What must a DPDP privacy notice contain?

A GDPR style privacy policy is not automatically a DPDP notice. Rule 3 has its own shape, and it is stricter about standalone readability than most policies in the wild.

It must stand alone

"be presented and be understandable independently of any other information that has been, is or may be made available by such Data Fiduciary"

A notice that only makes sense alongside your terms of service, cookie banner or help centre fails this on its face. One document, readable by itself.

It must enable informed consent, with two named minimums

The notice must give, in clear and plain language, a fair account of what is needed for specific and informed consent, including at minimum an itemised description of the personal data, and the specified purposes together with a specific description of the goods or services to be provided or uses to be enabled. Itemised is the operative word: broad categories written to cover everything are the opposite of an itemised description.

It must give working paths, not promises

The notice must give the particular communication link for your website or app, and describe any other means, through which the person can do three things: withdraw consent with ease comparable to how they gave it, exercise their rights under the Act, and make a complaint to the Data Protection Board. Comparable ease is a design constraint; a one tap consent with an email and postal letter withdrawal does not read like comparable ease.

When this bites

Rule 3 is in the eighteen month commencement group; the computed date is 13 May 2027 and is interpretation until officially confirmed. Notices take longer to rewrite than teams expect, because the itemised description forces a data inventory first.

What to do

Run your current notice through the checker element by element; it maps every gap to the exact provision. The full official text lives at Rule 3.