Itemised Notice
A notice that lists each category of personal data and each purpose separately, instead of using vague wording.
An itemised notice is a privacy notice that names each kind of personal data you collect and the specific reason for using each one. It replaces vague phrases like "for business purposes" with a plain list a person can actually check.
Meaning of Itemised Notice
Rule 3 asks for an itemised description of the personal data and the specific purpose of processing each item. "We may use your data for business purposes" does not meet this standard. A person should be able to see exactly what is collected and why.
The word "itemised" comes from Rule 3 of the DPDP Rules 2025, which fills in what Section 5 of the Act asks for. Section 5 says a notice must tell the Data Principal what personal data is being processed and for what purpose, how she can exercise her rights, and how she can complain to the Data Protection Board. Rule 3 adds that the notice must give an itemised description of the data and the specific purpose of processing, in clear and plain language.
Think of it as a table in words. Each row pairs one kind of data with one reason: mobile number for delivery updates, email address for invoices, location for finding the nearest store. A notice that says "we collect information you provide and information about your use of our services" has no rows at all. It describes a category so wide that nobody can tell what is being asked of them, which defeats the idea of specific and informed consent in Section 6(1).
Rule 3 also expects the notice to stand on its own. It should be understandable without reading any other document the organisation has published, so a line such as "see our privacy policy" cannot do the work of the list itself. The notice must also include a communication link, on the website or app, through which the person can withdraw consent as easily as she gave it, exercise her rights and complain to the Board. Section 5(3) adds the option to read it in English or any Eighth Schedule language.
Itemised notice is not the same as a privacy policy. A policy is a long, general document describing an organisation's practices; the notice is a short, point-of-collection statement tied to one consent request. It is also different from consent itself. The notice informs; consent is the person's agreement afterwards. Section 5 ties notice to consent requests, so organisations relying on a Section 7 legitimate use should look separately at what transparency duties and rights requests still apply to them.
Examples of Itemised Notice
"We collect your phone number to send delivery updates, and your email to send invoices" is itemised. "We collect your details to improve services" is not.
A shopping app lists its notice in four lines: name and phone number to process and deliver orders, delivery address to dispatch parcels, email to send invoices and return confirmations, and purchase history to show "buy again" suggestions. Marketing SMS is a separate unticked line, so a customer can order without agreeing to it.
A chain of labs collects patient name, age, test requests and reports through its booking portal. The notice states that reports are used only to run the test and share results with the patient and the doctor she names, and that a separate choice covers anonymised use for internal quality studies.
A lending app replaces its sentence "we process financial data to provide services" with a list: bank statement for income assessment, PAN for identity checks required by RBI rules, and device location for fraud screening. Each line says how long the item is kept and where to withdraw consent.
Why Itemised Notice matters
Notice is the foundation under consent. Under Section 6(10), if a question about consent arises in a proceeding, the Data Fiduciary must prove that a notice was given and that consent was obtained in line with the Act. A notice too vague to be itemised puts every consent collected through it at risk, and invalid consent means the processing that followed had no lawful ground under Section 4.
The financial exposure is real. Most Chapter II failures fall in the residual penalty tier of up to ₹50 crore under the Schedule to Section 33, decided by the Data Protection Board after an inquiry and weighed against factors such as how long the breach lasted and what was done to fix it. For individuals, a good itemised notice is the difference between a real choice and a checkbox: they can see that an app wants contacts access or precise location and decline just that item.
How it works in practice
- 1List every data element your product collects by walking through each form, SDK, API call and offline-to-digital process, and record which team uses it and why. A data inventory is the raw material for the notice; guessing leads to omissions.
- 2Write one line per item or tightly related group, pairing the data with its purpose and the service it supports. Keep sentences short and avoid legal vocabulary a customer would not use in conversation.
- 3Place the notice at the point of collection, such as the sign-up screen or the checkout step, rather than only in a footer. Where consent is needed for several purposes, show them separately so the person can accept some and decline others.
- 4Add working links for withdrawal, rights requests and complaints to the Board, plus the contact details required by Section 6(3) and Section 8(9). Test that the links open on a mobile phone on a slow connection.
- 5Offer the notice in English and in the Eighth Schedule languages your customers use, and have a bilingual reviewer check that the translations carry the same itemisation rather than a softened version.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating the privacy policy as the notice. A link to a 20-page document does not itemise anything at the point of consent. Put the data-and-purpose list in the notice itself and keep the policy as the longer companion.
Using umbrella purposes such as "improving user experience" or "business analytics". Name the actual use, for example "to show which pages load slowly so we can fix them".
Itemising data but not purposes, or the reverse. Rule 3 asks for both, tied to each other, so a reader can see which item feeds which use.
Never updating the notice after launching a new feature. A new data element or new purpose means the old notice no longer describes the processing, and fresh consent may be needed.
Compliance tips
Draft the notice from your data inventory, not from a template. A template cannot know that your app reads the camera roll or uses a third-party analytics SDK.
Read the notice aloud to someone outside your legal and product teams. If they cannot say what you collect and why, it is not plain enough.
Keep a version log with dates and a hash or snapshot of each notice, so that when a consent record points to notice v3 you can reproduce exactly what the person saw.
Common questions about Itemised Notice
Is an itemised notice the same as a privacy policy?
No. A privacy policy is a general, long-form description of your practices. An itemised notice is a short statement given with a specific consent request, listing the exact data and purposes. Rule 3 expects the notice to be understandable on its own, so it cannot simply point readers to the policy.
Does the DPDP Act require the notice to be itemised?
Section 5 requires the notice to cover the personal data and purpose, and Rule 3 of the DPDP Rules 2025 specifies an itemised description of the data and the specific purpose of processing. The notice obligations take effect on 13 May 2027, so organisations have time to rework existing wording.
Do I need a separate notice for every purpose?
Not necessarily a separate document, but each purpose should be clearly separable within the notice so the person can understand it and, where consent is the ground, agree to one purpose without being forced to accept others. Bundling unrelated purposes undermines the "specific" requirement in Section 6(1).