Notice
The statement a Data Fiduciary gives a Data Principal before or when asking for consent.
A notice is the clear message a company must show you before it asks for your consent. It tells you what data is taken, why, and how to withdraw consent, use your rights or complain.
Meaning of Notice
The notice must tell the person what personal data is collected, why, how to exercise rights and withdraw consent, and how to complain to the Board. The Rules require it to be clear, in plain language, itemised and independent of other information, and available in English or a language in the Eighth Schedule to the Constitution.
Section 5 of the Act ties notice to consent. Every request made to a Data Principal under Section 6 must be accompanied or preceded by a notice. Under Section 5(1) it must tell her the personal data and the purpose for which it will be processed, how she can exercise her right to withdraw consent and her right to grievance redressal, and how she can complain to the Board. Section 5(3) requires the option to read it in English or any language listed in the Eighth Schedule to the Constitution.
Rule 3 supplies the quality standard. The notice must be presented and be understandable independently of any other information, written in clear and plain language, and must give a fair account of what is needed for specific and informed consent. That means an itemised description of the personal data and the specific purpose, together with the goods or services the processing enables. It must also give a communication link, such as a website or app page, and describe other means by which the person can withdraw consent as easily as she gave it, exercise her rights and complain to the Board.
Section 5(2) deals with existing customers. Where a person gave consent before the section commenced, the fiduciary must give her a notice with the same elements as soon as reasonably practicable, and may continue processing until she withdraws consent. This makes a legacy-notice exercise necessary for most established businesses, and it is a practical task for the months before 13 May 2027, when the main obligations begin.
A notice is not a privacy policy, and it is not the consent itself. A privacy policy is a general, often long document describing a company's practices. The notice is a focused, transaction-level statement at the point of data collection. It is also not a terms-and-conditions page. Section 5 attaches notice to consent requests, so a fiduciary relying on a Section 7 legitimate use should still consider telling people what it does, as good practice, while checking the Rules for any specific duty.
Examples of Notice
A sign-up screen shows a short notice listing the data collected (name, phone, address), the purpose (delivery and order updates) and links to withdraw consent and to complain.
A store replaces its line "By continuing you agree to our policy" with a short notice at checkout that lists name, phone number and address, explains delivery and order updates as the purpose, and links to withdrawal and the grievance contact.
A hospital app shows a notice before collecting a patient's history, with the data items, the care purpose and a Hindi version. A separate optional notice covers research use and asks for separate consent.
An established private bank sends all existing customers a notice stating what data it holds and why, with a link to withdraw consent. It continues services meanwhile, as Section 5(2) permits, until someone withdraws.
Why Notice matters
Notice is the foundation of valid consent. If the notice is vague, missing or hidden, the consent that follows may not be specific and informed, and the fiduciary bears the burden under Section 6(10) of proving that notice was given and consent obtained in accordance with the Act. A defective notice therefore weakens every later act of processing built on it.
For people, a good notice is the main tool for exercising choice. It shows what happens to her data and gives a route to act. For the business, a notice is also a conversion and trust asset: short, honest notices tend to produce less friction than dense legal text. Failures can be penalised under the general head of up to ₹50 crore.
How it works in practice
- 1Inventory every point where you collect data: sign-up screens, checkout, lead forms, app permissions, call centres, event registrations and offline forms that are later digitised. Each needs a notice at the point of collection.
- 2Draft the notice from your purpose register. List each data item and the purpose it serves, and name the goods or services it enables. Keep sentences short and avoid legal jargon.
- 3Add the three routes required by Rule 3: a link or other means to withdraw consent, to exercise rights, and to complain to the Board. Test each link, and make sure withdrawal is no harder than the original consent.
- 4Offer language options. Provide the notice in English and in the Eighth Schedule languages that your users speak, and test it on phone screens.
- 5Version and archive each notice with dates, and record which version each user saw, so you can prove it later.
- 6For existing users, plan a legacy-notice campaign by email, SMS or in-app message and track delivery.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Pointing to the privacy policy for details. Rule 3 requires the notice itself to be understandable on its own.
Using vague data and purpose descriptions. Itemise the data and state the specific purpose.
Forgetting existing customers. Section 5(2) calls for a notice to those who consented earlier.
Offering only English. The person must be able to access the notice in English or an Eighth Schedule language.
Compliance tips
Test your notice with real users, including those who read only on mobile, and rewrite anything they find confusing.
Keep a change log, and issue a fresh notice whenever the data or purposes change.
Place the grievance and Board-complaint routes close to the consent button, not at the foot of a long page.
Coordinate with your consent management and records system so that the notice version is stored with every consent.
Common questions about Notice
What must a DPDP notice contain?
It must itemise the personal data and state the specific purpose and the goods or services enabled, and give a link or means to withdraw consent, exercise rights and complain to the Board. It should be in clear, plain language and understandable without other documents.
Is a privacy policy enough as a notice?
Not on its own. Rule 3 says the notice must be understandable independently of other information. A privacy policy can supplement it, but the notice at the point of collection must carry the itemised data, the purpose and the rights routes.
Do I have to send a notice to existing customers?
Under Section 5(2), where consent was given before the section commenced, the fiduciary must give a notice with the same elements as soon as reasonably practicable. It may continue processing until the person withdraws consent.
In which languages must the notice be available?
Section 5(3) requires an option to access it in English or any language specified in the Eighth Schedule to the Constitution. Choose the languages your users actually use, and check that the translated text is as clear as the English one.