Drafting a DPDP privacy notice

Privacy notice or consent notice

Section 5 requires every request for consent to come with, or be preceded by, a notice, and Rule 3 sets what that notice must contain. Your privacy notice is the complete public version: it covers every purpose, including those that rest on legitimate uses (s.7), and each consent notice links to it.

The privacy notice is also the natural home for what the Rules make you publish: the contact who answers questions about processing (Rule 9), how to make a request and the identifier needed (Rule 14), and your grievance response period, which cannot exceed 90 days (Rule 14(3)).

What to include

The sample column is illustrative, for a fictional company. Replace it with your own facts.

Steps to draft the notice

1. 01Start from your inventory

   List the personal data you hold and every purpose, from your records of processing. A notice written from memory misses purposes.

2. 02Sort purposes by ground

   Mark each purpose as consent (s.6) or a named legitimate use (s.7). Stop any purpose that fits neither.

3. 03Itemise

   Write the data and purposes as lists, not as one long paragraph, and say what each purpose enables (Rule 3).

4. 04Write plainly

   Use short sentences and everyday words, so the notice is understandable on its own (Rule 3). Test it on someone outside legal.

5. 05Add the links

   Link to withdrawal, rights requests and the route to the Board (Rule 3), and add the Rule 9 contact and the grievance period.

6. 06Review and publish

   Have counsel review it, publish it with a version number and date, and keep every past version.

7. 07Notify existing users

   For data collected before commencement, send a notice as soon as reasonably practicable (s.5(2)) and record who received it.

Use a layered structure

A layered notice puts a short summary first: what you collect, why, and how to withdraw, make a request or complain. The full detail sits below it or one tap away. Each layer must still make sense on its own, because Rule 3 asks for a notice that is understandable on its own.

English, Hindi and other languages

Under s.5(3), the notice can be read in English or any language of the Eighth Schedule, which lists 22 languages including Hindi. Choose languages from where your users are and the languages your product already supports.

• Keep one master text and translate from it, so versions do not drift apart.
• Use a qualified translator, and have a native speaker check legal terms in context.
• Give every language version the same version number and publish them together.
• Let people switch language from the notice itself, not only from settings.
• Check that Devanagari and other scripts render correctly on low-cost phones.

Before you publish

• Every purpose in the notice matches your records of processing
• Data and purposes are itemised
• Links to withdraw, exercise rights and complain to the Board work
• Rule 9 contact and grievance period are shown
• Language versions match the master text
• Past versions are archived with dates
• The s.5(2) notice plan for existing users is approved

How TruePrivacy helps

TruePrivacy helps you deliver the notice and keep evidence of it. Notice campaigns send bulk notice and re-consent campaigns by email, which suits the s.5(2) notice to existing users. The consent banner ships interface text in English and all 22 Eighth Schedule languages; you write and review your own notice text.

The privacy center gives people one place to make requests and manage preferences, which is where your notice's rights links can point. Records of processing keeps the purpose list your notice is built from. Related tool: the privacy notice generator.