Glossary
What is a notice under DPDP?
A notice tells the Data Principal what you will collect and why. Every request for consent must come with one.
Definition
A notice under s.5 of the DPDP Act, 2023 is the information a Data Fiduciary gives with every request for consent. Rule 3 requires it to be understandable on its own, in clear and plain language, with an itemised description of the personal data and specified purposes, and the means, with a link, to withdraw consent, exercise rights and complain to the Board. The notice can be read in English or any of the 22 languages of the Eighth Schedule (s.5(3)).
What it means
The notice tells the Data Principal what you will collect, why, and what that processing enables, and how to withdraw consent, use their rights and complain to the Board. Withdrawing must be comparably as easy as giving consent (Rule 3).
For personal data collected before commencement, give a notice as soon as reasonably practicable (s.5(2)). See the privacy notice guide.
Where it appears in the Act and Rules
| Requirement | Source |
|---|---|
| Comes with every request for consent | s.5 |
| Understandable on its own, in clear and plain language | Rule 3 |
| Itemised description of the personal data and the specified purposes | Rule 3 |
| Itemised description of the goods, services or uses the processing enables | Rule 3 |
| Means, with a link, to withdraw consent, exercise rights and complain to the Board | Rule 3 |
| Readable in English or any Eighth Schedule language | s.5(3) |
| For data collected before commencement, as soon as reasonably practicable | s.5(2) |
Common misconceptions
- “A link to the privacy policy is enough.” Rule 3 requires a notice that is understandable on its own, with itemised data and purposes.
- “Existing users can be skipped.” s.5(2) requires a notice for data collected before commencement, as soon as reasonably practicable.
- “English alone will do.” Under s.5(3), the notice can be read in English or any of the 22 Eighth Schedule languages.
Related terms
Free, specific, informed, unconditional and unambiguous, with a clear affirmative action (s.6).
Purpose limitationUsing personal data only for the specified purpose (s.4, s.6, s.8(7)).
Data Principal rightsAccess, correction, erasure, grievance redressal and nomination (ss.11 to 14).
Verifiable consentChecked consent of a parent or lawful guardian (s.9(1), Rules 10 and 11).
In TruePrivacy
The consent banner ships interface text in English and all 22 Eighth Schedule languages; you write and review your own notice text. Notice campaigns send bulk notice and re-consent campaigns by email, useful for the s.5(2) notice to existing users.
What must a DPDP notice contain?
Rule 3 asks for an itemised description of the personal data and the specified purposes, the goods, services or uses the processing enables, and the means, with a link, to withdraw consent, exercise rights and complain to the Board.
Do existing customers need a notice?
Yes. For personal data collected before commencement, s.5(2) requires a notice as soon as reasonably practicable.
In which languages must the notice be available?
The notice can be read in English or any of the 22 languages of the Eighth Schedule (s.5(3)).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin