How to Write a Privacy Notice (Rule 3)

Under Section 5 and Rule 3, every request for consent must come with a notice. The notice has to make sense on its own, in plain language, without sending people to other documents. This DPDPA 2023 course page explains how to write a privacy in plain language.

What Rule 3 requires (how to write a privacy)

• An itemised description of the personal data you collect
• The specific purpose of each use, and the goods or services it enables
• A link to your website or app where people can manage consent and rights
• How to withdraw consent, which must be about as easy as giving it
• How to exercise their rights (access, correction, erasure, grievance, nomination)
• How to complain to the Data Protection Board of India
• Available in English or any Eighth Schedule language on request (Section 5(3))

Step by step

1. Open your data inventory. The notice is a plain-language version of it.
2. Write one line per data item and purpose. Use words a customer would use.
3. Add the withdrawal route you will actually offer (a settings page or a monthly email link).
4. Add where to send rights requests and the contact from Rule 9.
5. Add the Board complaint line and how long you keep data.
6. Show a short version at the point of collection and link the full notice.
7. Version it: save date and wording every time it changes.
8. For existing customers, send the notice as soon as reasonably practicable (Section 5(2)).

Weak vs strong wording (how to write a privacy)

Notice generator

The generator gives a starting draft only. Have a lawyer review it before publishing.

Related guides (how to write a privacy)

• How to Manage Consent and Withdrawal
• Governance, Contact Point and Records

Educational material, not legal advice. Based on the DPDP Act, 2023 and the DPDP Rules, 2025 (Gazette notification of 13 November 2025). Always check the official text on the MeitY website.