Template · Notice
DPDP privacy notice: what it must contain
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
A notice under Section 5 must accompany or precede every request for consent, be understandable on its own, itemise the personal data and state the specified purpose, and give the specific means to withdraw consent, exercise rights and complain to the Board. Rule 3 sets the contents; a policy written before 2025 rarely meets them.
From the Gevox Readiness Index: Eight of twenty advisor websites have no DPDP-compliant privacy notice; eight publish no privacy contact.
Why a policy is not a notice
A privacy policy describes practices in general terms. A notice is addressed to one Data Principal about one consent: this data, this purpose, this way out. Rule 3 requires it to be a standalone document or a clearly separable part of one, presented in clear and plain language, and independently understandable.
What a checklist misses
A checklist asks whether a privacy policy exists. The Act asks whether the notice itemises the data (not "information you provide"), states a specified purpose (not "to improve our services"), and carries the three routes: withdrawal, rights, and the Board. The scanner tests a site’s published notice for those concepts; eight of twenty advisor sites had none of them.
What it must contain
- 01Standalone and plainUnderstandable on its own, without reference to another document, in clear and plain language.Rule 3(a), 3(b)
- 02The personal data, itemisedAn itemised description of the personal data being collected: name, phone number, IP address, and so on, not categories.Rule 3(b)(i)
- 03The specified purpose, with what it enablesThe purpose of processing and an itemised description of the goods, services or uses it enables.Rule 3(b)(ii), Section 5(1)(i)
- 04How to withdraw consentThe specific communication link, website, app or other means to withdraw, as easily as consent was given.Rule 3(c)(i), Section 6(4)
- 05How to exercise rightsThe means to access, correct, erase, nominate and seek grievance redressal.Rule 3(c)(ii), Section 5(1)(ii)
- 06How to complain to the BoardThe means to make a complaint to the Data Protection Board of India.Rule 3(c)(iii), Section 5(1)(iii)
- 07Language optionAvailable in English or any language in the Eighth Schedule, at the Data Principal’s option.Section 5(3)
- 08Existing data coveredA notice to Data Principals whose data was collected before commencement, as soon as reasonably practicable.Section 5(2)
What Gevox generates
An unedited excerpt from a document Gevox produced for a fictional client from its intake answers: Consent notice. Every client gets its own, built from its own answers, with each clause tied to the provision it satisfies.
2. WHY WE ARE ASKING (SPECIFIC PURPOSE)
We are requesting your personal data for the following specific purpose:
To create your account and deliver your orders
We will not use the data collected here for any other purpose without asking you again.
3. WHAT WE COLLECT AT THIS STEP
At this step, we collect only the following personal data:
Full name, Mobile number, Email address, Delivery address
4. ADDITIONAL USES OF THIS DATA
In addition to the main purpose above, the data collected here also enables the following, each of which is disclosed to you separately as required by Section 6(1):
Sending you offers by email (optional, separate tick box)
5. YOUR RIGHT TO WITHDRAW
You may withdraw this consent at any time. Withdrawing is as easy as giving consent, and withdrawal will not affect the lawfulness of any processing carried out before you withdrew.
How to withdraw: Account settings > Privacy > Withdraw consent, or email privacy@northline.example.
What happens if you withdraw: We will close your account; orders already placed are still delivered
Excerpt. The full document continues.
01
Answer the intake
The client, or you for them, answers questions about their data, purposes and vendors.
02
Gevox drafts it
Fixed templates fill from those answers. The same answers always give the same document, and gaps are flagged, not guessed.
03
Hand it over
Export to Word or PDF. On Suite and Firm it carries your firm’s name.
Sample structure
A structure, not statute wording. Each block is one Rule 3 element. Gevox generates the full notice from a client’s actual data map, cited to the section.
What we collect
Your name, email address, phone number, the pages you visit on this site, and your IP address and device type.
Why
To respond to your enquiry, to provide the service you asked for, and, only if you tick the box, to send you our newsletter.
Who else receives it
Our form provider, our email provider and our hosting provider, each under a contract that binds them to keep it secure. Data is stored in India.
Withdrawing consent
Use the link at the foot of any email or the Privacy choices control on this site. Withdrawal is as easy as giving consent was.
Your rights
Ask for a summary of your data, correction or erasure at the address below. We answer within thirty days.
Complaints
Contact our grievance officer at the address below first. If unresolved, you may complain to the Data Protection Board of India.
Questions people ask
- Can the notice be part of the privacy policy page?
- Yes, if it is a clearly separable part that a reader can understand on its own, per Rule 3.
- Does it need to be in Hindi?
- Section 5(3) gives the Data Principal the option of English or any Eighth Schedule language. Offer the option; provide the translation on request or by default for your audience.
- Do we need one notice per purpose?
- One notice can carry several purposes, but consent must be specific to each, and bundling a required purpose with an optional one makes consent conditional.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.