DPDP reference
Rule 3: Notice given by Data Fiduciary to Data Principal
Last checked 6 Nov 2026
A notice must be understandable on its own, without relying on other information the Data Fiduciary has made available (Rule 3(a)). In clear and plain language it gives at the minimum an itemised description of the personal data, and the specified purposes with a specific description of the goods or services provided or uses enabled (Rule 3(b)).
It also gives the particular communication link for the website or app, and any other means, for withdrawing consent with comparable ease, exercising rights under the Act, and complaining to the Board (Rule 3(c)).
- Applies to
- Every Data Fiduciary that gives notice under s.5.
- Starts
- 13 May 2027 (Rule 1(4)).
- Penalty
- Up to ₹50 crore (s.33, Schedule item 7).
- Source
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, rule 3; G.S.R. 892(E), corrigenda
Questions
What must a DPDP privacy notice contain?
An itemised description of the personal data, the specified purposes and the goods, services or uses they enable, and the link and other means for withdrawing consent, exercising rights and complaining to the Board (Rule 3).
Can the notice sit inside the terms and conditions?
Rule 3(a) requires it to be presented and understandable independently of any other information the Data Fiduciary has made available.
Related
Next
Not legal advice.