top of page
Search

How to Draft a DPDP Notice That Meets Rule 3 of the DPDP Rules 2025

Writer: Kaustav Chowdhury
Kaustav Chowdhury
18 minutes ago
6 min read

A DPDP notice is not a privacy policy. It is the specific document that must accompany or precede every request for consent, and rule 3 of the Digital Personal Data Protection Rules, 2025 prescribes what it has to contain. Section 6(10) of the Digital Personal Data Protection Act, 2023 then puts the burden of proving that the notice was given on the data fiduciary, which is why the drafting and the record keeping are one exercise.

Step 1: Separate the Notice From the Policy

Section 5 requires that every request for consent be accompanied or preceded by a notice informing the data principal of the personal data and the purpose for which it is proposed to be processed, the manner in which she may exercise her rights under section 6(4) and section 13, and the manner in which she may make a complaint to the Board.

Rule 3(a) then requires the notice to be presented, and to be understandable, independently of any other information. A clause buried in a terms of use document, or a notice that only makes sense once the reader has opened the privacy policy, does not satisfy that. The practical answer is a standalone artefact for each consent event, rendered at the point of collection.

Both provisions commence with the eighteen month tranche. By G.S.R. 843(E) dated November 13, 2025, sections 3 to 5 and most of section 6 come into force eighteen months after publication, and rule 3 sits in the matching group under G.S.R. 846(E) of the same date, so the operative date is in May 2027 rather than November 2026.

Step 2: Itemise the Personal Data

Rule 3(b) requires the notice to give, in clear and plain language, a fair account of the details necessary for the data principal to give specific and informed consent, and at a minimum an itemised description of the personal data. Itemised is the operative word: a category label such as contact details or usage data is not an item.

So the drafting input is a field level inventory, built from the collection forms and the data model rather than from the marketing copy. Where a field is optional, say so, because section 6(1) limits consent to the personal data necessary for the specified purpose and an unexplained optional field invites the argument that it was not.

Step 3: State the Specified Purpose Against the Service

The second limb of rule 3(b) requires the specified purpose and an itemised description of the goods or services to be provided, or the uses to be enabled, by that processing. The notice therefore has to connect each purpose to something the data principal actually receives.

That connection is what makes a purpose specific. Processing for business purposes or to improve our services names no good, service or use and will not hold. Where one data set serves several purposes, list them separately, because consent is given purpose by purpose and a bundled purpose cannot be partly withdrawn.

Step 4: Build the Three Routes Rule 3(c) Requires

Rule 3(c) requires the notice to give the communication link for the data fiduciary's website or app, and a description of other means, by which the data principal may withdraw her consent with the ease of doing so being comparable to that with which it was given, exercise her rights under the Act, and make a complaint to the Board.

Three separate routes, each of which has to exist before the notice can truthfully describe it. The withdrawal route is the one most often missing, and section 6(4) independently requires the comparable ease. Describing a route that resolves to a generic support inbox is a drafting problem and an operational one at the same time.

Step 5: Get the Language and the Contact Point Right

Section 6(3) governs the consent request itself. It must be presented in clear and plain language, giving the data principal the option to access the request in English or any language specified in the Eighth Schedule to the Constitution, and providing the contact details of a data protection officer where applicable, or of any other person authorised by the data fiduciary to respond to communications about the exercise of her rights.

The language option is a build item rather than a translation task, because the option has to be available at the moment of the request. Decide which Eighth Schedule languages the product will carry, and record the reasoning, rather than discovering the question during a complaint.

Step 6: Make the Notice Provable

Section 6(10) provides that where consent is the basis of processing and a question arises in a proceeding, the data fiduciary is obliged to prove that a notice was given and that consent was given in accordance with the Act and the rules. The burden is on the fiduciary, not on the data principal.

Discharging it means versioning. Store the exact text rendered, the language served, the timestamp, and the identifier of the data principal, and keep the mapping from each consent record to the notice version that accompanied it. A current notice on a website proves nothing about what a user saw two years ago.

Step 7: Decide What Happens to Consent Already Collected

Consent collected before the obligations commence was not collected against rule 3, and section 6(2) provides that any part of a consent which infringes the Act or the rules is invalid to the extent of the infringement. That makes the legacy consent base a distinct workstream rather than a footnote.

Decide, purpose by purpose, whether the existing record would survive the test and where a fresh notice and consent are needed. Doing that before commencement is cheaper than doing it under a grievance, and the analysis itself is the document that shows the decision was considered.

Common Pitfalls to Avoid

  • Treating the privacy policy as the notice: Rule 3(a) requires the notice to be presented and understandable independently of any other information.

  • Describing data by category: Rule 3(b) requires an itemised description. A field level inventory is the input, not a list of broad headings.

  • Naming a purpose with no service attached: The rule requires an itemised description of the goods or services provided or the uses enabled by the processing.

  • Bundling purposes into one consent: Consent under section 6(1) is specific. A bundled purpose cannot be withdrawn in part, which is a problem for the fiduciary as much as the data principal.

  • Describing a withdrawal route that does not exist: Rule 3(c) and section 6(4) both require it, and the ease has to be comparable to the ease of giving consent.

  • Ignoring the language option: Section 6(3) requires the option of English or an Eighth Schedule language at the point of the request.

  • Keeping only the current version: Section 6(10) puts the burden of proving the notice on the fiduciary, so each consent record has to point at the notice version that accompanied it.

Key Statutory Provisions

  • Section 5 of the Digital Personal Data Protection Act, 2023: Every request for consent must be accompanied or preceded by a notice stating the personal data and purpose, the manner of exercising rights, and the manner of complaining to the Board.

  • Section 6 of the Act: The standard of consent in sub-section (1), the invalidity of an infringing part in sub-section (2), the language and contact point requirements in sub-section (3), withdrawal with comparable ease in sub-section (4), and the burden of proving notice and consent in sub-section (10).

  • Section 13 of the Act: The right to readily available means of grievance redressal, the manner of whose exercise the notice must describe.

  • Rule 3 of the Digital Personal Data Protection Rules, 2025: The notice must be understandable independently of other information, give in clear and plain language an itemised description of the personal data and of the goods, services or uses enabled by the specified purpose, and give the link and other means to withdraw consent, exercise rights and complain to the Board.

Sources and References


Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.

Comments

bottom of page