Free tool · Section 5 and Rule 3
DPDP privacy notice checker
Paste a privacy notice and see, requirement by requirement, what the DPDP Act and Rules ask of it and what the text is missing. Each finding highlights the words it rests on and cites the provision.
By Suryansh Sagar. The same phrase rules as the Gevox website scanner. Last checked 5 October 2026.
Runs in your browser. Nothing you paste is sent or stored.
A fictional notice with deliberate gaps. Replace it with your own.
- Words
- 141
- Sentences
- 8
- Avg sentence
- 17.6 words
- Reading
- 1 min
Section 5 and Rule 3 requirements
5 of 9 met
States 2 specific purposes, but also open-ended wording such as "business purposes". Consent must be specific to a specified purpose (Section 6(1)).
Add: Name each purpose and the service it makes possible, for example: "to deliver your order", "to send payment receipts". Remove catch-all phrases.
4 highlighted in the textRead Rule 3(b)(ii)
A text check against the minimum content of Section 5 and Rule 3. It cannot confirm that the notice matches what the business actually collects and does, or how it is presented on the page.
What the law asks
Seven things every DPDP notice must give
- 01
An itemised description of the personal data, and the specified purposes with a specific description of the goods, services or uses each enables.
Section 5(1)(i), Rule 3(b) - 02
How to withdraw consent, with ease comparable to giving it, and how to exercise the rights of access, correction and erasure, grievance redressal and nomination.
Section 5(1)(ii), Rule 3(c)(i) and (ii) - 03
How to make a complaint to the Data Protection Board of India.
Section 5(1)(iii), Rule 3(c)(iii) - 04
The particular communication link, a web page or address, where the reader can act.
Rule 3(c) - 05
The contact details of a Data Protection Officer, where applicable, or a person authorised to respond.
Section 6(3) - 06
The option to read the notice in English or any language in the Eighth Schedule to the Constitution.
Section 5(3) - 07
Clear and plain language, understandable on its own without reference to any other document.
Rule 3(a) and (b)
Questions
Common questions on DPDP notices
What must a privacy notice contain under the DPDP Act?
Section 5(1) requires the notice to state the personal data and the purpose of processing, the manner of exercising rights under Sections 6(4) and 13, and the manner of complaining to the Data Protection Board. Rule 3 of the DPDP Rules 2025 adds that it must be understandable independently, in clear and plain language, with an itemised description of the data, the specified purposes, and the communication link and means to withdraw consent, exercise rights and complain to the Board.
Is my notice uploaded anywhere?
No. The checker runs entirely in your browser. The text is not sent to Gevox or anyone else, and it is not stored.
Can I use a GDPR privacy policy for India?
Not as it stands. A GDPR policy usually relies on grounds such as legitimate interests, which the DPDP Act does not recognise; the Act allows processing on consent or for the certain legitimate uses in Section 7. GDPR policies also tend to omit the complaint to the Data Protection Board and the right to nominate under Section 14.
When does Rule 3 apply?
Rule 3 comes into force on 13 May 2027, with most of the DPDP Rules 2025. Section 5 of the Act sets out the same core content.
Does passing every check make a notice compliant?
No. The checker reads the words. It cannot confirm the notice matches what the business actually collects and does, or how it is shown to people. Those are judgements for the professional advising the business.
Gevox drafts the notice for each client from fixed templates.
Every clause is tied to the section or rule it satisfies, built from the client’s own intake answers, so the same answers always give the same notice. Also see the notice template and the deadline calculator.