Under the DPDP Act the privacy notice is not boilerplate — it is a legal pre-condition to consent. If the notice is missing or vague, the consent built on it is weak. Here is how to write one that does its job.
What the Act requires: Section 5
When you seek consent, you must give the Data Principal a notice that contains at least:
- An itemised description of the personal data you will collect;
- The purpose of processing — what you will do with it;
- How the person can exercise their rights (access, correction, erasure, grievance);
- How they can withdraw consent, as easily as they gave it;
- How they can complain to the Data Protection Board.
'Itemised' is the operative word. 'We collect information to improve our services' is not a notice; 'we collect your name, email and delivery address to process and deliver your order' is.
The Indian-language rule
The Act requires that the person be able to access the notice in English or any language listed in the Eighth Schedule of the Constitution (there are 22). In practice, offering the notice in English plus the main languages of your users is the safe, user-friendly approach — and it is explicit in the law, not optional politeness.
A plain structure you can follow
- Who we are — the Data Fiduciary's identity and contact, and your DPO or contact person.
- What we collect — an itemised list of data categories.
- Why — the specific purpose for each, in person-friendly language.
- Who we share it with — processors and categories of recipients.
- How long we keep it — retention, and when it is erased.
- Your rights — access, correction, erasure, nomination, grievance.
- Withdraw consent — a clear, working link or control.
- Complain — how to reach your grievance channel and the Board.
Keep it specific, layered and versioned
Write for a real person, not a lawyer: short sentences, a layered design (a concise summary that expands into detail), and no dark patterns. And version it — because you must be able to show which notice a person saw when they consented. If your notice changes materially, that is a new version, and sometimes a reason to re-seek consent.
Tie the notice to reality
A notice is only true if it matches what your systems actually do. That is why notices should be built from a real data map — the data you genuinely hold, the purposes you genuinely pursue and the vendors who genuinely receive it. A notice that describes an imagined, tidier version of your processing is a liability, not a shield.
Timeline
With the DPDP Rules, 2025 notified, the notice-and-consent obligations sit within the 18-month grace period ending 14 May 2027. That is time to get it right, not time to ignore — re-writing notices and wiring them to consent capture is one of the longer compliance tasks.
How DPDP Bridge helps
DPDP Bridge generates DPDP-compliant privacy notices in English and Indian languages, linked to your actual data map and purposes, and keeps them versioned so you can show what a person saw and agreed to. The free assessment flags where your current notice falls short.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.