How to Write a DPDP-Compliant Privacy Notice (Free Template + 12 Essential Elements)
Most Indian privacy policies were written for a different job. They sit in the footer, run to thousands of words, and borrow heavily from a GDPR template. A DPDP privacy notice is something else. Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, the notice is what makes consent valid in the first place. If the notice is vague, bundled or buried, the consent it collects is on weak ground, and so is every record built on it.
This guide covers what the law requires, a twelve-element checklist (ten items come from the Act and Rule 3, two are best practice), how a notice works as a live system, and a free template. It is written for DPOs, compliance leads and product teams preparing for the notice obligations that commence on 13 May 2027.
What the DPDP Act and Rules actually say about notice
Three provisions do most of the work.
Section 5 of the Act. Every request for consent under Section 6 must be “accompanied or preceded by” a notice from the Data Fiduciary. The notice has to tell the Data Principal (i) the personal data and the purpose for which it will be processed, (ii) how she can exercise her rights under Section 6(4) (withdrawal) and Section 13 (grievance redressal), and (iii) how she can complain to the Data Protection Board. Section 5(2) covers consent collected before the Act commenced: you must send a notice with the same information “as soon as it is reasonably practicable.” Section 5(3) requires that the notice be available in English or any language in the Eighth Schedule to the Constitution. Our plain-English breakdown of the Section 5 notice obligation goes through each clause.
Section 6(3) of the Act. The consent request itself must be in clear and plain language, offer the same English or Eighth Schedule language choice, and give the contact details of the Data Protection Officer (where applicable) or another person authorised to respond to the Data Principal.
Rule 3 of the DPDP Rules, 2025. The Rules were notified on 13 November 2025 (G.S.R. 846(E)). Rule 3 sets the content and form of the notice. It must:
- (a) be presented, and be understandable, independently of any other information the Data Fiduciary has made available;
- (b) give, in clear and plain language, a fair account of the details needed for informed consent, including at least an itemised description of the personal data, and the specified purpose along with an itemised description of the goods or services to be provided or uses to be enabled; and
- (c) give the particular communication link to the Data Fiduciary’s website or app, and describe any other means, through which the Data Principal can withdraw consent (as easily as she gave it), exercise her rights under the Act, and complain to the Board.
On timing: Rule 3 is in the group of rules that commence eighteen months after publication, which puts it at 13 May 2027. Consent Manager registration under Rule 4 opens earlier, on 13 November 2026. Reports in early 2026 said MeitY was considering a shorter timeline, but as of this writing no amendment has been notified. Check the full DPDP Rules timeline and MeitY’s site before you plan against these dates.
Two things the law does not say. It does not require a list of legal bases, as GDPR does. It also sets no separate penalty for defective notices: a notice failure falls under item 7 of the Schedule (“breach of any other provision”), with a maximum of ₹50 crore. The ₹250 crore ceiling applies to security safeguard failures under Section 8(5). The larger risk is indirect: a bad notice undermines the consent it collects, and with it the basis for everything you process afterwards.
The 12 elements your DPDP privacy notice should contain
The table splits the statutory requirements into checklist items. Elements 1–10 come from Sections 5, 6(3) and 8(9) and Rules 3 and 9. Elements 11 and 12 are not strictly required in the notice, but auditors and your own grievance team will want them.
| # | Element | Legal source | Status |
|---|---|---|---|
| 1 | Standalone presentation: understandable without reading your terms or privacy policy | Rule 3(a) | Mandatory |
| 2 | Clear and plain language | Section 6(3), Rule 3(b) | Mandatory |
| 3 | Itemised description of the personal data collected | Section 5(1)(i), Rule 3(b)(i) | Mandatory |
| 4 | Specified purpose for each data item | Section 5(1)(i), Rule 3(b)(ii) | Mandatory |
| 5 | Itemised description of the goods, services or uses the processing enables | Rule 3(b)(ii) | Mandatory |
| 6 | How to withdraw consent, as easily as it was given | Section 5(1)(ii) read with 6(4), Rule 3(c)(i) | Mandatory |
| 7 | How to exercise rights under the Act (access, correction and erasure, grievance, nomination) | Section 5(1)(ii), Rule 3(c)(ii) | Mandatory |
| 8 | How to complain to the Data Protection Board | Section 5(1)(iii), Rule 3(c)(iii) | Mandatory |
| 9 | The particular communication link (website/app) and any other means for the actions above | Rule 3(c) | Mandatory |
| 10 | Contact details of the DPO or authorised person, and an option to read the notice in English or any Eighth Schedule language | Sections 5(3), 6(3), 8(9); Rule 9 | Mandatory |
| 11 | Retention period and categories of recipients (processors, other fiduciaries) | Supports Sections 8(7) and 11(1)(b) | Recommended |
| 12 | Version number, effective date and change summary | Evidence for Section 6(10) burden of proof | Recommended |
Where teams most often go wrong:
Itemised means itemised
“We may collect your name, contact details and other information” does not meet Rule 3(b)(i). List each item (full name, mobile number, delivery address, PAN if collected) and tie it to a purpose. A table beats prose here.
Purpose is tied to the goods or service
“To improve our services” is not enough. Name the service or use, such as “to deliver your order and send delivery updates by SMS.” Marketing needs its own line and its own consent choice.
Withdrawal must mirror collection
If consent was a single tap, withdrawal cannot be an email to a generic inbox. Put the withdrawal link in the notice and test the path end to end.
Children and persons with disability
For a child’s data, Section 9 and Rule 10 require verifiable parental consent, so that notice should address the parent. The same logic applies to a lawful guardian acting for a person with disability.
How a DPDP privacy notice actually works
In a compliant setup the notice is not a page of text. It is one stage in a pipeline, and every stage has to produce evidence.
1. Input: the data inventory. The notice is only as accurate as your data map. Start from your Records of Processing Activities: each activity gives you data items, purpose, retention and recipients. If the RoPA lists Aadhaar numbers for KYC and the notice doesn’t, the notice is wrong.
2. Processing: drafting and translation. Purposes are grouped into consent-able units, written in plain language and translated. Each version gets a unique ID, and translation is a reviewed step, not a one-off export.
3. Consent capture. The notice is shown before or with the consent request. Each purpose gets its own affirmative action (no pre-ticked boxes), and the language can be switched before agreeing.
4. Consent artefact and logging. Each agreement produces a record: principal identifier, purposes accepted and declined, notice version and language, timestamp and channel. This is your consent artefact. Under Section 6(10), the fiduciary must prove that notice was given and consent obtained. The log is that proof.
5. Rights requests. Notice links lead to working channels for withdrawal, access, correction, erasure, nomination and grievances. Rule 14 caps grievance response at ninety days. A withdrawal must reach every downstream system, including processors, which is where most programmes fail. See our guide to handling data principal requests for the operational side.
6. Board complaint route. The notice must say how to complain to the Data Protection Board. Under Section 13(3), the Data Principal must first use your grievance mechanism, so the notice should point to both, in that order.
7. Monitoring and versioning. A new purpose, vendor or data item means a new notice version. New purposes need fresh consent; existing consents stay linked to the version the person saw.
Across every stage: security. Consent logs are personal data too. Protect them with access control, tamper-evidence (hash-chaining or write-once storage) and retention rules, while keeping them retrievable for audit.
A practical example
A Pune-based D2C skincare brand collects name, mobile, address and skin-type answers at checkout. Its old notice was a footer link to a long policy. Now checkout shows a short notice with three itemised purposes: order fulfilment (name, mobile, address), product recommendations (skin-type answers) and WhatsApp marketing (mobile), each with its own toggle and a Marathi/Hindi/English selector. The customer accepts the first two and declines marketing. The system records: customer ID, purposes 1–2 accepted, purpose 3 declined, notice v2.1, Marathi, timestamp, “web checkout.” Three months later she withdraws recommendations via the link in her order email. The record updates, the recommendation engine stops using her skin-type data, and the analytics vendor receives a deletion instruction. Every step leaves evidence.
Free DPDP privacy notice template
Copy it, replace everything in [SQUARE BRACKETS], and delete purposes that don’t apply. Use one notice per consent context (checkout, app onboarding, recruitment), not one for the whole company.
PRIVACY NOTICE: [SERVICE / FORM NAME]
Version [v1.0] | Effective [DD Month YYYY]
Read this notice in: English | हिन्दी | [OTHER EIGHTH SCHEDULE LANGUAGE]
WHO WE ARE
[LEGAL ENTITY NAME] ("we") is the Data Fiduciary for the personal data
described below. Website/app: [URL]
WHAT WE COLLECT AND WHY
Please review each purpose. You can agree to some and not others.
1. [PURPOSE, e.g. Deliver your order]
Data: [e.g. full name, mobile number, delivery address]
Enables: [e.g. order dispatch, delivery tracking SMS]
[ ] I agree
2. [PURPOSE, e.g. Personalised recommendations]
Data: [e.g. purchase history, skin-type quiz answers]
Enables: [e.g. product suggestions in app and email]
[ ] I agree
3. [PURPOSE, e.g. Marketing on WhatsApp/SMS/email]
Data: [e.g. mobile number, email address]
Enables: [e.g. offers and new-product messages]
[ ] I agree
HOW LONG WE KEEP IT
[e.g. Order data: [X] years after delivery, as required by
[APPLICABLE LAW]. Marketing data: until you withdraw consent.]
WHO WE SHARE IT WITH
[e.g. Courier partners, payment processor, cloud host] acting
on our instructions.
WITHDRAW YOUR CONSENT
Withdraw any time at [LINK], or [OTHER MEANS, e.g. reply STOP /
in-app Settings > Privacy]. It is as easy as agreeing. Withdrawal
does not affect processing done before it.
YOUR RIGHTS
Under the Digital Personal Data Protection Act, 2023 you can:
- get a summary of your personal data and how we process it
- ask us to correct, complete, update or erase it
- nominate someone to exercise your rights if you die or are
unable to act
- raise a grievance with us
Use: [RIGHTS PORTAL LINK] | [EMAIL] | [PHONE]
CONTACT
[Data Protection Officer / Authorised person]: [NAME or ROLE],
[EMAIL], [PHONE], [ADDRESS]
COMPLAINTS TO THE DATA PROTECTION BOARD
If you are not satisfied with how we handle your grievance, you
may complain to the Data Protection Board of India at
[BOARD PORTAL LINK, once published]. You need to use our
grievance process first.
[ Agree to selected purposes ] [ Decline all ]
Before publishing, confirm each data item matches your RoPA, the withdrawal link works without friction, translations match the English text, and the Board complaint link points to the official channel the Board publishes.
Common mistakes in DPDP notices
- Rebadging a GDPR notice. These usually skip itemised goods or services, the Board complaint route and the Eighth Schedule language option.
- One consent for everything. A single “I agree” for fulfilment, analytics and marketing fails Section 6’s specificity test.
- Linking out instead of stating. Rule 3(a) requires the notice to stand on its own. “See our Privacy Policy” is not a notice.
- Forgetting legacy users. Section 5(2) requires notice to people whose consent predates the Act. Plan the re-notice campaign early.
- Unreviewed machine translation. A Tamil notice that differs from the English one is a liability.
- No version link. If you can’t show which notice a person saw, you will struggle to meet the burden of proof in Section 6(10).
- Leaving it to legal alone. Engineering owns capture, logging and withdrawal propagation.
Platform-managed notice vs static PDF vs GDPR template
| Criterion | Platform-managed (ProtectComply approach) | Manual / static PDF notice | Generic GDPR template |
|---|---|---|---|
| Rule 3 itemisation | Drafted from org profile; still needs review against your RoPA | Depends on the drafter | Usually missing itemised goods/services |
| Eighth Schedule languages | Auto-translation into 22 languages | Manual translation, per language | Not addressed |
| Per-purpose consent capture | Hosted preference centre and embeddable widget | Must be built separately | Not addressed |
| Notice version linked to consent record | Stated on the Section 5 page: notice versions linked to consent records | Rarely; manual spreadsheets | No |
| Withdrawal channel | OTP-gated withdrawal; revoke links via WhatsApp/email in Consent-as-a-Service | Usually an email address | Generic |
| Rights and grievance | Public rights portal with SLA timer and grievance clock | Inbox-based | GDPR rights list, not DPDP-specific |
| Evidence | Timestamped, hash-chained records exportable as signed PDF receipts | Screenshots, if anything | None |
| Upfront cost | Subscription (entry plan published on the site; higher tiers on quote) | Legal drafting fees plus engineering time | Free, but high rework |
ProtectComply entries reflect capabilities listed on its features page; test them against your own flows.
Pros and cons of the ProtectComply approach
Pros
- The notice, consent capture, receipts and rights portal sit in one system, so version-to-consent linkage doesn’t depend on manual reconciliation.
- Coverage for 22 Eighth Schedule languages is built in rather than bought per language.
- Re-consent campaign tooling is aimed at the Section 5(2) legacy-user problem.
- Its website scanner includes notice among its checked domains, which helps catch drift after launch.
Cons
- AI-drafted notices and machine translations are starting points. Counsel and native-language reviewers still need to sign off.
- The output depends on how accurate your org profile and data map are. A platform cannot find a purpose nobody declared.
- OTP-gated withdrawal adds a step. If consent was one tap without OTP, check that withdrawal still meets the “comparable ease” test in Section 6(4) for your flow.
- Pricing for Pro, Max and Enterprise tiers is quote-based, so budgeting needs a sales conversation.
How we measure success
A notice is working when you can answer these questions with evidence. Use them as a quarterly review.
- Coverage: Does every consent-based processing activity in the RoPA have a live notice, and does every data item in each notice match the RoPA?
- Rule 3 conformance: Does each notice pass all ten mandatory elements when a reviewer reads it cold, without opening any other document?
- Language parity: Has each translated version been reviewed, and is its version ID the same as the English source?
- Traceability: For a random sample of consent records, can you retrieve the exact notice version and language each person saw?
- Withdrawal symmetry: Is the number of steps to withdraw less than or equal to the number of steps to consent? Test it on each channel.
- Propagation: After a withdrawal, can you show that downstream systems and processors stopped processing?
- Timeliness: Are grievances closed within the ninety-day limit in Rule 14, and are any trends feeding back into notice wording?
- Change control: Did every change in purpose or vendor since the last review trigger a notice version and, where needed, fresh consent?
Frequently asked questions
Is a DPDP privacy notice the same as a privacy policy?
No. A privacy policy describes your overall data practices. A DPDP notice under Section 5 and Rule 3 is a standalone, itemised disclosure given before or with a specific consent request, and it must make sense without the policy.
When does the notice requirement take effect?
Rule 3 of the DPDP Rules, 2025 commences eighteen months after the Rules were published on 13 November 2025, which is 13 May 2027. Check MeitY for any notified change to this schedule.
Do I need a notice if I process data under a legitimate use?
The Section 5 notice is tied to consent requests under Section 6. Processing under a Section 7 legitimate use doesn’t need consent, so Section 5 doesn’t apply in the same way, but your other obligations under the Act still do.
Which languages must the notice be available in?
The Data Principal must have the option to access it in English or any of the 22 languages in the Eighth Schedule to the Constitution. A language selector is the usual way to offer this.
What about customers who consented before the Act?
Section 5(2) requires you to send them a notice with the same core information as soon as reasonably practicable. You can continue processing until they withdraw consent.
What is the penalty for a non-compliant notice?
The Schedule sets no separate penalty for notices. A notice breach falls under item 7, “breach of any other provision”, with a maximum of ₹50 crore. Defective notices can also undermine the validity of the consent they collect.
Does the notice have to name the Data Protection Officer?
Section 6(3) requires the consent request to include the contact details of the DPO where applicable, or of another person you authorise to respond to the Data Principal. A named role with a working email and phone is sufficient.
Next step
Start by mapping your highest-volume consent flows against Rule 3. Then work out what your consent management setup must actually do to capture and prove consent. To see how notices, consent records and rights requests connect in one workflow, talk to the ProtectComply team and bring one of your real consent flows to the conversation.
Disclaimer: This article is general information about the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as understood at the time of writing. It is not legal advice. Read the primary texts on India Code and the DPDP Rules, 2025 published by MeitY, see the PIB release on the notified Rules, and consult qualified counsel before relying on any template.