How to write a DPDP-compliant privacy notice

What the notice must contain

The DPDP Act and Rule 3 of the DPDP Rules, 2025 require a notice that:

• Stands on its own, separate from other information, and is clear and in plain language.
• Gives an itemised description of the personal data to be processed.
• States the specific purpose of processing and the goods, services or uses it enables.
• Explains how to withdraw consent, with a link or means as easy as giving it.
• Explains how to exercise rights and raise a grievance.
• Explains how to complain to the Data Protection Board of India.

Languages

The person must be able to read the notice in English or in any of the 22 languages listed in the Eighth Schedule to the Constitution. In practice, offer the languages your customers actually use, and be ready to provide the others.

Consent that already exists

Where people gave consent before the Act applied, you must send them a notice as soon as reasonably practicable. You may keep processing until they withdraw consent, so plan a notice campaign for your existing customer base.

Common mistakes

Notices often fail because they:

• Bundle several purposes into one "I agree" button.
• Use pre-ticked boxes or hide consent inside terms of service.
• List vague purposes such as "business purposes" or "to improve our services".
• Include clauses that waive the person's rights, which the Act makes invalid.
• Are updated without keeping the old version, so you cannot prove what someone saw.

Keeping notices under control

Treat notices like code: versioned, reviewed and published deliberately. ConsentLo versions every notice, checks it for clauses the Act invalidates before publishing, serves it in Indian languages and links each consent to the exact version shown.