Rule 3, notice

The notice must—

(a) be presented and be understandable independently of any other information the Data Fiduciary has made or may make available. This kills the practice of burying privacy terms inside a general T&C document.

(b) give, in clear and plain language, a fair account of the details needed for specific and informed consent, including at minimum: (i) an itemised description of the personal data; and (ii) the specified purpose or purposes, and a specific description of the goods or services to be provided or the uses to be enabled by the processing.

(c) give the particular communication link for the website or app, and a description of other means, by which the Data Principal may: (i) withdraw consent, with ease comparable to giving it; (ii) exercise her rights under the Act; and (iii) make a complaint to the Board.

Build implications. A standalone consent notice screen. A machine-readable itemised data inventory per consent purpose. Purpose strings tied to concrete goods or services, not to categories like "improving our services". A one-click withdrawal link, live at the URL you declared. Plus the Eighth Schedule language option, which comes from s.5(3) and s.6(3) of the Act.