# How to write a DPDP consent notice: Rule 3, with examples you can copy

> Under the DPDP Act every consent request must come with or after a notice that itemises the personal data, states each specific purpose, and gives a link plus the means to withdraw consent, exercise rights and complain to the Board (s. 5(1), Rule 3). She must be able to access it in English or an Eighth Schedule language, and the request must name a contact (s. 5(3), 6(3)). Rule 3 applies from 13 May 2027; this guide gives illustrative notices that meet it, including one in Hindi.

Source: https://dpdp.commons.inc/dpdp-consent-notice · Updated 25 October 2026 · By the Commons Trust team (commons.inc)

A DPDP notice must come with or before every request for consent (s. 5(1)). Under Rule 3 it must stand on its own, itemise the personal data, state each specific purpose and what it enables, and give a link to your website or app with the means by which she can withdraw consent as easily as she gave it, exercise her rights and complain to the Data Protection Board. She must have the option to read it in English or any of the 22 languages of the Eighth Schedule to the Constitution (s. 5(3)), and the consent request must name someone who will respond to her (s. 6(3)). Rule 3 and these sections apply from 13 May 2027 (Rule 1(4); G.S.R. 843(E)).

Like the Act (s. 2(y)), we say "she" and "her" for every person.

**Jump to what you need.**

- **Legal and compliance:** [Rule 3, line by line](#rule-3-line-by-line), [Language](#language-english-or-an-eighth-schedule-language), [Where the law is unclear](#where-the-law-is-unclear-on-notices).
- **Product and design teams:** [Layering](#layered-notices-what-the-first-layer-must-carry), [web form](#sample-1-a-web-form), [app screen](#sample-2-an-app-screen), [SMS](#sample-3-an-sms-and-the-page-it-links-to), [donation page](#sample-8-a-donation-page), [what to store](#what-to-store-when-she-answers).
- **NGO and field teams:** [IVR script](#sample-4-an-ivr-script), [paper form, English and Hindi](#sample-5-a-paper-form-for-field-use), [parent notice](#sample-6-a-children-s-programme-for-the-parent), [information-only notice](#sample-7-an-information-notice-for-a-section-7-a-use), and the companion guide on [consent in the field](/dpdp-field-consent).

## What the Act asks of a notice and a consent request

Section 5(1) sets the content: the personal data and purpose, how she can withdraw consent (s. 6(4)) and use the grievance route (s. 13), and how she can complain to the Board; Rule 3 prescribes the manner. The notice and the request can share a screen, page or call, as long as the notice accompanies or precedes the request (s. 5(1)). Where consent is questioned before the Board, you must prove that you gave the notice and obtained consent in line with the Act and Rules (s. 6(10)). The notice text you can produce, and the record that she saw that version, are your evidence.

## Rule 3, line by line

| Rule 3 says | What it means in drafting | Test |
|---|---|---|
| (a) Presented and understandable independently of any other information you have published | Links can add detail; they cannot carry the essentials | Hide everything except the notice. Can she still tell what you collect, why, and how to undo it? |
| (b) A fair account, in clear and plain language, of what she needs for specific and informed consent | Short sentences, ordinary words. "Fair" points to anything she would want to know before agreeing, such as a recipient she would not expect | Read it to someone outside your team, then ask what she agreed to |
| (b)(i) An itemised description of the personal data | List the fields, or tight groups: "name, mobile number, village, crops grown" | Every field on the form appears in the notice, and nothing else does |
| (b)(ii) The specified purposes, and a specific description of the goods, services or uses enabled | Each purpose says what she gets or what the data is used for | No "improve our services", "analytics" or "research" without saying what |
| (c) The particular link to your website or app, and other means, if any | A specific URL, plus non-digital routes: a phone line, a missed-call number, a field worker | Someone without a smartphone can still act on it |
| (c)(i) How to withdraw consent, as easily as she gave it | The route mirrors how she consented: one tap for one tap; a field worker or phone for a doorstep yes | Withdrawal takes no more steps than consent |
| (c)(ii) How to exercise her rights under the Act | Access (s. 11), correction and erasure (s. 12), grievance (s. 13), nomination (s. 14), and where to ask | Each right is named in words she understands |
| (c)(iii) How to complain to the Board | Name the Board and give the route: a link or number, with a note that she should use your grievance route first (s. 13(3)) | She could act on the route given |

Section 6(3) adds the contact: a Data Protection Officer "where applicable" (only Significant Data Fiduciaries must appoint one, s. 10(2)(a)), or another person you authorise. Use a named role with a phone number, and publish it on your website or app and in every reply to a rights request (Rule 9).

The Board is to receive complaints digitally "as far as practicable" (s. 28(1), Rule 20). MeitY sought nominations for its members on 6 May 2026 and issued a further notification in June. LiveLaw reported on 1 August 2026 that no appointments had been made ([LiveLaw](https://www.livelaw.in/articles/india-data-protection-board-established-law-543751)). As of 25 October 2026 we have found none announced since, and we could not confirm an official online complaint facility. Our view: link each notice to a page of your own that explains how to complain to the Board, and update that page when a portal appears.

Consent must be specific and unconditional, with a clear affirmative action and only the data each purpose needs (s. 6(1)), so keep optional purposes separate and unticked. You may tell her that withdrawing may end a service that depends on the data (s. 6(5)).

## Language: English or an Eighth Schedule language

She must have the option to access the notice, and the consent request, in English or any language of the Eighth Schedule (s. 5(3), 6(3)): Assamese, Bengali, Bodo, Dogri, Gujarati, Hindi, Kannada, Kashmiri, Konkani, Maithili, Malayalam, Manipuri, Marathi, Nepali, Odia, Punjabi, Sanskrit, Santali, Sindhi, Tamil, Telugu and Urdu.

Bhili, Gondi, Tulu, Marwari, Bhojpuri, Chhattisgarhi and Kokborok are not on the list, so a notice only in one of them does not by itself satisfy section 5(3). Offer a Scheduled language the community uses, such as Hindi or Odia, with dialect audio. Translate buttons too, back-translate the purposes and withdrawal line, and record the language offered and used.

The words "the option to access ... in English or any language specified in the Eighth Schedule" can be read two ways: you may choose which Scheduled language to offer, or she may choose any of the 22. No rule or Board guidance settles it. Our position is under [Where the law is unclear](#where-the-law-is-unclear-on-notices).

## Layered notices: what the first layer must carry

We recommend layering: a short first layer at the point of collection, a fuller second layer a tap or call away. Rule 3(a) means the first must make sense alone.

| First layer (at the point of collection) | Second layer (linked page, leaflet, or "press 0 to hear more") |
|---|---|
| Who you are and a named contact (s. 6(3)) | Retention periods for each data set |
| Each item of data, by purpose (Rule 3(b)(i)) | Processors and recipients by category |
| Each purpose and what it gives her (Rule 3(b)(ii)) | Security measures in outline |
| Optional choices, separately, unticked (s. 6(1)) | Full rights process and the identifier she needs (Rule 14(1)) |
| The link; how to withdraw by the same route (Rule 3(c)(i)) | Grievance response period, which Rule 14(3) requires on your website or app; we add it to the first layer where space allows |
| Her rights and where to use them (Rule 3(c)(ii)) | Notice version history |
| How to complain to the Board (Rule 3(c)(iii)) | |
| Language options (s. 5(3)) | |

If something in the second layer would change her decision, such as a funder receiving her name, move it up.

For people who consented before 13 May 2027, section 5(2) requires a notice, as soon as reasonably practicable, of what you have processed and why, how to withdraw and complain, and how to reach the Board; you may continue until she withdraws. Our guide on [the data you already hold](/dpdp-existing-data) covers that campaign.

## Sample notices for each channel

Every sample below is illustrative and written for this guide. Square brackets mark text you must replace, and the data items and purposes must match what you actually collect. In each one, the whole notice, including withdrawal, rights and the route to the Board, comes before or with the first choice (s. 5(1)).

### Sample 1: a web form

*Illustrative.* An NGO's online application for a college scholarship. Applicants are 18 or over; for under-18s, use [sample 6](#sample-6-a-children-s-programme-for-the-parent).

> **How [Organisation] uses your information · Notice v1.0 · [हिन्दी] [English]**
>
> [Organisation] runs the [Programme] scholarship. Questions: [Programme Data Officer], [phone], [email].
>
> **To assess your application and tell you the result** we use your name, date of birth, mobile number, email, home district, college, course and year, family annual income, and the marksheet and income certificate you upload. Our selection panel reads your application. If you are selected, we also use your bank account number and IFSC to pay the scholarship.
>
> **Changing your mind.** Withdraw any choice below at [link to consent page] or by calling [phone]. If you withdraw the first, we cannot continue with your application.
>
> **Your rights.** Ask us for a summary of what we hold about you and who we shared it with; ask us to correct, update or delete it; name someone to act for you if you die or cannot act; or complain to us at [link] or [phone]. We reply within [number] days. If our reply does not satisfy you, you can complain to the Data Protection Board of India. How: [link to your page on complaining to the Board].
>
> ☐ I agree to [Organisation] using this information to assess my application and, if I am selected, to pay the scholarship.
>
> **Optional.** Saying no does not affect your application.
>
> ☐ Email me news of other [Organisation] programmes, about once a month.
>
> ☐ Call me once, about six months after the result, for a 10-minute survey on how the scholarship helped. Uses your name and mobile number.
>
> [Submit] · Full notice, including how long we keep your information: [link]

Submit stays disabled until the first box is ticked and never depends on the optional boxes.

### Sample 2: an app screen

*Illustrative.* A job-matching app for factory and logistics workers, shown at sign-up before any data is entered.

> **Before you start · Notice v2.1 · [हिन्दी] [English] [मराठी]**
>
> **[App name] by [Company]** · Help: [Grievance Officer], [phone], [email]
>
> If you are under 18, you can use [App name] only with a parent's permission: [link].
>
> **To find jobs for you** we use your name, mobile number, age, pin code, skills, past jobs and expected pay. **When you apply for a job** we send your name, mobile number, skills and past jobs to that employer only.
>
> **Change your mind** at Settings > My data, one tap per choice, or call [phone]. There you can also see, correct or delete your data, nominate someone to act for you if you die or cannot act, or complain to us. Not satisfied? Complain to the Data Protection Board of India. How: [link].
>
> **Optional.** You can still use the app if you say no.
>
> [ ] Job alerts on WhatsApp. Uses your mobile number.
>
> [ ] Use my phone's location to show nearby jobs. Without it, we use your pin code.
>
> [Agree and continue] · [Full notice]

The toggles start off and sit above the main button. The phone's location prompt appears only after she turns location on, and withdrawal in Settings is one tap because consent was. The age line routes under-18s to a parent notice like [sample 6](#sample-6-a-children-s-programme-for-the-parent), because a child cannot consent for herself (s. 2(f), 9(1)).

### Sample 3: an SMS and the page it links to

An SMS cannot carry a full Rule 3 notice. Our view: use the SMS as the invitation, put the notice at the link and on a free phone line, and take consent there, never by a bare reply. Sending the invitation is itself processing of her number, so after 13 May 2027 it needs its own basis, such as earlier consent to contact or a legitimate use you can document.

*Illustrative.* A skilling programme asks past trainees about a follow-up survey.

> ORGNAME: Survey call about your training? See the data we use, say yes or no, or change your mind later: xxxxxxx.in/s/4KQ7 or call 1800XXXXXXX (free)

That is 149 characters in the standard GSM-7 set; a Hindi version goes in Unicode at about 70 characters a segment, so expect three. Commercial SMS in India run on the telecom operators' DLT system under TRAI's regulations, so your provider will need the sender header and template registered before sending.

The page it opens:

> **Follow-up survey · [Organisation] · Notice v1.0 · [हिन्दी] [English]**
>
> We would like to call you once, for about 10 minutes, to ask how the [Programme] training has helped your work. We will use your name, mobile number, the course you took, and your answers about your work and income since. Your answers are combined with others for our report to [Funder]; we do not give them your name.
>
> Saying no does not affect any other support from us. Change your answer here or at 1800XXXXXXX (free) any time. On the same number, ask [Survey Coordinator] what we hold about you, to correct or delete it, to record someone to act for you if you die or cannot act, or to make a complaint. If you are not satisfied, complain to the Data Protection Board of India. How: [link].
>
> [Yes, you can call me] [No thanks]

### Sample 4: an IVR script

Our view: a spoken notice is presented to her as much as a written one; the Act prescribes no medium. She must hear the whole notice before the first choice, and the system must log the version she heard and the keys she pressed.

*Illustrative.* Farmers call a free number to register for weekly crop advice. About 95 seconds at a natural pace.

> **Language menu.** "हिंदी के लिए 1 दबाएँ। मराठीसाठी 2 दाबा. For English, press 3." *(Hindi and Marathi are Scheduled languages. A dialect recording can sit alongside them as option 4.)*
>
> **Notice (script v1.4).**
>
> "Namaste. This is [Organisation]'s crop advice service.
>
> To send you crop advice, we will keep your mobile number, your village and district, the crops you grow, and how many acres you farm. We use these to call you once a week with advice on your crops and the weather.
>
> We will also ask one optional question: whether we may give your name, mobile number, village and crop to [Buyer A] and [Buyer B], who buy pulses and soybean from farmers in your district, so they can call you with offers. Saying no will not stop your crop advice.
>
> You can stop either at any time: call this number and press 9, or give a missed call to [number]. To ask what we hold about you, correct or delete it, name someone to act for you if you die or cannot act, or make a complaint, call this number and press 0 for [Helpline Lead]. If you are not satisfied with our answer, you can complain to the Data Protection Board of India; press 0 and we will tell you how, or visit [short web address].
>
> To hear this again, press star. To continue, press hash.
>
> If you agree to receive crop advice, press 1. If not, press 2.
>
> [After 1:] May we give your details to [Buyer A] and [Buyer B]? If yes, press 1. If no, press 2.
>
> We will send you an SMS with these details and our web link."
>
> **Read-back.** "You said yes to crop advice and no to sharing with buyers. Thank you."

Log the caller number, language, script version, each key, timestamps and any replay, and keep the audio for every script version. The follow-up SMS carries the link (Rule 3(c)); it does not replace the spoken notice.

### Sample 5: a paper form for field use

Nothing in the Act requires consent to be digital; our view is that paper consent is valid if it meets section 6. The Act covers the data once you digitise it (s. 3(a)(ii)). Print the form in the Scheduled language of the area, read all of it aloud, including the "Before you answer" box, before asking question 1, and give her the tear-off slip.

*Illustrative.* Enrolment of self-help group members in livelihoods training.

> **[Organisation] · Enrolment for [Programme] · Form v3**
>
> **What we will write down:** your name, age, village, mobile number, the name of your self-help group, and your bank account number and IFSC for the training allowance.
>
> **What we use it for:** to enrol you in the training, record your attendance, and pay the training allowance into your bank account.
>
> **Before you answer.** You can change your mind about any answer at any time: tell our facilitator, call [Field Coordinator] on [number], or give a missed call to [number]. On the same number you can ask what we hold about you, correct or delete it, name someone to act for you if you die or cannot act, or complain. Web: [short web address]. If our answer does not satisfy you, you can complain to the Data Protection Board of India. How: call [number] or see [short web address]/board.
>
> 1. I agree to the above. ☐ Yes ☐ No · Thumbprint or signature: ______
>
> **Optional.** Saying no will not affect your training or allowance.
>
> 2. Photographs of me at the training may appear in reports to [Funder] and on [Organisation]'s website. ☐ Yes ☐ No · Thumbprint or signature: ______
>
> 3. [Organisation] may call me once next year to ask about my business. ☐ Yes ☐ No · Thumbprint or signature: ______
>
> **Facilitator:** I read this whole form aloud in ______ (language) before she answered. Name, ID: ______ Date: ______
>
> ✂ - - - - - - - - - - - - - - - - - - - - - - - - -
>
> **Your copy. Keep this slip.** Form v3 · Enrolment number: ______ · You said yes to: ☐ 1 ☐ 2 ☐ 3 · To change your mind, ask about your information or complain: [Named role], [number], missed call [number], [short web address]. To complain to the Data Protection Board: [short web address]/board.

The same form in Hindi, as the facilitator would print it:

> **[संस्था का नाम] · [कार्यक्रम] में नामांकन · फ़ॉर्म v3**
>
> **हम क्या लिखेंगे:** आपका नाम, उम्र, गाँव, मोबाइल नंबर, आपके स्वयं सहायता समूह का नाम, और प्रशिक्षण भत्ते के लिए आपका बैंक खाता नंबर और IFSC।
>
> **यह जानकारी किसलिए:** प्रशिक्षण में आपका नाम दर्ज करने, आपकी हाज़िरी लगाने, और प्रशिक्षण भत्ता आपके बैंक खाते में भेजने के लिए।
>
> **जवाब देने से पहले।** आप कभी भी अपना कोई भी जवाब बदल सकती हैं: हमारे सहयोगी को बताएँ, [फ़ील्ड समन्वयक] को [नंबर] पर फ़ोन करें, या [नंबर] पर मिस्ड कॉल दें। इसी नंबर पर आप पूछ सकती हैं कि हमारे पास आपकी क्या जानकारी है, उसे ठीक करवा सकती हैं या हटवा सकती हैं, यह बता सकती हैं कि आपकी मृत्यु होने पर या आपके असमर्थ होने पर आपकी ओर से कौन काम करेगा, या शिकायत कर सकती हैं। वेब: [वेब पता]। अगर हमारे जवाब से आप संतुष्ट नहीं हैं, तो आप भारतीय डेटा संरक्षण बोर्ड (Data Protection Board of India) से शिकायत कर सकती हैं। कैसे: [नंबर] पर फ़ोन करें या [वेब पता]/board देखें।
>
> 1. ऊपर लिखी बातों के लिए मेरी सहमति है। ☐ हाँ ☐ नहीं · अँगूठे का निशान या हस्ताक्षर: ______
>
> **आगे के सवाल आपकी मर्ज़ी पर हैं।** "नहीं" कहने से आपके प्रशिक्षण या भत्ते पर कोई असर नहीं पड़ेगा।
>
> 2. प्रशिक्षण में ली गई मेरी तस्वीरें [वित्तपोषक / फ़ंडर] को भेजी जाने वाली रिपोर्टों में और [संस्था] की वेबसाइट पर लगाई जा सकती हैं। ☐ हाँ ☐ नहीं · अँगूठे का निशान या हस्ताक्षर: ______
>
> 3. [संस्था] अगले साल मेरे काम-धंधे के बारे में पूछने के लिए मुझे एक बार फ़ोन कर सकती है। ☐ हाँ ☐ नहीं · अँगूठे का निशान या हस्ताक्षर: ______
>
> **सहयोगी:** जवाब लेने से पहले मैंने यह पूरा फ़ॉर्म ______ (भाषा) में पढ़कर सुनाया। नाम, आईडी: ______ तारीख़: ______
>
> ✂ - - - - - - - - - - - - - - - - - - - - - - - - -
>
> **आपकी पर्ची। इसे संभालकर रखें।** फ़ॉर्म v3 · नामांकन संख्या: ______ · आपने "हाँ" कहा: ☐ 1 ☐ 2 ☐ 3 · जवाब बदलने, अपनी जानकारी के बारे में पूछने या शिकायत के लिए: [पदनाम], [नंबर], मिस्ड कॉल [नंबर], [वेब पता]। डेटा संरक्षण बोर्ड से शिकायत के लिए: [वेब पता]/board।

Her thumbprint or signature beside each purpose is the affirmative act. The enrolment number links the slip to her record, so a missed-call withdrawal can be matched; the digitised record must carry the form version and facilitator ID.

### Sample 6: a children's programme, for the parent

For anyone under 18 you need a parent's or lawful guardian's verifiable consent before processing (s. 2(f), 9(1)). The notice therefore covers the child's data and the parent's own details used to check that she is an identifiable adult (Rule 10(1)).

*Illustrative.* An after-school learning centre.

> **For parents and guardians · [Organisation] Learning Centre · Notice v1.1 · [हिन्दी] [English]**
>
> Your child can join our after-school classes. Because your child is under 18, we need your permission first.
>
> **About your child, we will record:** name, age, class, school, attendance at our centre, and scores on our reading and maths checks. **We use this to** teach your child at the right level and show you how your child is progressing.
>
> **About you, we will record:** your name, mobile number, your relationship to the child, and how we checked your identity and that you are over 18, for example "voter ID seen" or "matched to the ages on the ration card in our records". We write down the type of document, not its number.
>
> **Changing your mind.** Tell the centre teacher, or call [Centre Coordinator] on [number]. We stop within [number] days. On the same number you can ask what we hold about your child or you, correct or delete it, name someone to act for you if you die or cannot act, or complain. If you are not satisfied, complain to the Data Protection Board of India. How: [link].
>
> ☐ I am the parent or guardian, and I agree.
>
> **Optional.** Saying no does not affect your child's place.
>
> ☐ Send me an SMS when my child misses class.
>
> ☐ Photographs of my child at the centre may be used in our reports to donors and on our website, without my child's name or school.

Rule 10(1) requires due diligence on both the identity and the age of the person consenting, using reliable details you already hold or details she provides, herself or through a token such as DigiLocker. Do it before you process the child's data. Photographs of children also carry the duty not to process in a way likely to harm the child's well-being (s. 9(2)). Our guide on [children's data](/dpdp-childrens-data) covers verification methods and the Fourth Schedule exemptions.

### Sample 7: an information notice for a section 7(a) use

Where you rely on voluntary provision under section 7(a), there is no consent to ask for, but the purpose must still be "specified" (s. 2(za)). Our view: tell her in a short notice, without boxes to tick. Case work may also fall under the legal-claims exemption in section 17(1)(a); our view is to give this notice anyway.

*Illustrative.* A walk-in legal aid clinic.

> **[Organisation] Legal Aid Clinic · Information notice v1.0 · [हिन्दी] [English]**
>
> To advise you and, if you ask us, to help you file papers, we will write down your name, mobile number, address, and the details of your problem that you tell us. We use these only for your case. Our lawyer [Name] sees them; nobody outside [Organisation] does unless you ask us to share them.
>
> If you do not want us to use any of this, tell us and we will stop, though we may then be unable to help with your case.
>
> Ask what we hold about you, correct it or have it deleted, or complain to us: [Clinic Coordinator], [phone]. If our answer does not satisfy you, you can complain to the Data Protection Board of India. How: [link].

### Sample 8: a donation page

*Illustrative.* An NGO's online donation form. Processing the gift and receipt is 7(a): she gives the details to donate. Reporting donations to the Income Tax Department, where the income-tax law requires it, fits section 7(d), a legal obligation to disclose to the State. Only the updates need consent. The Income-tax Act, 2025 has applied since 1 April 2026, so confirm the current donation-deduction provision and reporting rules with your chartered accountant or auditor before using this text.

> **Your donation to [Organisation] · Notice v1.0 · [हिन्दी] [English]**
>
> To process your donation and send your receipt we use your name, email, mobile number and address, and the payment details our payment provider [Provider] handles for us. If you want a tax-deduction receipt, we need your PAN (or Aadhaar or another ID the tax rules accept), because we must report your donation to the Income Tax Department with it. We keep donation records as long as tax law requires.
>
> Unsubscribe from updates with one click in any email, or at [link]. To see, correct or delete your details, name someone to act for you if you die or cannot act, or complain: [Donor Care Lead], [email], [phone]. If our reply does not satisfy you, complain to the Data Protection Board of India. How: [link].
>
> ☐ Optional: email me a short update on [Programme] every three months. You can still donate if you leave this unticked.
>
> [Donate]

## What to store when she answers

Each sample works only if you can later produce what she saw and chose (s. 6(10)). The minimum consent receipt, our recommendation:

| Field | Example |
|---|---|
| Person and identifier | Applicant 40417, mobile ending 2210 |
| Notice version and language | Notice v1.0, Hindi |
| Channel | Web form, IP and browser logged |
| Each purpose and decision | Assessment: yes · Newsletter: no · Survey: yes |
| Timestamp | 14 June 2027, 11:42 IST |
| Withdrawal status | Not withdrawn |

Field channels need more, such as facilitator ID and parent verification; the list is in [consent in the field](/dpdp-field-consent#recording-methods-and-what-each-record-must-hold).

## Test any notice in ten minutes

Use it on your drafts and on any notice a vendor shows you.

| # | Check | Typical failure | Provision |
|---|---|---|---|
| 1 | It comes with or before the request | Notice emailed after sign-up | s. 5(1) |
| 2 | It makes sense with every link removed | "See our privacy policy" as the notice | Rule 3(a) |
| 3 | Every field collected is itemised by purpose | "Personal information such as..." | Rule 3(b)(i) |
| 4 | Every purpose says what it does for her | "Analytics", "research", "legitimate business purposes" | Rule 3(b)(ii) |
| 5 | Optional purposes are separate, unticked, and refusal changes nothing | One box for everything; "by continuing you agree" | s. 6(1) |
| 6 | Only necessary data | Date of birth where an age band will do; GPS where a pin code will | s. 6(1) |
| 7 | A specific link to your website or app, plus non-digital means | No route for people without internet | Rule 3(c) |
| 8 | Withdrawal by the same route, in no more steps | One-tap consent, withdrawal by email | s. 6(4), Rule 3(c)(i) |
| 9 | Rights named in plain words, with where to use them | "You have rights under applicable law" | Rule 3(c)(ii) |
| 10 | Grievance route given; response period stated (our view) | No grievance contact | s. 13; Rule 14(3) for the website |
| 11 | The Board, with a route to complain | Board named with no route, or missing | s. 5(1)(iii), Rule 3(c)(iii) |
| 12 | A named contact with phone or email | A generic inbox nobody reads | s. 6(3), Rule 9 |
| 13 | English or a Scheduled language offered, buttons included | Hindi notice, English buttons | s. 5(3), 6(3) |
| 14 | A version number, stored with every consent | You cannot prove which text she saw | s. 6(10) |
| 15 | Any recipient she would not expect is named | Funder receives names silently | Rule 3(b), our view |

Our view: a link to your home page is weak practice, though not clearly a breach. Rule 3(c) asks for "the particular communication link"; send her to the page where she can act.

## Where the law is unclear on notices

These are our positions until the Board, a court or a rule decides otherwise.

**Must the notice be available in all 22 Scheduled languages?** We offer English plus the Scheduled languages the people we serve use, add dialect audio, and keep a route to supply another Scheduled language on request within a reasonable time. *Why:* "any" can be read as the fiduciary's choice or hers; an on-request route covers the stricter reading at modest cost. *Would change if:* a rule, Board guidance or an order reads "any" as her choice. *Confidence:* medium.

**What if we have no website or app?** Create a simple web page. *Why:* Rule 3(c) requires "the particular communication link for accessing the website or app", and Rules 9 and 14 assume one exists; "other means, if any" adds routes without replacing the link. *Would change if:* guidance accepts offline-only fiduciaries. *Confidence:* medium.

**Is tracking a child's learning "behavioural monitoring"?** Probably not when scores are used only to teach that child, but the term is undefined (s. 9(3)). The Fourth Schedule exempts tracking and behavioural monitoring only by an educational institution, for its educational activities or the safety of enrolled children, and whether an NGO learning centre is one is unclear. *Would change if:* the Board or a court defines the term. *Confidence:* low.

**Must the notice name processors?** No, if they act only for the purposes described; name recipients that use the data for their own purposes. *Why:* Rule 3(b) asks for a "fair account". *Confidence:* medium.

## What to do between now and 13 May 2027

1. **List every point where you collect data or ask for consent:** forms, apps, call scripts, field registers ([data mapping](/dpdp-data-mapping)).
2. **Decide the basis per purpose** ([legitimate uses](/dpdp-legitimate-uses)), and cut data you do not need.
3. **Write one notice per collection point** from the closest sample.
4. **Translate** into the Scheduled languages your people use, back-translate, and record dialect audio.
5. **Build withdrawal before you go live,** with a matching route for every consent route. A [consent management platform](/consent-management-platform) can hold notices, versions and records.
6. **Publish the contact, rights and Board-complaint pages** (Rule 9, Rule 14), with your grievance response period.
7. **Version and archive** every notice, translation and audio file.
8. **Test with ten real users.** Ask each what she agreed to and how she would undo it.

For the wider programme, see [the DPDP Act and Rules explained](/dpdp-act-guide) and the [compliance checklist](/dpdp-compliance-checklist).

**How we wrote this guide.** We worked from the text of the Digital Personal Data Protection Act, 2023, sections 2, 3, 5 to 9, 11 to 14 and 28, and the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)), Rules 1, 3, 8, 9, 10, 14 and 20 and the Second and Fourth Schedules, as published in the Gazette of India. The Board's status comes from the linked public report; we last checked for later announcements on 25 October 2026. The samples are illustrations; tax and telecom points are stated generally and should be checked with your advisers. Statements marked as our view, position or recommendation are our judgement. This guide explains the law; it is not legal advice.
{: .note }

## Questions people ask

### Can our privacy policy be the DPDP notice?

Usually not on its own. Rule 3(a) requires the notice to be understandable independently of anything else you publish, and Rule 3(b) asks for an itemised list of data and specific purposes for the consent being sought. A privacy policy covering every activity of the organisation rarely does that for one form. Keep the policy as the second layer and as the place you publish contact details and the rights process (Rule 9, Rule 14), and put a short, self-contained notice at each point of collection.

### Do we need a notice if we rely on a legitimate use instead of consent?

Section 5(1) ties the notice to consent requests, so the Act does not expressly require a Rule 3 notice for processing under section 7. Section 7(a), however, depends on a 'specified purpose', which section 2(za) defines as the purpose mentioned in a notice, and the State's section 7(b) processing needs an intimation under the Second Schedule. Our view: give a short information notice for 7(a) uses, without asking for consent you do not need. Sample 7 in this guide is one.

### Does a notice have to state how long we keep the data?

Rule 3 does not list retention among the minimum contents, though it asks for a 'fair account' of what she needs for informed consent (Rule 3(b)). Our view: put a plain retention statement in the second layer, and in the first only where it would change her decision. Whatever you write must match your systems: you must erase when the purpose ends or consent is withdrawn unless a law requires retention (s. 8(7)), and Rule 8(3) separately requires you to keep personal data and processing logs for at least one year.

### Do we have to show the notice every time we use the data?

No. The notice accompanies or precedes each request for consent (s. 5(1)), so a consent you already hold, for a purpose you have not changed, does not need a fresh notice each time you use the data. You need a new notice when you ask for consent again, add a purpose or collect new data. Our view: remind people of their choices and the withdrawal route at natural points, such as renewal or annual contact, and log those reminders.

### Should the notice change when we add a purpose?

A new purpose needs a new notice and a new consent for that purpose, because consent covers only the specified purpose (s. 6(1)). Version every notice, keep each version, and store the version number in each consent record, so you can show exactly what she saw (s. 6(10)). Editorial fixes that change neither data nor purposes can be a minor version without re-consent; our view is to record why.

## About Commons Trust

Commons Trust is a DPDP compliance programme and consent management platform from commons.inc that takes nonprofits, foundations, startups and corporates from wherever they are to fully compliant with India's Digital Personal Data Protection Act. Contact: hello@commons.inc · https://dpdp.commons.inc/#start