Every consent request under the DPDP Act has to be paired with a notice. The Rules are specific about what that notice needs to say — and clarity itself is part of the requirement.
A COMPLIANT NOTICE COVERS
WHAT & WHY
The data and the purpose
Exactly what personal data is being collected, and precisely what it will be used for.
YOUR RIGHTS
How to exercise them
A clear explanation of how someone can access, correct or withdraw — not just that they can.
HOW TO COMPLAIN
The route to the Board
How to raise a grievance, and escalate it, if the organisation’s own response isn’t good enough.
Notices must also be offered in English or any of the 22 languages listed in the Constitution’s Eighth Schedule — a reminder that this requirement is about genuine comprehension, not legal box-ticking in a language most readers won’t fully follow.
Common misconception — That a long, comprehensive notice is automatically a good one. Length and legal completeness aren’t the point — clarity is. A notice nobody can parse doesn’t achieve what transparency is actually for.
A DPDP-compliant notice isn’t judged by how much it covers. It’s judged by whether an ordinary reader actually understands it.
SOURCES The DPDP Rules, 2025 — official text, MeitY — https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf