What must a privacy notice contain under the DPDP Rules, 2025?
Answer:
A notice given to obtain consent must be standalone, in clear and plain language, and must give an itemised list of the personal data being collected and the specific purpose of processing. It must also tell the Data Principal how to withdraw consent (as easily as it was given), how to exercise their rights, and how to make a complaint to the Data Protection Board, along with a link or means to do so.
privacy notice rule 3 itemised plain language withdraw consent rights
Related Questions:
- By when do organizations need to technically integrate with Board-registered Consent Managers?
- Is the consent notice required to give contact details?
- What makes consent valid under Section 6 of the DPDP Act?
- Must a Data Fiduciary maintain data accuracy?
- What is the right to correction and erasure?
- How are DPDP penalties determined by the Board?