Guide
How to write a DPDP-compliant privacy notice (Section 5 and Rule 3)
What a DPDP Act Section 5 consent notice must contain under Rule 3, the plain-language standard, and a copy-paste skeleton you can adapt for your Indian website.
Under Section 5 of the DPDP Act, before or when you collect someone's personal data you must give them a clear notice. It is separate from your long privacy policy, and it is one of the cheapest, highest-value things you can fix. Here is what it must contain and a skeleton you can adapt.
What a Section 5 notice must include
Rule 3 of the DPDP Rules, 2025 itemises the mandatory parts: the categories of personal data collected, the specific purpose for each, how to withdraw consent, how to exercise rights, the grievance officer contact, and the right to complain to the Data Protection Board. Plain language is itself a requirement, not a nicety.
A skeleton you can adapt
PRIVACY NOTICE: [Your Organisation] Issued under Section 5, DPDP Act 2023 and Rule 3, DPDP Rules 2025. 1. WHAT WE COLLECT: [list the categories of personal data]. 2. WHY: [state each specific purpose]. 3. HOW TO WITHDRAW CONSENT: [link/email, as easy as giving it]. 4. YOUR RIGHTS: access, correction, erasure, nomination, grievance. 5. GRIEVANCE OFFICER: [name], [email], response within 30 days. 6. COMPLAIN TO THE BOARD: you may escalate to the Data Protection Board.
Swap the brackets for your real details, keep it in plain language, and serve it at the point of collection, not buried three clicks deep. When you are ready to build the full version, the build-a-consent-notice workflow walks through it step by step.
Common mistakes
- Relying on the long privacy policy instead of a notice at the point of collection.
- Listing vague purposes like "business purposes" instead of specific ones.
- No withdrawal path, or one that is harder than giving consent.
- No named grievance officer or response timeline.
Frequently asked questions
Is a Section 5 notice the same as my privacy policy?
What must the notice contain?
Does this replace legal review?
Guidance, not legal advice. dpdpactindia.in is an independent resource, not affiliated with the Government of India. Confirm specifics against the enacted Act and Rules.