Writing your DPDP privacy notice: what Rule 3 asks, step by step

What Rule 3 asks

• The notice must make sense on its own, without the reader needing your other documents (Rule 3(a)).
• In clear and plain language it lists, item by item, the personal data you ask for, and for each purpose what the processing lets you provide or do (Rule 3(b)).
• It gives the link to your website or app, and any other means, by which the person can withdraw consent as easily as they gave it, use their rights under the Act, and complain to the Data Protection Board of India (Rule 3(c)).

Rule 3 applies from 13 May 2027.

The steps

1. List every item of personal data you ask for: in forms, at checkout, in your app, at the counter.
2. Write down why you ask for each item. Each purpose is its own line, so a person can consent to one without the others.
3. Set up a page or form to withdraw consent, and one to ask for access, correction, erasure or a nominee. They can be the same page.
4. Name who answers questions about the data (your Data Protection Officer if you are a Significant Data Fiduciary, Rule 9), and the days you take to answer a grievance: at most 90 (Rule 14(3)).
5. Give the notice before you ask for consent, or with the request (section 5(1)). Link it wherever you ask for personal data.
6. Let the reader choose English or any language of the Eighth Schedule of the Constitution (section 5(3)).
7. If people gave consent before the Act came into force, send them the notice as soon as reasonably practicable, for example by email or an in-app message (section 5(2) and its illustration).

How the kit does this

The generator asks for steps 1 to 4 in one form. It refuses a notice with a missing link, an item no purpose uses or a purpose without data, then writes the notice in English and the Indian languages it has. You put the page on your site and link it (steps 5 to 7).

Write my notice

What a notice does not cover

• The consent itself: the notice informs, consent is the person's clear yes to each purpose (section 6).
• Security safeguards (Rule 6), and telling the Board and the people affected about a personal data breach (Rule 7).
• Erasing data once its purpose is no longer served (Rule 8).
• How you verify the consent of a child's parent or lawful guardian (Rule 10); the notice only says you will ask for it.
• Consent Managers (Rule 4) and the further duties of a Significant Data Fiduciary (Rule 13).

Questions