DPDP privacy notice requirements: the Rule 3 checklist
Updated · Rotomal
Under Rule 3 of the DPDP Rules, the notice you give before asking for consent must be understandable on its own, in clear and plain language, and include at least an itemised description of the personal data and the specific purposes and services it is for. It must also give a link to your website or app and explain how people can withdraw consent as easily as they gave it, exercise their rights under the Act and complain to the Data Protection Board.
The Rule 3 checklist
| Rule 3 requires | In practice |
|---|---|
| Understandable independently of other information | A stand-alone notice at the point of collection, not a clause buried in terms and conditions |
| Clear and plain language, a fair account to allow specific and informed consent | Short sentences, no legal shorthand, one purpose per line |
| An itemised description of the personal data | Name, mobile number, email, address, date of birth, health details: each listed |
| The specified purposes and the goods, services or uses enabled | For example: delivering your order; sending appointment reminders; marketing messages (optional) |
| A link to your website or app, and other means to withdraw consent with comparable ease | An unsubscribe or withdraw link as easy as the tick box that gave consent |
| How to exercise rights under the Act | Where to ask for access, correction, update or erasure |
| How to complain to the Board | A line pointing to the Data Protection Board of India's complaint route |
Also required from May 2027
- Rule 9: publish prominently on your website or app the business contact of your Data Protection Officer, if you have one, or of a person who can answer questions about your processing, and include it in every reply to a rights request.
- Requests to access, correct, update or erase data must be answered within ninety days.
- For children, verifiable consent of a parent is needed before processing their data (Rule 10).
Common gaps in small business notices
- A copied privacy policy that lists purposes the business does not have, and misses the ones it does.
- Consent bundled into terms of sale, with no separate choice for marketing.
- No withdrawal route, or one that is much harder than giving consent.
- No named contact for privacy questions.
- WhatsApp, offline registers and staff data left out entirely.
Get a notice that matches your business
DPDP Ready maps where your business collects personal data and writes the notice, consent wording and contact text for each point, checked by a person. Data check of your website for ₹499; ₹2,999 for one site with up to 5 forms or flows.
Questions
Is a privacy policy enough?
Not on its own. Rule 3 asks for a notice that can be understood independently, itemises the data and purposes, and is given with or before the consent request.
Does the notice have to be in Indian languages?
The Act requires an option to access the notice in English or any language in the Eighth Schedule to the Constitution. Offer the languages your customers use.
Do I need consent for everything?
No. The Act allows processing for consent or for certain legitimate uses it lists. Marketing and optional extras usually rely on consent.
When does Rule 3 apply?
Eighteen months after the Rules' publication in November 2025, which most advisers put at 13 May 2027.
Can I use a free template?
Yes, as a start. The work is making the itemised data and purposes match what your business actually collects and does.
Sources
- MeitY: Digital Personal Data Protection Rules, 2025 (Rules 3, 9 and 10) Source: meity.gov.in
- MeitY: Digital Personal Data Protection Act, 2023 Source: meity.gov.in
- PIB backgrounder: DPDP Rules, 2025 Notified (17 November 2025) Source: static.pib.gov.in