DPDP privacy notice generator
Fill in a short form and get a plain-language privacy notice with the items the DPDP Act and Rules require. Copy it or download it as text, then review it before you publish.
Last updated 22 October 2026
What does a DPDP privacy notice have to say?
Under section 5 of the DPDP Act and rule 3 of the DPDP Rules, a notice must itemise the personal data you collect and the specified purpose, and explain how to withdraw consent, exercise rights and complain to the Data Protection Board. This generator drafts one in plain language from your answers, in your browser.
How do you draft a DPDP privacy notice?
Fill in the form. The preview updates as you type, and anything you leave blank shows as a placeholder in square brackets for you to complete. When you are done, copy the text or download it as a .txt file.
Live preview
Sign up once to see your results. It's free, and the results open here as soon as the form is sent.
Enter your business name and privacy contact email to see your notice.
Everything is generated in your browser. Nothing you type is stored or sent; only the one-time sign-up form is.
Which parts of the notice come from the Act and Rules?
Section 5(1) of the Digital Personal Data Protection Act, 2023 (official text) and rule 3 of the DPDP Rules, 2025 (G.S.R. 846(E)) set the minimum contents. The generated notice is built around them:
| Notice section | What it says | Source |
|---|---|---|
| Who we are | Your name as the Data Fiduciary and the link to your website or app | Rule 3(c) |
| The personal data we collect | An itemised list of the personal data | Act s. 5(1)(i); rule 3(b)(i) |
| Why we use it | The specified purposes and the goods, services or uses they enable | Act s. 5(1)(i); rule 3(b)(ii) |
| Children’s personal data | Verifiable parental consent; no tracking, behavioural monitoring or targeted advertising | Act s. 9; rule 10 (shown only if you process children’s data) |
| Who processes your data for us | That processors work under contract with security safeguards | Act s. 8(2) and 8(5); rule 6(1)(f) (shown only if you use processors) |
| How long we keep it | Erasure when the purpose is served or consent is withdrawn; one-year logs | Act s. 8(7); rule 8(3) |
| How to withdraw your consent | Means of withdrawal, as easy as giving consent | Act s. 6(4); rule 3(c)(i) |
| Your rights | Access, correction, erasure, grievance and nomination, and how to ask | Act ss. 11 to 14; rule 3(c)(ii); rule 14 |
| Questions and grievances | The contact who answers questions, and your response period | Act s. 8(9) and 8(10); rules 9 and 14(3) |
| Complaining to the Board | How to complain to the Data Protection Board, after your grievance process | Act s. 5(1)(iii) and 13(3); rule 3(c)(iii) |
| Language | The option to read the notice in English or an Eighth Schedule language | Act s. 5(3) |
What should you check before publishing the notice?
The generator gives you a starting draft. Before it goes live, check these points against how you actually work:
| Check | Why it matters |
|---|---|
| Every item of personal data is listed | Rule 3(b)(i) asks for an itemised description; a vague “and other information” does not meet it |
| Each purpose matches what you really do | Consent is limited to the personal data necessary for the specified purpose (Act s. 6(1)) |
| Withdrawal really is as easy as consent | If consent takes one tap, withdrawal should not need an email and a wait (Act s. 6(4)) |
| The notice appears where consent is asked | Section 5(1) requires the notice to accompany or precede the consent request |
| Retention periods reflect other laws | Tax, KYC or sector rules may require you to keep some records longer (Act s. 8(7)) |
| Translations are ready | People must be able to read it in English or an Eighth Schedule language (Act s. 5(3)) |
If people consented before the Act came into force, section 5(2) also requires you to send them a notice as soon as reasonably practicable. The DPDP compliance checker covers that and the other duties a notice cannot fix on its own.
What is Perimattic building for DPDP notices and consent?
The Perimattic DPDP Compliance Suite is planned software for Indian businesses. For notices and consent, the plan includes:
- A notice builder for rule 3 notices in English and the languages of the Eighth Schedule.
- A personal-data inventory, so the notice lists what you really collect and why.
- Consent capture and records, with withdrawal as easy as giving consent.
- Rights requests and grievances with response-time tracking.
- Verifiable parental consent workflows under rule 10.
Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet. Sign up to follow the build.
General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.
More on DPDP notices and consent
DPDP privacy notices, answered
Is a DPDP privacy notice the same as a privacy policy?
Not exactly. The DPDP Act speaks of a notice that must accompany or precede every request for consent, and rule 3 says it must be understandable on its own. Many businesses also publish it as their privacy policy page, but the notice has to be shown at the point of consent, not only buried in a footer link.
What must a DPDP privacy notice contain?
At the minimum: an itemised description of the personal data, the specified purpose and the goods, services or uses it enables, the link to your website or app, and how the person can withdraw consent, exercise her rights and complain to the Data Protection Board. Rule 3 applies from 13 May 2027.
Does the notice need to be in Hindi or other Indian languages?
Section 5(3) of the DPDP Act requires you to give people the option to read the notice in English or any language specified in the Eighth Schedule to the Constitution. You do not have to show every language at once, but you must be able to provide the one a person chooses.
Want DPDP compliance built around how your business handles data?
Sign up to tell us what personal data you handle, follow the build and be first to try the DPDP Compliance Suite when it opens.
Sign up