Chapter 3: Manner of Giving Notice

Notice requirements and formats for data collection

chapter · 2 min read · Updated 14-Feb-2026 · 3 of 14

Executive Summary

•The days of hiding behind 50-page legal documents are over. You must ask for permission cleanly, clearly, and upfront. Users must know exactly what they are signing up for before they give you a single byte of data.

•Itemized information: The notice must give an itemized description of the personal data and the specified purpose or purposes, including the goods, services, or uses enabled by the processing.
•Language access: A consent request must be presented in clear and plain language, with the option to access it in English or a language specified in the Eighth Schedule to the Constitution.
•Withdrawal Info: You must explicitly tell them *how* to withdraw consent and *how* to file a grievance.
•No "Bundling": You cannot hide a "share with 3rd parties" clause inside a "terms of service" agreement.

•The "Why": You have the right to know *why* they need your phone number. If they say "for security" but use it for "marketing," that is a violation.
•Access: You can access the notice at any time, not just when signing up.

Practical application

Use these examples to distinguish a defensible process from a common mistake.

Right

✓A notice lists each category of personal data alongside its specific purpose in clear language.

Incorrect

×A business hides several unrelated purposes inside a long, bundled terms-of-service document.

Specifies how Data Fiduciaries must provide notice to Data Principals about data processing activities.

Rule 3 also requires a link or other means for withdrawing consent, exercising rights, and making a complaint to the Board.

Primary sources: section 5 of the DPDP Act and rule 3 of the DPDP Rules.