What the law requires
Section 5 of the DPDP Act and the Rules require a notice that is understandable on its own, and includes at least:
- an itemised description of the personal data you collect
- the specific purposes, and the goods or services enabled by that processing
- how the person can withdraw consent, exercise their rights and raise a grievance
- how they can complain to the Data Protection Board of India
People can ask for the notice in English or any of the 22 languages listed in the Eighth Schedule of the Constitution.
Section-by-section template
| Section | What to write |
|---|---|
| Who we are | Business name, address, and that you follow the DPDP Act 2023 and Rules 2025 |
| Data we collect | A bulleted list: name, mobile, email, health records, payment details… |
| Why we use it | One line per purpose: appointments, billing, WhatsApp updates (only with consent)… |
| Sharing | Types of service providers you share with, that you don’t sell data |
| Retention | How long you keep each kind of data |
| Security | The safeguards you use and that you’ll inform people of breaches |
| Your rights | Access, correction, erasure, withdrawal, grievance, nomination |
| How to use them | Link to your privacy centre, contact person, 90-day response |
| Complaints | Right to complain to the Data Protection Board of India |
Common mistakes
- Copying a long policy from a big website that lists data you don’t collect
- Only English, when most customers read Hindi or a regional language
- Bundling consent (“by using our services you agree to everything”)
- No contact person, or a contact who never replies
Generate yours in minutes
ConsentKaro asks what you collect and why, then writes your notice in English and Hindi, publishes it on your own privacy-centre page, and versions it so every consent is tied to the notice the person saw. Create your notice free.
Frequently asked questions
Is a privacy policy the same as a DPDP notice?
Not quite. A DPDP notice must be short enough to understand on its own and be given when you ask for consent. Many businesses keep a fuller privacy policy too, but the notice is what the law focuses on.
Does the notice have to be in Hindi?
It must be in English or, if the person chooses, any of the 22 Eighth Schedule languages. Offering Hindi or your regional language makes it genuinely understandable, which is what the law asks.
Get DPDP-ready without a lawyer’s bill
ConsentKaro writes your privacy notice in English and Hindi, logs consent, and handles customer data requests. 14-day free trial, no card.
Start free trial → Take the free DPDP check