A DPDP-compliant privacy notice is an essential part of privacy and data protection compliance under India’s Digital Personal Data Protection Act, 2023 (DPDP Act). For businesses collecting or processing personal data, a well-drafted notice helps explain what personal data is being processed, why it is being processed, how individuals can exercise their rights, and how they can withdraw consent or raise grievances.

The Digital Personal Data Protection Rules, 2025, notified by the Ministry of Electronics and Information Technology (MeitY) on 13 November 2025, provide additional requirements for notices given by Data Fiduciaries to Data Principals. Rule 3 requires the notice to be independently understandable, use clear and plain language, include an itemised description of personal data and specify the purposes and relevant goods, services or uses enabled by processing.

For organisations preparing for DPDP compliance, the key question is therefore not simply “Do we have a privacy policy?” but:

“Does our privacy notice clearly and accurately explain our actual personal data processing practices?”

This guide explains how to draft a DPDP-compliant privacy notice, what information it should contain, common mistakes to avoid, and how businesses can connect their privacy notice with their broader DPDP compliance programme.

What Is a Privacy Notice Under the DPDP Act?

The DPDP Act uses the concept of a notice provided by the Data Fiduciary to the Data Principal.

Under Section 5 of the DPDP Act, a request for consent must be accompanied or preceded by a notice informing the Data Principal about:

• the personal data proposed to be processed;
• the purpose for which the personal data is proposed to be processed;
• the manner in which applicable rights may be exercised; and
• the manner in which a complaint may be made to the Data Protection Board.

The notified DPDP Rules, 2025 provide additional detail about how the notice should be presented.

This means a privacy notice should be treated as an important transparency and consent-management mechanism, rather than simply as a lengthy legal document placed on a website.

Privacy Policy vs Privacy Notice Under the DPDP Act

A privacy policy and a privacy notice are related, but they should not automatically be treated as identical documents.

A privacy policy may provide broader information about an organisation’s privacy practices, such as:

• security practices;
• retention;
• cookies;
• third-party services;
• international data transfers;
• contact information;
• organisational privacy governance; and
• other information relevant to users.

A DPDP notice, particularly one accompanying or preceding a consent request, has a more specific purpose.

It must provide the information necessary for the Data Principal to make a specific and informed consent decision.

The notified Rule 3 expressly requires the notice to be understandable independently of other information made available by the Data Fiduciary.

Practical takeaway

Businesses should not assume that:

“We have a privacy policy, so our DPDP notice requirement is automatically satisfied.”

Instead, organisations should review whether the information presented at the point of consent satisfies the applicable requirements.

What Does a DPDP-Compliant Privacy Notice Need to Contain?

A practical DPDP notice should address the following areas:

1. Identity of the Data Fiduciary;
2. Personal data being processed;
3. Specific purpose or purposes of processing;
4. Goods, services or uses enabled by processing;
5. Consent and consent withdrawal mechanism, where consent is the basis;
6. Mechanism for exercising applicable Data Principal rights;
7. Grievance mechanism;
8. Relevant communication links or channels; and
9. Additional information required by the applicable legal and regulatory framework.

The exact content will depend on the organisation, its processing activities and the context in which personal data is collected.

Step 1: Identify the Data Fiduciary

The notice should clearly identify the organisation responsible for the processing.

For example:

ABC Technologies Private Limited is the Data Fiduciary responsible for processing your personal data in connection with the services described in this notice.

The organisation should avoid creating uncertainty about who is responsible for the processing.

Where multiple entities are involved, the legal and operational relationship should be assessed carefully rather than simply listing every group company.

Step 2: Identify Every Category of Personal Data

One of the most important steps in drafting a DPDP privacy notice is identifying the personal data actually being processed.

The notified Rule 3 specifically requires an itemised description of the personal data covered by the notice.

Instead of saying:

“We collect your personal information.”

provide meaningful categories.

For example:

Account information

• Full name
• Email address
• Mobile number
• Account username

Delivery information

• Delivery address
• Contact number

Transaction information

• Order details
• Transaction-related information

Technical information

• Device information
• Log information
• Identifiers used for security or service functionality

The categories should reflect what the organisation actually processes.

Step 3: Map Each Data Category to a Purpose

A good privacy notice should not simply list data categories.

It should explain why each category is processed.

A useful internal exercise is to create a data-purpose matrix:

Personal Data	Purpose	Service or Use Enabled
Name	Account management	Creating and managing the user account
Email address	Service communication	Sending account-related communications
Mobile number	Authentication	Verifying and securing the account
Delivery address	Order fulfilment	Delivering purchased products
Transaction information	Transaction processing	Processing and maintaining purchase records

This exercise can also expose unnecessary data collection or vague purposes before the notice is published.

Step 4: Write Specific Purposes

The purpose statement is one of the most important parts of the notice.

Avoid vague expressions such as:

• “for business purposes”;
• “for operational purposes”;
• “to improve your experience”;
• “for legitimate business needs”;
• “for other purposes”;
• “for purposes we consider appropriate.”

Instead, explain what the organisation is actually doing.

Example

Less informative:

We process your information to improve our services.

More informative:

We use information about your use of our application to identify technical problems, analyse service performance and improve specific features.

The appropriate level of detail will depend on the processing activity.

Step 5: Explain the Goods, Services or Uses Enabled by Processing

The notified DPDP Rules go beyond simply requiring a generic purpose statement.

Rule 3 requires the notice to include the specified purpose or purposes and a specific description of the goods or services to be provided or uses to be enabled by the processing.

For example:

We process your delivery address to enable delivery of products purchased through our platform.

This is more informative than:

We process your information to provide our services.

The notice should help the Data Principal understand the connection between the personal data and the service or functionality.

Step 6: Explain Consent Clearly

Where consent is the applicable basis for processing, the notice and consent mechanism should work together.

The user should be able to understand:

• what they are consenting to;
• what personal data is involved;
• why it is being processed; and
• what happens if they do not provide consent.

The DPDP Act provides that consent must be free, specific, informed and unambiguous, and involve a clear affirmative action. The Act also provides for withdrawal of consent.

The notice should therefore not be designed merely to maximise the number of consent selections.

Its purpose is to support an informed decision.

Step 7: Provide a Practical Consent Withdrawal Mechanism

A DPDP-compliant privacy notice should explain how consent can be withdrawn where processing is based on consent.

The notified Rules require the notice to provide a relevant communication link and describe other means, if any, through which the Data Principal may withdraw consent, exercise rights and make complaints. Rule 3 also requires withdrawal to be as easy as the manner in which consent was given.

Example

If consent is given through:

Settings → Privacy → Marketing Preferences → Enable

the organisation should consider providing a comparably straightforward route to withdraw that consent.

The withdrawal process should not unnecessarily force the user to contact customer support if a straightforward digital mechanism is reasonably available.

Step 8: Explain How Data Principals Can Exercise Their Rights

The notice should provide a clear route for exercising applicable rights under the DPDP Act.

Depending on the circumstances, the organisation may need to support requests relating to:

• access to information about personal data;
• correction;
• erasure;
• grievance redressal; and
• nomination.

The organisation should provide an appropriate communication channel, such as:

Privacy Rights Portal: [insert link]

or:

Email: privacy@example.com

The specific mechanism should correspond with the organisation’s actual rights-management process.

Step 9: Explain the Grievance Mechanism

A privacy notice should not merely state that users “may contact us with complaints.”

It should identify a practical channel.

For example:

If you have a concern regarding the processing of your personal data, you may submit a grievance through our Privacy Rights Portal or contact our designated grievance contact at privacy@example.com.

The notice should also appropriately explain the mechanism for making a complaint to the Data Protection Board where required.

Section 5 of the DPDP Act expressly requires the notice to inform the Data Principal about the manner in which a complaint may be made to the Board.

Step 10: Use Clear and Plain Language

The notified Rule 3 requires the notice to provide the relevant information in clear and plain language.

This has an important drafting implication.

A legally precise document does not have to be unnecessarily complicated.

Avoid

“The Data Fiduciary may process the Personal Data of the Data Principal for purposes ancillary, incidental or otherwise connected with the provision of the Services.”

Prefer

“We use your personal data to provide and manage the services you request.”

Where a legal qualification is necessary, it can be explained separately.

Step 11: Make the Notice Understandable on Its Own

Rule 3 requires the notice to be presented and understandable independently of other information made available by the Data Fiduciary.

This is important for businesses that currently rely on:

• hyperlinks;
• lengthy privacy policies;
• terms of service;
• FAQs;
• cookie policies; and
• other documents.

Links can provide additional information, but the core notice should not become meaningless without opening five additional documents.

A useful test

Ask someone unfamiliar with the organisation:

“Can you understand what data this company is asking to process and why, without reading the entire website?”

If the answer is no, the notice may need to be redesigned.

Step 12: Separate Necessary and Optional Processing Where Appropriate

Many organisations process personal data for several purposes.

For example:

• account creation;
• service delivery;
• security;
• analytics;
• marketing;
• personalised recommendations.

These purposes should be analysed individually.

Where certain processing is optional and consent-based, businesses should consider whether the consent interface should provide a meaningful choice rather than combining unrelated purposes into one selection.

Example

Required

We use your email address to create your account and send important service communications.

Optional

With your consent, we may use your email address to send promotional communications about our products and services.

The precise legal treatment depends on the processing context and applicable provisions.

Step 13: Make Sure the Notice Matches Your Actual Processing

This is where many privacy notices fail.

A company may draft an excellent notice but still have a compliance gap if its systems do something different.

For example, the notice might say:

“We use your email address only for account management.”

But the marketing system may also use the same email address for promotional campaigns.

The issue is therefore not merely a drafting problem.

It is a processing-governance problem.

Your privacy notice should be consistent with:

• data inventories;
• application architecture;
• consent records;
• marketing systems;
• analytics tools;
• cloud services;
• vendors and processors;
• retention practices; and
• rights-request workflows.

The DPDP Privacy Notice Data Mapping Exercise

Before drafting a notice, create a data-processing inventory.

For each processing activity, document:

Question	Example
What data?	Name, email, mobile
Whose data?	Customers
Source?	Registration form
Purpose?	Account management
Legal basis?	Consent / applicable lawful basis
System?	CRM
Processor?	Cloud service provider
Retention?	Defined according to applicable requirements
Rights mechanism?	Privacy portal
Withdrawal mechanism?	Account settings

Once this exercise is complete, drafting the privacy notice becomes considerably easier.

DPDP Privacy Notice Structure

A practical privacy notice can follow this structure:

1. About the organisation

Identify the Data Fiduciary.

2. Personal data we process

Provide an itemised description.

3. Why we process your data

Explain specific purposes.

4. Services and uses enabled

Explain what the processing enables.

5. Consent

Explain where consent is being requested and what it covers.

6. Withdrawal of consent

Explain how consent can be withdrawn.

7. Your rights

Explain how Data Principals can exercise applicable rights.

8. Grievances and complaints

Provide relevant communication channels and complaint information.

9. Additional information

Provide links to broader privacy information where appropriate.

Sample DPDP Privacy Notice

The following is an illustrative structure. Businesses should customise it based on their actual processing activities.

Privacy Notice

Who we are

ABC Technologies Private Limited is the Data Fiduciary responsible for processing your personal data in connection with the services described below.

Personal data we process

Depending on the services you use, we may process:

• Name
• Email address
• Mobile number
• Account information
• Delivery address
• Transaction information
• Information required to provide and secure our services

Why we process your personal data

We process your personal data for the following purposes:

Data	Purpose	Use Enabled
Name	Account management	Creating and managing your account
Email	Service communication	Sending account-related communications
Mobile number	Authentication	Verifying your account
Delivery address	Order fulfilment	Delivering your order
Transaction information	Transaction processing	Processing your purchase

Withdrawal of consent

Where processing is based on your consent, you may withdraw your consent through:

[Insert link or mechanism]

You may use the same account or privacy settings to manage your consent preferences.

Exercise of rights

You may exercise your applicable rights under the DPDP Act through:

[Insert privacy rights portal/link]

Grievances

If you have a grievance regarding our processing of your personal data, you may contact:

[Name/role]
[Email]
[Link/contact mechanism]

Information about the applicable mechanism for making a complaint to the Data Protection Board is available through:

[Insert appropriate link/information]

Common Mistakes When Drafting a DPDP Privacy Notice

1. Copying a generic privacy policy

A privacy notice should reflect the organisation’s actual processing.

2. Using vague purposes

“Business purposes” is generally not a meaningful explanation of a specific processing activity.

3. Listing broad categories

“Personal information” does not provide the same transparency as an itemised description.

4. Hiding important information behind multiple links

Additional information can be linked, but the core notice should remain understandable independently.

5. Making consent withdrawal difficult

The notified Rules specifically address the ease of withdrawal.

6. Combining unrelated purposes

Account management, advertising and optional analytics may involve different processing purposes and should be assessed accordingly.

7. Drafting without data mapping

The legal team cannot accurately describe processing that the organisation itself has not mapped.

8. Forgetting mobile applications

The privacy notice should be designed for the actual interface through which personal data is collected.

9. Failing to update the notice

A notice should evolve when processing activities change.

DPDP Privacy Notice for Websites

Website owners should consider where the notice appears in the user journey.

For example:

Newsletter signup

Enter your email address to receive our newsletter and updates about our services.

[Email address]

[Subscribe]

By subscribing, you consent to the processing described in our notice.

[View Privacy Notice]

The precise interface and wording should be adapted to the actual processing and consent requirements.

A privacy notice should not simply be buried in the website footer.

DPDP Privacy Notice for Mobile Apps

Mobile applications may process substantially more information than a basic website.

Depending on the app, processing could include:

• account information;
• device information;
• location;
• contacts;
• photographs;
• usage information;
• transaction information; and
• other personal data.

The notice should accurately identify the information relevant to the particular feature.

For example, if location data is used to provide location-specific services, the notice should explain that purpose rather than simply stating:

“We may collect information from your device.”

DPDP Privacy Notice for E-Commerce Businesses

E-commerce businesses commonly process personal data for multiple purposes.

A notice may need to address:

Account management

Name, email and mobile number.

Order fulfilment

Delivery address and contact information.

Payments

Transaction-related information.

Customer support

Information needed to investigate and resolve customer queries.

Marketing

Information used for promotional communications, where applicable.

These processing activities should be mapped before the notice is drafted.

DPDP Privacy Notice for HR and Employee Data

Employee and applicant information may require a different notice structure from customer-facing processing.

Depending on the organisation, HR processing may involve:

• identity information;
• contact information;
• employment information;
• payroll information;
• attendance information;
• professional qualifications; and
• information required for applicable employment or legal purposes.

The organisation should assess the applicable lawful basis and requirements for each processing activity rather than simply copying its customer privacy notice.

DPDP Privacy Notice for Children’s Data

Organisations providing services to children need additional care.

The notified DPDP Rules prescribe requirements concerning verifiable parental consent and verification of the adult identifying themselves as the parent in specified circumstances.

Businesses serving children should therefore separately assess:

• age determination;
• parental consent;
• verification;
• child-facing notices;
• parent-facing information;
• prohibited processing;
• interface design; and
• record keeping.

A standard adult consent process should not automatically be treated as sufficient for children’s services.

How to Audit an Existing Privacy Notice for DPDP Compliance

If your organisation already has a privacy policy, conduct a structured review.

Content review

Check whether the document:

• identifies the personal data processed;
• explains specific purposes;
• describes relevant goods, services or uses;
• explains applicable rights;
• provides a grievance mechanism;
• provides relevant consent withdrawal information.

Language review

Check whether:

• sentences are unnecessarily complicated;
• technical terminology is explained;
• important information is easy to find;
• the notice can be understood without reading additional documents.

Operational review

Compare the notice against:

• data inventory;
• consent-management platform;
• application forms;
• mobile app permissions;
• CRM;
• marketing platform;
• analytics tools;
• vendor contracts;
• retention schedules; and
• rights-request processes.

Governance review

Define:

• who owns the notice;
• who approves changes;
• how changes are tracked;
• when the notice must be reviewed; and
• how product teams notify privacy/legal teams of new processing.

DPDP Privacy Notice Compliance Checklist

Before publishing or approving a notice, ask:

• Have we identified the Data Fiduciary?

• Have we itemised the personal data being processed?

• Have we identified each relevant purpose?

• Are the purposes specific and understandable?

• Have we described the relevant goods, services or uses enabled?

• Is the notice written in clear and plain language?

• Can the notice be understood independently?

• Is the notice provided at the appropriate point in the consent journey?

• Is consent presented appropriately where required?

• Can consent be withdrawn easily?

• Is there a mechanism to exercise applicable rights?

• Is there a grievance mechanism?

• Is information about complaints to the Board appropriately provided?

• Does the notice accurately reflect actual processing?

• Does it match the organisation’s data inventory?

• Does it match the consent-management process?

• Has it been reviewed by the relevant legal/privacy stakeholders?

• Is there an owner responsible for future updates?

DPDP Notice Compliance: What Businesses Should Do Now

Businesses should treat privacy notice drafting as part of a broader DPDP compliance programme.

A practical implementation sequence is:

Step 1 — Identify processing activities

Map where personal data is collected and used.

Step 2 — Create a data inventory

Identify categories of personal data.

Step 3 — Map purposes

Connect every processing activity with a specific purpose.

Step 4 — Review lawful basis

Determine whether processing relies on consent or a relevant lawful use under the DPDP Act.

Step 5 — Draft the notice

Use clear, plain and context-specific language.

Step 6 — Design the consent interface

Make sure the notice and consent mechanism work together.

Step 7 — Build withdrawal and rights mechanisms

Ensure individuals have practical ways to exercise applicable rights and withdraw consent where relevant.

Step 8 — Test against actual systems

Confirm that the notice matches what the organisation actually does.

Step 9 — Establish governance

Assign ownership and define a process for updating the notice.

DPDP Rules 2025 and the Privacy Notice: Important Commencement Point

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. The Rules use a phased commencement structure.

Under Rule 1(2)–(4):

• Rules 1, 2 and 17–21 came into force upon publication;
• Rule 4 comes into force one year after publication; and
• Rules 3, 5–16, 22 and 23 come into force eighteen months after publication.

This matters because Rule 3 contains the detailed notice requirements discussed in this article.

Accordingly, organisations should distinguish between the existing statutory requirements under Section 5 of the DPDP Act and the later commencement of the detailed Rule 3 requirements.

The notified Rules and their commencement dates should be checked against the latest official MeitY materials when implementing or auditing compliance. MeitY maintains the official repository for the DPDP Rules, 2025 and related implementation documents.

Why a DPDP-Compliant Privacy Notice Is More Than a Legal Document

A privacy notice connects several parts of an organisation’s privacy programme.

It connects:

Data Collection

↓

Purpose Identification

↓

Notice

↓

Consent

↓

Processing

↓

Rights Management

↓

Retention & Erasure

↓

Governance & Audit

If any one of these elements is inconsistent with the others, the organisation may have difficulty demonstrating that its privacy practices are transparent and properly controlled.

A good notice therefore serves two audiences:

For the Data Principal:
It explains what happens to their personal data.

For the organisation:
It provides a documented representation of its processing activities and privacy commitments.

Final Takeaway

Drafting a DPDP-compliant privacy notice is not simply a matter of rewriting an existing privacy policy.

A strong notice begins with an accurate understanding of the organisation’s personal data processing.

The organisation should be able to answer:

• What personal data do we process?
• Why do we process it?
• What service or functionality does that processing enable?
• When are we relying on consent?
• How can consent be withdrawn?
• How can the Data Principal exercise applicable rights?
• How can a grievance be raised?
• Does our notice accurately describe what our systems actually do?

The DPDP Act requires a notice to accompany or precede a request for consent and to communicate specified information to the Data Principal. The notified DPDP Rules, 2025 provide more detailed requirements, including an itemised description of personal data, specified purposes, relevant goods, services or uses, clear and plain language, independent understandability and mechanisms for consent withdrawal, rights and complaints.

For businesses, the most effective approach is therefore to treat the privacy notice as part of the DPDP compliance architecture, rather than as a standalone legal page.

A well-designed notice should be clear enough for a Data Principal to understand, specific enough to support informed consent, and accurate enough to reflect the organisation’s real-world processing activities.

Frequently Asked Questions About DPDP Privacy Notices

What is a DPDP-compliant privacy notice?

A DPDP-compliant privacy notice is a notice provided by a Data Fiduciary to a Data Principal that communicates the required information about the processing of personal data, including the personal data involved, purposes of processing and relevant mechanisms for exercising rights and making complaints.

Is a privacy policy mandatory under the DPDP Act?

The DPDP Act’s Section 5 requirement is specifically framed around a notice accompanying or preceding a request for consent. Businesses should therefore assess their privacy notice and broader privacy-policy documentation separately against the applicable requirements.

What should a DPDP privacy notice contain?

At a minimum, organisations should assess the requirements concerning the personal data being processed, purposes, rights, grievance/complaint mechanisms and, under Rule 3 when applicable, itemised data descriptions, specific purposes, relevant goods/services/uses and appropriate communication mechanisms.

Can a business use its existing privacy policy as its DPDP notice?

An existing privacy policy may contain some or all relevant information, but businesses should verify whether it satisfies the specific notice requirements and whether the relevant notice is independently understandable as required by Rule 3 when that provision becomes applicable.

Does the DPDP notice need to be written in plain language?

Yes. Rule 3 specifically requires the notice to give the relevant information in clear and plain language.

Can a Data Principal withdraw consent?

Where processing is based on consent, the DPDP Act provides for withdrawal of consent. The notified Rules further require the notice to describe the means of withdrawal and require withdrawal to be as easy as the manner in which consent was given.

Should a company create separate privacy notices for different services?

A single notice may not always provide the clearest transparency where products, users, data categories or purposes differ substantially. Organisations should assess whether context-specific notices are appropriate.

When should a company update its privacy notice?

The notice should be reviewed when there are material changes to personal data collected, processing purposes, products, consent mechanisms, rights processes or other relevant processing activities. It should also be reviewed periodically as part of privacy governance.

Official DPDP Sources

For compliance work, organisations should rely on the Digital Personal Data Protection Act, 2023, the notified Digital Personal Data Protection Rules, 2025, and subsequent official notifications, amendments, corrigenda and guidance.

The official MeitY repository contains the DPDP Rules, 2025 and related implementation documents.

Last reviewed: September 2026

Disclaimer: This article provides general information about the DPDP framework and is not legal advice. Organisations should obtain professional advice based on their specific processing activities, business model and applicable legal requirements.