1. Home
  2. Tools
  3. Privacy notice generator for DPDP

Free tool

Privacy notice generator for DPDP

Answer a few questions and get a draft notice laid out the way Rule 3 asks. Review it with counsel before you publish.

Use the tool All tools

Updated 4 Nov 2026

Short answer

Under s.5 and Rule 3, a notice must be understandable on its own, in clear and plain language, itemise the personal data, the purposes and the goods, services or uses they enable, and give the means to withdraw consent, exercise rights and complain to the Board. This generator turns your answers into a draft notice in that structure, in your browser. It is a starting point, not legal advice: review the draft with counsel before you publish.

Enter your organisation's details, the personal data you collect, why you collect it and the languages you plan to offer. The tool drafts a notice structured on Rule 3. Everything stays in your browser. Review the draft with counsel before you publish it.

Draft for review with counsel

Privacy notice: [Organisation name] 1. The personal data we process • [List each item of personal data] 2. Why we process it • [Each specified purpose, and the goods, services or uses it enables] 3. Your consent and how to withdraw it You can withdraw your consent at any time at [where]. Withdrawing is as easy as giving consent. Withdrawal does not affect processing done before it. 4. Your rights Under the Digital Personal Data Protection Act, 2023 you can ask for a summary of your personal data and how we process it (section 11); ask us to correct, complete, update or erase it (section 12); nominate another person to exercise your rights in the event of your death or incapacity (section 14); and raise a grievance (section 13). Make a request at [where]. 5. Grievances and complaints Write to [grievance contact]. We respond within 90 days. If you are not satisfied after using our grievance process, you may complain to the Data Protection Board of India. 6. Questions For questions about how we process your personal data, contact [contact]. 7. Languages This notice is available in English.

What Rule 3 asks a notice to contain

  • Text that is understandable on its own, in clear and plain language
  • An itemised description of the personal data and the specified purpose for which it is processed
  • An itemised description of the goods, services or uses that the processing enables
  • The means, with a link, to withdraw consent, comparably as easy as giving it
  • The means to exercise rights under the Act
  • The means to complain to the Data Protection Board

Under s.5(3), the Data Principal can choose to read the notice in English or any of the 22 languages in the Eighth Schedule. Every consent request comes with a notice (s.5), as the consent notice guide explains.

What the generator asks and produces

You enter your organisation's name, a contact email, a grievance contact, the personal data items you collect, the purposes, the services they enable and the languages you plan to offer.

It then drafts a notice structured on Rule 3. Your answers stay in your browser, and nothing you type is sent anywhere.

If you offer the notice in Eighth Schedule languages, have each translation checked by someone fluent before you publish it.

Review with counsel before you publish

Educational, not legal advice

The draft is educational, not legal advice and not a certification. It cannot see your processing, any legitimate uses you rely on (s.7), children's data (s.9) or your sector regulator's directions. Have counsel review the draft before you publish it.

  • Every data item and purpose matches what your systems actually do
  • Withdrawal is as easy as giving consent, and the link works
  • The contact who answers questions about processing is the one you publish under Rule 9
  • The grievance route matches your published process

How TruePrivacy helps

Notice campaigns send notices and re-consent requests by email, which helps with the s.5(2) notice to people whose data you collected before commencement.

The consent banner ships its interface text in English and all 22 Eighth Schedule languages; you write and review your own notice text. Data discovery shows what personal data you hold, so the itemised list matches reality.

Sources

  • Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
  • Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025

Updated 4 Nov 2026. Educational information, not legal advice.

Questions, answered

Educational, not legal advice.

All DPDP FAQs
What must a DPDP privacy notice include?

Rule 3 asks for an itemised description of the personal data and specified purposes, the goods, services or uses the processing enables, and the means to withdraw consent, exercise rights and complain to the Board, in clear and plain language.

Can I publish the generated notice as it is?

No. Treat it as a draft and have counsel review it against your actual processing before you publish it.

In which languages must the notice be available?

Under s.5(3), the Data Principal can choose to read it in English or any of the 22 languages in the Eighth Schedule.

Is what I enter stored?

No. The generator runs in your browser and nothing you type is sent anywhere.

Keep reading

Your DPDP plan, starting today

Core obligations for data fiduciaries begin on 13 May 2027.

13 May 2027

Core obligations begin

Start your readiness assessment See pricing in INR