Notice (DPDP s.5)

Section 5 of India's DPDP Act requires the Data Fiduciary to give the Data Principal a notice informing them of the personal data to be processed and the purpose, in English or any of the 22 Eighth Schedule languages. The notice must be standalone and complete — it cannot cross-reference an external privacy policy to satisfy its content requirements. Rule 3 of the DPDP Rules 2025 (in force from 13 May 2027) sets the minimum notice content: an itemised description of the personal data to be processed, the purposes of the processing, the goods or services the processing enables, the specified means by which the Data Principal may withdraw consent, the means by which rights (access, correction, erasure, nomination, grievance) may be exercised, and the means by which the Principal may complain to the Data Protection Board.

The DPDP notice is distinct from the broader privacy policy that most Fiduciaries already publish. Both must coexist: the privacy policy is typically a longer sitewide document, while the DPDP notice is a point-of-collection, consent-adjacent disclosure that satisfies the Section 5 standard for a specific processing purpose. Rule 3's standalone requirement means the notice must be visible in the sign-up flow (or equivalent collection moment) — a buried link to a long privacy policy is not sufficient. For digital services, a layered design is common: a short per-purpose summary at the top with granular consent toggles, structured detail below, and the Grievance Officer contact persistently visible.