How to Write a DPDP Privacy Notice People Actually Read

Who this is for: legal counsel, product managers, UX writers and DPOs responsible for the words users see when you collect their personal data.

Most privacy notices are written to protect the company, not to inform the reader. They are long, abstract, written in legal language and placed where few people look. The DPDP Act turns that approach into a liability. Consent is valid only if it is informed (Section 6(1)), and the business must prove that a proper notice was given (Section 6(10)).

This guide sets out what a DPDP notice must contain, how it differs from a privacy policy, and how to write one people will actually read. It includes a sample you can adapt. For the consent rules the notice supports, see valid consent under DPDP.

Notice versus privacy policy

They are different documents with different jobs.

Keep your privacy policy as the full reference. But every point where you ask for consent needs its own notice.

What the law requires

Content (Section 5(1) and Rule 3)

A notice must give the individual, at minimum:

1. an itemised description of the personal data to be processed
2. the specified purpose of processing, with an itemised description of the goods, services or uses it enables
3. a communication link to your website or app, or a description of other means, through which the individual can:

• withdraw consent, with ease comparable to giving it
• exercise their rights under the Act
• make a complaint to the Data Protection Board

Format (Rule 3)

The notice must be:

• presented independently of any other information, not buried in terms of service
• understandable independently, without needing to read another document
• written in clear and plain language

Language (Section 5(3) and Section 6(3))

Individuals must be able to read the notice in English or in any of the 22 languages in the Eighth Schedule to the Constitution. For consumer businesses, this means a deliberate language strategy based on where your users are.

Contact details

Section 6(3) requires consent requests to include contact details of your Data Protection Officer, where applicable, or another person authorised to respond. Section 8(9) separately requires you to publish these details.

Existing users (Section 5(2))

For personal data processed on consent given before the Act commenced, you must give a notice as soon as reasonably practicable. You may continue processing until the individual withdraws consent.

How to write a notice people read

Lead with what matters to the user. Start with the data and the purpose, not with your company's legal name and registered address.

Itemise, don't summarise. "Your name, mobile number and delivery address" is itemised. "Your contact information" is not.

One purpose, one notice. If you ask for consent to several purposes, show each purpose separately so each can be chosen on its own.

Use layers. Show a short notice at the point of collection, with a link to a fuller explanation. The short layer must still contain every required element.

Use the user's words. "So we can send you offers on WhatsApp" is clearer than "for marketing communications via OTT messaging channels".

Make withdrawal visible. Tell users exactly where and how to withdraw, in the notice itself.

Sample notice

Here is a short-layer notice for a WhatsApp marketing consent. Adapt it to your purpose, data and channels.

Note the unticked box, the optional framing, the specific purpose, the itemised data and the withdrawal route in the same channel. Each is a direct answer to a DPDP requirement.

Version every notice

Under Section 6(10), you must prove which notice an individual saw when they consented. That requires:

• a unique version ID for each notice and language
• an archive of every version, with dates in use
• consent records that store the notice version shown

When you change a notice, consider whether the change affects existing consents. A new purpose needs new consent. A clearer wording of the same purpose usually does not.

Notice checklist

Common mistakes

• Linking to the privacy policy instead of giving a notice. Rule 3 requires a standalone notice.
• Vague purposes. "To improve your experience" is not a specified purpose.
• Combining notice and terms. Notices must be presented independently.
• English only for a regional audience. Users must be able to read it in an Eighth Schedule language.
• No version history. Without it, you cannot prove what an individual was told.

How ConsentifyAI helps

ConsentifyAI's notice template management lets you build DPDP-compliant notices from your Record of Processing Activities, so each notice itemises exactly the data and purposes recorded there. Notices are versioned automatically, published in multiple languages, and linked to every consent captured. When you need to prove what someone was told, you can retrieve the exact notice and language they saw.