What must a DPDP privacy notice include?
A checklist of the mandatory elements of a DPDP notice.
The mandatory elements
At minimum: the personal data collected; the purpose of processing; the manner of withdrawing consent; the way to exercise data principal rights; and the procedure to complain to the Board. Each purpose should be presented so the person can relate the data to the reason it's collected.
Itemisation is the point
The Rules push notices toward granularity so people make informed, specific choices. Listing each purpose with its data turns an opaque 'we collect data to improve services' into something a person can actually consent to or decline.
Delivery and language
Present the notice at or before collection, make it easy to read, and ensure it's accessible in English or an Eighth Schedule language. A link buried in a footer that no one sees at the point of collection doesn't satisfy the spirit of the requirement.
Frequently asked questions
What's the difference between a notice and a policy?
The notice is short and purpose-specific, shown at collection; the policy is the comprehensive standing document. Both are required.
Does the notice need to list every purpose separately?
Yes. Itemising each purpose with its data is the core requirement so consent can be specific and informed.
When must the notice be shown?
At or before the point you collect the personal data, not after the fact.
Build an itemised notice
Use the Privacy Notice Generator to produce a purpose-by-purpose DPDP notice in minutes.
Generate a Privacy Notice