What is a DPDP consent notice?

The DPDP consent notice (Rule 3) is the formal disclosure a Data Fiduciary must give before or at the time of asking for consent, describing what personal data will be processed, for what specific purpose, and how the Principal can exercise their rights. It replaces the vague "we care about your privacy" statements.

What must the notice contain?

The categories of personal data collected, the specific purposes, whether data will be shared or transferred, the retention period, how to withdraw consent, how to lodge a grievance, and the contact of the DPO (or named officer). Rule 3 details each element.

How is a compliant notice different from a privacy policy?

The privacy policy is a general document about all your data practices. The consent notice is the specific disclosure attached to each consent moment, 'to send you order updates, we will store your phone number for 6 months'. DPDP requires the specific notice, not just a policy.

Can I bundle multiple purposes in one notice?

You can display them together, but consent must be capturable per-purpose (granular). A single OK button covering marketing + service + analytics is invalid. dcomply's widget renders purpose-level checkboxes with per-purpose withdrawal.

How often must notices be updated?

Whenever the underlying processing changes, new purpose, new sharing partner, new retention period, new cross-border destination. dcomply's notice-versioning module manages the full lifecycle: draft, translate to 23 languages, publish, retain per-user version shown.

Do I need notices for existing users after DPDP takes effect?

Yes. DPDP requires the notice for both new and existing processing where consent is the lawful basis. Common approach: re-consent campaign with the new notice, giving existing users a chance to opt in/out under the new terms. dcomply automates the campaign and tracks response rates.

Rule 3 Consent Notice Builder

Rule 3 Compliant Consent Notices in Minutes

DPDP Rules 2025 Rule 3 specifies exactly what a consent notice must contain, the data fiduciary's identity, data categories, processing purposes, and withdrawal mechanism. dcomply's Consent Notice Builder generates Rule 3-compliant notices and links them directly to your consent widgets.

Try the live product

Data Fiduciary

Purpose Stated

Withdrawal Method

Rule 3 Compliant

The Problem

Most Consent Notices Fail Rule 3

A consent widget without a Rule 3-compliant notice attached does not constitute valid consent under the DPDP Act

Rule 3 Has Specific Requirements

DPDP Rules 2025 Rule 3 mandates that consent notices must contain: data fiduciary name and contact, data categories, processing purposes, retention period, withdrawal mechanism, and grievance officer details. Missing any element makes the notice non-compliant.

Consent Widgets Without Notices Are Invalid

A consent widget that collects consent without a linked Rule 3 notice does not constitute valid consent under Section 6. The notice must be presented before consent is recorded.

Translation Is Required

Rule 3 also requires notices in languages the data principal understands, meaning vernacular language notices are not optional for consumer-facing organizations.

Capabilities

Build, Publish, and Manage Rule 3 Notices

Rule 3 Template Builder

Pre-built template covering all mandatory Rule 3 elements: data fiduciary identity, grievance officer details, data categories, processing purposes, retention period, and consent withdrawal mechanism.

Widget Integration

Link each consent notice directly to a consent widget. When a visitor sees your consent banner, the Rule 3 notice is presented before they give consent, making consent legally valid under Section 6.

Multilingual Support

Add translations in any of the 22 Indian scheduled languages. Works in conjunction with the Multilingual Consent Notices module for automated AI translation.

Version Management

Every time you update a notice, a new version is created. Track which version is active, when it was published, and maintain a complete audit trail for regulatory review.

Public Notice URL

Each notice gets a unique public URL (e.g. dcomply.in/notice/your-org-xyz) that you can link to from your website, app, and consent widget.

Compliance Checklist

Built-in Rule 3 compliance checker validates your notice against all mandatory elements before you publish, catching missing fields before they become violations.

How It Works

Notice Live in 4 Steps

From filling the template to a published Rule 3 notice linked to your widget, in minutes.

Fill the notice template

Enter your organization's name, data categories, processing purposes, DPO/grievance officer details, and consent withdrawal method. The builder guides you through each required element.

Link to your consent widget

Select which consent widget this notice applies to. The widget will automatically display this notice to visitors before collecting consent.

Publish and get your public URL

Publish the notice and get a permanent public URL. Add this URL to your privacy policy, website footer, and any communications referencing consent.

Update and version

When processing changes, update the notice. A new version is created automatically, existing consents are flagged for re-confirmation if required, and the audit trail is preserved.

FAQ

Frequently Asked Questions

DPDP Rules 2025 Rule 3 requires consent notices to include: (1) Name and contact details of the Data Fiduciary, (2) Categories of personal data being collected, (3) The purpose of processing, (4) The manner in which consent can be withdrawn, (5) The grievance officer's name and contact, and (6) How to reach the Data Protection Board if the grievance is not resolved. dcomply's builder ensures all elements are present before you publish.

Each consent notice is linked to one widget, but you can create multiple notices, one per product, service, or processing purpose. This is best practice: separate notices for your mobile app, website, and email marketing ensure each consent is purpose-specific and auditable independently.

When you update a notice, dcomply creates a new version automatically. The previous version is archived (never deleted, it's part of your consent audit trail). If the changes materially affect the processing purpose or data categories, you should re-collect consent from existing data principals. dcomply flags consents collected under older notice versions so you can manage re-consent workflows.

Build Your Rule 3 Consent Notice

DPDP-compliant consent notices linked to your widgets

View All Features