What a DPDP privacy notice must contain (Rule 3), with an example
Updated 20 October 2026 · 5 min read
Under section 5 of the DPDP Act, every request for consent must come with a notice. Rule 3 of the DPDP Rules, 2025 says what that notice must look like and contain.
The form
- Stands on its own: understandable without reading any other document, and not buried inside your terms.
- Clear and plain language: written for your customers, not for lawyers.
- In a language people can read: English or any language in the Eighth Schedule to the Constitution.
What it must contain
- An itemised list of the personal data you collect, such as name, phone number, email, address, payment details or device identifiers.
- The specific purpose for each item, and the goods, services or uses it enables. "Phone number: to call about your delivery" is the level of detail meant.
- How to withdraw consent, as easily as it was given, through a link or similar.
- How to use their rights: access, correction, completion, updating, erasure and nomination.
- How to complain to the Data Protection Board.
Rule 9 also asks you to publish a contact for questions about how you use personal data, so most notices include it.
A simple structure
- Who we are and how to reach us.
- What we collect and why: a table with one row per item of data, its purpose and what it enables.
- What is optional: for example analytics and marketing, which run only if you agree.
- Withdrawing consent: one link.
- Your rights and how to use them.
- Complaints: our grievance contact, then the Data Protection Board.
Common mistakes
- Copying a GDPR or US privacy policy. It usually lacks the itemised list and the Board, and talks about laws that do not apply to you. See DPDP vs GDPR.
- Bundling: one tick box that agrees to orders, newsletters and ad tracking together.
- Hiding the withdrawal option, or making it harder than saying yes.
- Never updating it. When you add a new tool or purpose, the notice should change, and a version history helps you show what people saw.
Make one in a few minutes
The free nodd notice generator builds an itemised notice structured around Rule 3, with each part linked to its source. It runs in your browser and needs no sign-up. With a free account, nodd hosts it as a versioned Privacy Center.
Questions
Is a privacy policy the same as a DPDP notice?
Not quite. Many privacy policies are long legal documents. A DPDP notice under Rule 3 must stand on its own, use clear and plain language, and give an itemised list of the personal data you collect with the purpose for each. Many businesses publish the notice as their privacy page.
Does the notice have to be in Hindi?
Section 5 of the Act says people must be able to read the notice in English or in any language in the Eighth Schedule to the Constitution, which includes Hindi and 21 other languages. Offering the languages your customers use is the safest approach.
Do I need a new notice for existing customers?
Yes. For people who gave consent before the Act applies, section 5(2) asks you to send them a notice as soon as reasonably practicable, so they can decide whether to continue.