# DPDP Rules 2025, Rule 3: what a privacy notice must contain

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/rules/rule-3-notice/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

Digital Personal Data Protection Rules, 2025. Secondary-sourced from the PIB release and cross-checked sources; verify against the notified Gazette text before external use.

## Rule 3, notice

The notice must—

(a) **be presented and be understandable independently** of any other information the Data
Fiduciary has made or may make available. This kills the practice of burying privacy terms inside
a general T&C document.

(b) give, **in clear and plain language**, a fair account of the details needed for specific and
informed consent, including at minimum:
  (i) an **itemised description** of the personal data; and
  (ii) the specified purpose or purposes, and a **specific description of the goods or services**
  to be provided or the uses to be enabled by the processing.

(c) give the **particular communication link** for the website or app, and a description of other
means, by which the Data Principal may:
  (i) **withdraw consent, with ease comparable to giving it**;
  (ii) exercise her rights under the Act; and
  (iii) **make a complaint to the Board**.

**Build implications.** A standalone consent notice screen. A machine-readable itemised data
inventory per consent purpose. Purpose strings tied to concrete goods or services, not to
categories like "improving our services". A one-click withdrawal link, live at the URL you
declared. Plus the Eighth Schedule language option, which comes from s.5(3) and s.6(3) of the Act.