The minimum content checklist
Under Section 5(1) of the Act and Rule 3 of the DPDP Rules, your privacy notice must include:
- An itemised list of every category of personal data you collect
- An itemised list of every purpose for which you process that data
- The manner in which the Data Principal can withdraw consent — with parity to how it was given
- The manner in which they can exercise their rights under Sections 11-14
- The manner in which they can lodge a complaint with the Data Protection Board
Why itemisation matters
'We collect personal information for service delivery' is not itemisation. The bar is closer to: 'We collect: (a) name, (b) mobile number, (c) email address, (d) device identifier, (e) location coordinates when you use our app.' Each item must be specific enough that a Data Principal can recognise it as something they have, in fact, given you.
Same standard for purposes: 'to provide the service' is too vague. 'To process your order, send delivery updates by SMS, and answer customer-support queries' is closer.
Withdrawal parity
If consent was given by ticking a checkbox at signup, withdrawal must be at least as easy — typically a one-click toggle in account settings. If consent was given via a cookie banner, withdrawal must be available through the same banner (or a clear equivalent). The clearest test: can a non-technical user withdraw consent in under 30 seconds without contacting support?
Languages
Section 5(3) requires the notice to be available in English plus the 22 Eighth Schedule languages on request. The Rules clarify that on most digital surfaces, 'on request' means a language-selector control. Best practice: detect the user's language and show the matching version by default.
What a compliant notice looks like
You can see our Privacy Notice Template (Template 01 in our library) for a fully worked example. The structure works in three layers: short summary at the top, itemised tables in the middle, contact and rights mechanics at the bottom.