Question · Notice
DPDP privacy notice requirements: what Rule 3 asks for
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
Section 5 requires a notice with or before every consent request, and Rule 3 sets what it contains: a standalone, plain-language document that itemises the personal data, states the specified purpose and what it enables, and gives the specific means to withdraw consent, exercise rights and complain to the Board. A pre-2025 privacy policy almost never meets it.
From the Gevox Readiness Index: Eight of twenty advisor websites have no DPDP-compliant privacy notice; eight publish no privacy contact.
The five things it must say
- An itemised description of the personal data collected, not categories.
- The specified purpose and an itemised description of the goods, services or uses it enables.
- The specific link or means to withdraw consent, as easily as it was given.
- The means to exercise the rights of access, correction, erasure, nomination and grievance redressal.
- The means to complain to the Data Protection Board of India.
The two things it must be
Understandable on its own, without reference to any other document. Available in English or any Eighth Schedule language at the Data Principal’s option, under Section 5(3).
Where policies fail
"Information you provide to us" is not itemised. "To improve our services" is not a specified purpose. A policy that never mentions the Board, the withdrawal route or the rights route fails three of the five. The scanner checks a site’s notice for these concepts; eight of twenty advisor sites had a policy that carried none of them.
Questions people ask
- Do we need a separate notice for each form?
- The notice must cover the consent being requested. One notice can serve several forms if it itemises the data and purposes for each; a generic policy cannot.
- Does the notice need to name our vendors?
- Rule 3 requires the processing to be described in a way the Data Principal can understand. Naming the categories of processor and where data goes is the practical minimum; naming them is better.
- What about data we collected before the Act?
- Section 5(2) requires a notice to those Data Principals as soon as reasonably practicable after commencement.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.