Rule 3Notice, Consent & Consent Managers
Contents and form of notice
What the Rule sets out
Sets out the operative detail behind Section 5 notice: it must independently itemise the personal data collected and the specific purpose for each item, be presented in clear language, and give the Data Principal a direct way to withdraw consent and reach the grievance officer — all without requiring her to hunt through a separate, unlinked privacy policy.
What this means in practice
- A single generic consent checkbox for 'our privacy policy' does not satisfy this rule — each purpose needs its own itemised line.
- The withdrawal path and grievance contact must be reachable from the same notice screen, not several clicks away.
Summarised for practical use from the publicly notified DPDP Rules, 2025. Confirm exact clause text against the official Gazette notification before relying on it for compliance decisions.