Section 5 · Rule 3
DPDP notices for Indian Data Principals
Every consent request under the DPDP Act comes with a notice. TruePrivacy shows it where consent is asked and helps you reach people whose data you already hold.
Sample workspace
Notice campaign NC-014
- AudienceExisting customers
- ChannelEmail
- Asks for re-consentYes
- Basiss.5(2)
Campaign
- Notice text written and reviewed
- Audience selected
- Send campaign by email
Short answer
Under s.5 of the DPDP Act, every request for consent comes with a notice, which can be read in English or any of the 22 Eighth Schedule languages (s.5(3)). Rule 3 asks for clear and plain language, an itemised description of the personal data and purposes, and links to withdraw consent, exercise rights and complain to the Board. For data collected before commencement, give notice as soon as reasonably practicable (s.5(2)); TruePrivacy sends those notices by email campaign.
What notices in TruePrivacy cover
The consent banner carries your notice text, which you write and review, on web and in iOS, Android and React Native apps.
Banner interface text ships in English and all 22 Eighth Schedule languages (s.5(3)).
Bulk notice and re-consent campaigns by email, useful for the s.5(2) notice to people whose data you held before commencement.
Write the notice from the purposes you define in consent management, so the itemised list matches what you record.
Point the withdrawal and rights links Rule 3 asks for to your privacy center and preference page.
How to publish a DPDP notice
- 01Draft the text
Write in clear and plain language, itemising the personal data, each purpose and what the processing enables. The privacy notice generator can help you start a draft.
- 02Review the languages
Decide which of the 22 Eighth Schedule languages your users need. Banner interface text already ships in all of them; the notice text is yours to write and review.
- 03Show it with each consent request
Publish the banner on web and in apps so the notice appears wherever you ask for consent (s.5).
- 04Reach existing users
Run an email campaign for the s.5(2) notice and, where needed, ask for consent again.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| A notice with every consent request | s.5 | Banner on web, iOS, Android and React Native carrying your notice text |
| Notice readable in English or an Eighth Schedule language | s.5(3) | Banner interface text in English and all 22 Eighth Schedule languages |
| Itemised personal data and purposes, in clear and plain language | Rule 3 | Purposes defined once in consent management; you write the notice text |
| Links to withdraw consent, exercise rights and complain to the Board | Rule 3 | Preference page and privacy center to link to; you add the route to complain to the Board |
| Notice for data collected before commencement | s.5(2) | Bulk notice and re-consent campaigns by email |
Limits of notices in TruePrivacy
Notice campaigns send by email only today. TruePrivacy does not write your notice: you write and review the text, and the banner's interface translations do not translate it. Check the final text with counsel.
Rule 9 also asks you to publish, on your website or app, the business contact of the person who can answer questions about processing, or of the DPO for a Significant Data Fiduciary.
Works with
Consent per person and purpose, with receipts and an event log.
Cookie consentThe banner and SDKs that carry your notice on web and in apps.
Privacy centerWhere your notice links send people to withdraw consent and exercise rights.
Purpose limitationKeep the purposes in your notice in step with consent and retention.
What must a DPDP notice contain?
Rule 3 asks for an itemised description of the personal data and the specified purposes, the goods, services or uses the processing enables, and the means to withdraw consent, exercise rights and complain to the Board. It must be understandable on its own, in clear and plain language.
Which languages can a DPDP notice be in?
Section 5(3) lets the Data Principal read the notice in English or any of the 22 languages of the Eighth Schedule.
Do people whose data I already hold need a notice?
Section 5(2) covers data collected before commencement: give notice as soon as reasonably practicable. TruePrivacy sends these notices by email campaign.
Which channels do notice campaigns use?
Email only today.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin