Privacy notices and consent under DPDP

Almost certainly not, and it is the most common misunderstanding we meet. The Act names a notice under section 5, and Rule 3 requires it to be presented so it can be understood independently of any other information, in clear and plain language, with an itemised description of the personal data and the purpose. A company-wide policy linked from your footer is broad by design and covers everything at once — which is the opposite of itemised, and cannot be tied to the moment a particular person hands over particular data. Keep the policy; procurement teams and app stores expect one. Just do not let it stand in for the notice.

Yes. Section 5(2) says that where a person gave consent before the Act commenced, you must give them a notice as soon as reasonably practicable — informing them of the personal data and the purpose it has been processed for, how to exercise their rights and withdraw, and how to complain to the Board. The relief is that you may continue processing until they withdraw, so this is not a business interruption. It is a drafting and delivery exercise across your whole existing base, and it is the obligation established businesses are most likely not to have scoped at all.

No, and this is worth being blunt about because the instinct is so common. Consent under section 6 carries a withdrawal right under section 6(4). If you ask for consent to something you would lawfully continue under section 7 — treating a patient, running payroll — you have created a switch you cannot honour when somebody flips it. Section 6(1) also requires consent to be free and unconditional, and section 6(2) voids any part that infringes the Act, so consent you would ignore if refused was never valid consent. The first piece of work is sorting purposes by lawful basis. The writing comes after.

Section 5(3) gives the person the option of English or any language in the Eighth Schedule — twenty-two of them. That is an option they hold, not twenty-two documents you must publish on day one. In practice you choose from who you actually serve: a hospital in Indore needs Hindi and English before anything else, and a national platform needs a wider set. We help you decide honestly, because translating into languages nobody asks for is a cost with no compliance return, and missing the one your patients speak is the opposite.

You can, and for a simple business it may get you most of the way. The parts a template cannot supply are the ones that fail: the itemised list of what you collect, the purposes you pursue, whether each rests on consent or a legitimate use, and which of your forms and screens the notice has to appear on. A template is a shape. Most of the work is what goes in it, and a generic notice that does not describe your actual processing is worse than useless because it looks compliant.

Yes — retention, access control and breach response, written so your team can follow them rather than admire them. Worth knowing that the Act does not name these documents the way it names the notice; they exist because Rule 6 requires specific security safeguards, Rule 8 governs erasure, and Rule 7 sets what happens in a breach, and none of those can be discharged by people improvising. A policy nobody follows is evidence against you, so we keep them short enough to be followed.