sits at the point where transparency, consent and individual rights intersect.

2. Notice vs Privacy Policy: Are They the Same?

Not necessarily.

This is one of the most important distinctions businesses should understand.

A traditional privacy policy may contain extensive information about:

cookies;
security;
international transfers;
retention;
third-party services;
legal bases;
user rights;
contact information;
governing law; and
other privacy practices.

A DPDP notice, on the other hand, has a more specific function: to provide the information necessary for a Data Principal to make an informed decision about consent.

The notified Rule 3 makes this distinction particularly important because the notice must be presented so that it is understandable independently of other information made available by the Data Fiduciary.

Practical implication

A business should not simply assume:

“We already have a 20-page privacy policy, therefore we have a DPDP notice.”

Instead, organisations should assess whether the information required by Section 5 and Rule 3 is actually presented to the Data Principal in an understandable and accessible manner.

A privacy policy may continue to provide broader information, but the consent notice should independently satisfy the applicable DPDP requirements.

3. What Does Section 5 of the DPDP Act Require?

Section 5 establishes the basic statutory requirements for notice.

The notice must inform the Data Principal about:

3.1 Personal data being processed

The Data Fiduciary must identify the personal data proposed to be processed.

For example:

name;
mobile number;
email address;
residential address;
date of birth;
identification information;
account information; or
other categories of personal data relevant to the processing activity.

The organisation should avoid vague descriptions that prevent an individual from understanding what information is actually being collected.

3.2 Purpose of processing

The notice must communicate the purpose for which the personal data is proposed to be processed.

For example:

Weak:

“We collect your information for business purposes.”

More informative:

“We collect your name, email address and mobile number to create and manage your customer account, provide customer support and send service-related communications.”

The objective is to make the processing understandable to the Data Principal.

3.3 How rights can be exercised

The notice must explain the manner in which the Data Principal can exercise the rights available under the DPDP Act.

This becomes particularly important as organisations build operational processes for:

access-related requests;
correction;
erasure;
grievance redressal; and
nomination.

The mechanism should be practical rather than merely theoretical.

A statement such as:

“You may exercise your rights in accordance with applicable law”

may not provide enough operational guidance.

3.4 How to make a complaint

The notice must also explain how the Data Principal can make a complaint to the Data Protection Board in accordance with the applicable framework.

The organisation should therefore ensure that its notice contains an understandable route for raising concerns and grievances.

4. What Does Rule 3 of the DPDP Rules, 2025 Add?

The Digital Personal Data Protection Rules, 2025 provide more detailed requirements concerning the notice.

Rule 3 requires the notice to:

be understandable independently of other information;
use clear and plain language;
provide the details necessary to enable specific and informed consent;
include an itemised description of the personal data; and
specify the purposes and provide a specific description of the goods, services or uses enabled by the processing.

It must also provide a particular communication link to the Data Fiduciary’s website or app and describe other means, if any, through which the Data Principal can:

withdraw consent;
exercise rights under the Act; and
make a complaint to the Board.

The Rules specifically require that withdrawal of consent be as easy as the process through which consent was given.

5. The Five Core Elements of a DPDP Notice

A practical DPDP notice can therefore be structured around five core components.

5.1 What data are you collecting?

Provide an itemised description.

For example:

Account registration

Full name
Email address
Mobile number

Delivery

Delivery address
Contact number

Payment

Transaction-related information required to process the payment

The precise information should correspond to the actual processing.

5.2 Why are you collecting it?

Each category of personal data should have a clear purpose.

For example:

Personal Data	Purpose
Name	Creating and managing customer account
Email	Account communication and service updates
Mobile number	Authentication and customer communication
Delivery address	Delivering purchased products
Transaction information	Processing and maintaining transaction records

This kind of mapping is useful not only for drafting the notice but also for internal compliance.

5.3 What service or functionality does the processing enable?

Rule 3 goes beyond simply requiring a generic statement of purpose.

The notice should provide a specific description of the goods, services or uses enabled by processing.

For example:

“Your delivery address is processed to enable delivery of products purchased through our platform.”

This is more transparent than:

“Your information may be used to provide services.”

5.4 How can consent be withdrawn?

The notice should explain how the Data Principal can withdraw consent.

More importantly, the withdrawal mechanism should not be unnecessarily difficult.

For example, if consent can be provided through a simple toggle or button, requiring the individual to:

send a physical letter;
contact customer support;
wait for manual verification; and
submit another form

could create a significant mismatch between giving and withdrawing consent.

The Rules expressly require withdrawal to be as easy as the manner in which consent was given.

5.5 How can the Data Principal exercise rights or complain?

The notice should provide an accessible mechanism or communication route through which the Data Principal can:

exercise applicable rights;
raise a grievance; and
access the relevant process for complaints to the Board.

The Rule 3 requirement specifically refers to providing the relevant communication link and describing other available means.

6. What Does “Clear and Plain Language” Mean?

A DPDP notice should be understandable to the ordinary person whose data is being processed.

Avoid unnecessary legal or technical terminology.

Avoid:

“The Data Fiduciary may undertake processing activities in furtherance of legitimate operational, administrative and commercial objectives.”

Prefer:

“We use your contact information to manage your account, provide customer support and send important service communications.”

The second version gives the Data Principal a clearer understanding of what is happening.

7. Avoid the “Everything Under One Purpose” Problem

One of the most common privacy-notice weaknesses is excessive aggregation.

For example:

“We collect your name, email, phone number, location, device information and transaction data for business, marketing, security, analytics, service improvement and other purposes.”

This may technically contain many words, but it does not necessarily provide meaningful transparency.

A better approach is to create a data-purpose matrix.

Data	Purpose
Name	Account creation
Email	Account communication
Mobile	Authentication and service communication
Location	Showing location-specific services
Device information	Security and fraud prevention
Transaction information	Processing purchases

This also helps the organisation maintain consistency between its notice, consent mechanism, data inventory and internal processing records.

8. Should Every Privacy Notice Be the Same?

No.

A single generic notice may be insufficient for organisations with multiple products, services or processing contexts.

Consider a company operating:

an e-commerce platform;
a mobile application;
a loyalty programme;
an employee portal; and
a marketing platform.

Each processing environment may involve different categories of personal data and different purposes.

The organisation should therefore consider context-specific notices where appropriate.

Example

An e-commerce checkout notice may explain:

“We use your name, contact number and delivery address to process and deliver your order.”

A marketing consent notice may separately explain:

“If you choose to receive promotional communications, we will use your email address to send information about products, offers and services.”

The second purpose should not simply be hidden inside a broad paragraph about “service delivery.”

9. Notice and Consent Should Work Together

A notice is not the same thing as consent.

The notice provides information.

Consent is the Data Principal’s permission where consent is the applicable basis for processing under the Act.

A good implementation therefore looks like:

Notice → Understanding → Specific consent → Processing

rather than:

Long privacy policy → Pre-selected checkbox → Processing

The DPDP framework requires consent to be free, specific, informed and unambiguous, and capable of being withdrawn. Organisations should therefore design the notice and consent interface as connected components of the same compliance process.

10. Do Not Bundle Unrelated Purposes Without Explanation

Consider a registration form containing:

☑ I agree to the processing of my personal data for account creation, customer support, analytics, personalised advertising, sharing with marketing partners and promotional communications.

This creates a number of questions.

Are all these purposes necessary for account creation?

Does the user understand each purpose?

Is promotional communication genuinely necessary to provide the service?

Can the user separately control optional processing?

A better architecture may separate:

Required processing

Create and manage your account.

and

Optional processing

Receive promotional communications about our products and services.

The exact design should depend on the organisation’s processing activities and applicable legal requirements.

11. The Notice Should Match Actual Data Processing

A notice is only useful if it accurately reflects what the organisation actually does.

For example, suppose the notice says:

“We collect your email address solely to manage your account.”

But the organisation subsequently uses the same email address for:

advertising;
profiling;
third-party marketing;
product recommendations; and
unrelated campaigns.

The problem is not simply the wording of the notice. It indicates a disconnect between documented processing and actual processing.

A proper compliance programme should therefore reconcile:

Notice ↔ Consent ↔ Data inventory ↔ Processing activities ↔ Systems ↔ Vendors

12. DPDP Notice Compliance Requires Internal Data Mapping

Before drafting or updating a notice, businesses should ideally conduct a data-mapping exercise.

For every processing activity, identify:

What personal data is collected?
From whom?
Where is it collected?
Why is it collected?
Which system stores it?
Who can access it?
Which processors receive it?
How long is it retained?
Is consent required?
How can the Data Principal exercise rights?
How can consent be withdrawn?
What happens when the purpose is completed?

Only after answering these questions should the organisation finalise the notice.

13. DPDP Notice Template

Below is a practical structure that businesses can adapt.

DPDP Privacy Notice

1. Who we are

[Company Name] is the Data Fiduciary responsible for the processing of your personal data described in this notice.

2. Personal data we process

Depending on the services you use, we may process:

Name
Email address
Mobile number
Address
Account information
Transaction information
Other personal data specifically identified at the point of collection

3. Why we process your personal data

We process your personal data for the following purposes:

Personal Data	Purpose	Service/Use Enabled
Name	Account management	Creating and managing your account
Email	Service communication	Sending account and service-related communications
Mobile number	Authentication	Verifying and securing your account
Address	Order fulfilment	Delivering products or services
Transaction information	Transaction processing	Processing purchases and maintaining transaction records

4. Your choices and consent

Where processing is based on your consent, you may withdraw your consent through:

[Insert withdrawal mechanism/link]

Withdrawal will be enabled through a process comparable to the process used to provide consent.

5. Exercising your rights

You may exercise your rights under the DPDP Act through:

[Insert rights-request link/email/process]

6. Grievances

For questions or grievances concerning the processing of your personal data, contact:

[Name/Role]
[Email]
[Contact mechanism]

Information concerning the applicable mechanism for complaints to the Data Protection Board should also be made accessible as required.

7. Further information

For additional information about our processing activities, please refer to:

[Privacy Policy / relevant information page]

14. What Should Businesses Avoid in a DPDP Notice?

14.1 Excessive legal language

A notice should not require a lawyer to understand it.

14.2 Vague purposes

Avoid statements such as:

“for business purposes”;
“for operational purposes”;
“for improving our services”;
“for other legitimate purposes”; or
“for purposes deemed necessary by us.”

Where applicable, provide meaningful specificity.

14.3 Hidden consent mechanisms

Do not bury important consent information deep inside a lengthy privacy policy.

14.4 Pre-selected optional choices

Organisations should carefully review interface design so that consent is genuinely meaningful rather than obtained through confusing or manipulative design.

14.5 Difficult withdrawal

If giving consent takes one click but withdrawing consent requires a customer-service process, the organisation should reconsider its design.

The notified Rules expressly address the ease of withdrawal.

14.6 Notice that does not match actual processing

The notice should be periodically reviewed against actual processing operations.

15. Notice for Websites and Mobile Apps

For digital services, the notice should be integrated into the user journey.

Example: Account registration

Create your account

Name
[________]

Email
[________]

Mobile
[________]

How we use this information

We use your name, email address and mobile number to create and manage your account, authenticate you and provide account-related communications.

[View detailed notice]

[Agree and Continue]

The exact implementation will depend on the processing involved, but the core objective is to make relevant information available at the point where the user is making the decision.

16. Notice for E-Commerce Businesses

An e-commerce business may process personal data for several distinct purposes.

For example:

Order fulfilment

Name
Delivery address
Contact information

Payment

Transaction-related information

Customer support

Contact information
Order information
Communications with support

Marketing

Contact information
Preferences
Interaction information, where applicable

These activities should not automatically be treated as one undifferentiated purpose.

The notice and consent architecture should reflect the actual processing model.

17. Notice for HR and Employee Data

Businesses should also review notices relating to employees, applicants and contractors.

Potential processing may include:

identity information;
contact information;
employment records;
payroll information;
attendance information;
professional information; and
information required for statutory or organisational purposes.

However, organisations should not simply copy their customer privacy notice for employees.

Employee processing often involves different purposes, relationships and legal requirements.

The organisation should assess each processing activity separately.

18. Notice for Children’s Data

Children’s personal data requires particular care under the DPDP framework.

The notified Rules provide requirements concerning verifiable parental consent before processing a child’s personal data and prescribe measures concerning verification of the adult identifying themselves as the parent.

Businesses serving children should therefore review:

age identification;
parental consent mechanisms;
verification processes;
notices presented to children and parents;
prohibited processing activities;
interface design; and
records demonstrating compliance.

A standard adult-user consent flow should not simply be reused for children’s services.

19. When Should a Business Review Its Notice?

A notice should not be treated as a “write once and forget” document.

Review it when:

a new category of personal data is introduced;
a new purpose is introduced;
a new product is launched;
a new technology changes processing;
a new third-party processor is engaged;
marketing practices change;
the consent mechanism changes;
the rights-request process changes;
applicable law changes; or
internal data mapping identifies a mismatch.

A periodic compliance review is also advisable.

20. DPDP Notice Compliance Checklist

Before publishing a notice, ask:

Content

Is the personal data clearly identified?
Is the purpose clearly stated?
Are purposes specific enough to be meaningful?
Is the service, good or use enabled by processing described?
Is the language clear and understandable?
Can the notice be understood independently?

Consent

Is the notice provided before or with the consent request?
Is consent separated from unrelated information where appropriate?
Can the Data Principal understand what they are agreeing to?
Is consent withdrawal available?
Is withdrawal as easy as giving consent?

Rights

Is there a clear mechanism for exercising rights?
Is the relevant communication link provided?
Is the grievance mechanism explained?
Is the route for complaints to the Board appropriately described?

Operational consistency

Does the notice match the data inventory?
Does it match actual processing?
Does it match the consent-management system?
Does it match vendor/processor arrangements?
Does the organisation have a process for updating the notice?

21. Common DPDP Notice Mistakes

Mistake 1: Treating the privacy policy as the entire compliance solution

A broad privacy policy does not automatically eliminate the need to satisfy the specific notice requirements applicable to consent requests.

Mistake 2: Using generic purposes

“To improve your experience” does not tell the Data Principal enough about many types of processing.

Mistake 3: Listing too much information without structure

A notice can be technically comprehensive but practically unreadable.

Mistake 4: Making withdrawal difficult

The notified Rules specifically require an ease of withdrawal comparable to the manner of giving consent.

Mistake 5: Ignoring the user journey

The notice should be considered as part of the actual interface—not merely as a PDF sitting on a website.

Mistake 6: Forgetting legacy data

Businesses should assess data collected and consent obtained before the relevant DPDP provisions become applicable to their processing.

22. Implementation Timeline: An Important Point for Businesses

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025.

The Rules use a phased commencement structure. Rules 1, 2 and 17–21 came into force upon publication; Rule 4 comes into force one year after publication; and Rule 3, along with Rules 5–16, 22 and 23, comes into force eighteen months after publication.

This is particularly relevant to the notice requirement because Rule 3 contains the detailed notice requirements discussed in this article.

Therefore, businesses should distinguish between:

the statutory requirement under Section 5 of the DPDP Act;
the detailed requirements under Rule 3; and
the applicable commencement date for each provision.

MeitY’s official materials state that the notified Rules establish the implementation framework for the DPDP Act and provide an eighteen-month phased timeline for compliance.

Businesses should therefore avoid treating the implementation timeline as a reason to postpone preparation. Building notice, consent, data-mapping and rights-management processes can require substantial operational work.

23. DPDP Notice as Part of a Larger Compliance Framework

A compliant notice should not exist in isolation.

A mature DPDP compliance programme should connect the notice with:

Data Inventory
↓
Data Mapping
↓
Purpose Identification
↓
Notice
↓
Consent Management
↓
Processing Controls
↓
Data Principal Rights
↓
Retention & Erasure
↓
Audit & Review

This is why notice drafting should ideally involve more than the legal team.

Depending on the organisation, input may be required from:

Legal;
Privacy;
Information Security;
IT;
Product;
Marketing;
HR;
Customer Support; and
Vendor Management.

24. Final Takeaway

The DPDP notice should be treated as a core operational component of privacy compliance, not simply as another legal document on a website.

At a minimum, organisations should ensure that the notice clearly communicates:

What personal data is being processed;
Why it is being processed;
What goods, services or uses the processing enables;
How consent can be withdrawn;
How applicable rights can be exercised; and
How grievances and complaints can be raised.

The notified DPDP Rules, 2025 add an important practical dimension: the notice must be independently understandable, use clear and plain language, provide an itemised description of personal data and specify the purposes and relevant goods, services or uses.

For businesses, the most effective approach is therefore not to begin with the question:

“How do we write a privacy notice?”

Instead, begin with:

“What personal data do we process, why do we process it, and can we explain that processing clearly to the Data Principal?”

Once the underlying processing is accurately mapped, the notice becomes much easier to draft—and much more useful as a genuine compliance control.

Frequently Asked Questions

Is a DPDP notice the same as a privacy policy?

Not necessarily. A privacy policy may contain broader information, while the DPDP notice has specific requirements connected with informing the Data Principal when consent is sought.

Is notice mandatory before obtaining consent?

Section 5 provides that a consent request must be accompanied or preceded by the required notice.

What information should a DPDP notice contain?

The statutory framework requires information concerning the personal data and purpose of processing, rights-related mechanisms and the complaint mechanism. Rule 3 additionally requires an itemised description of personal data, specified purposes and a specific description of relevant goods, services or uses, together with relevant links or means for withdrawal, rights and complaints.

Can a company use its existing privacy policy?

An existing privacy policy may contain relevant information, but businesses should separately assess whether their notice satisfies the applicable DPDP requirements and whether it is independently understandable.

Does a Data Principal have to contact customer support to withdraw consent?

The notified Rules require withdrawal of consent to be as easy as the manner in which consent was given. Businesses should therefore design withdrawal mechanisms accordingly.

Should a business have different notices for different services?

Where processing activities, data categories or purposes differ materially, context-specific notices may provide greater transparency and reduce compliance risk.

When should businesses update their notices?

Whenever material changes occur to personal data collected, processing purposes, products, consent mechanisms, rights processes or other relevant processing practices. Periodic reviews should also form part of the privacy governance programme.

Official Sources

For authoritative reference, organisations should consult the Digital Personal Data Protection Act, 2023 and the notified Digital Personal Data Protection Rules, 2025 published by the Ministry of Electronics and Information Technology.

The DPDP Act is available through MeitY’s official repository.

The notified DPDP Rules, 2025 were published in the Gazette on 13 November 2025.

MeitY’s official DPDP Rules repository also provides the notified Rules and related implementation materials.

Last reviewed: September 2026