DPDP Privacy Notice Generator India — Rule 3 Compliant

1. Organisation

Organisation name

Website URL

Contact email

2. Data categories (Rule 3(a))

Identity data

name, date of birth, photo

Contact data

email, phone, address

Financial data

card last 4, UPI handle, billing address

Health data

lab reports, medical history

Location data

IP-derived city, GPS in app

Device data

browser, OS, screen size, language

Usage data

pages viewed, features used, session times

KYC data

Aadhaar masked, PAN, GST

Employment data

designation, employer, salary band

3. Purposes (Rule 3(b))

To provide the core service requested

Consent + Section 7 legitimate use

To respond to customer-support queries

Consent + Section 7(b)

To process billing and payments

Consent + Section 7(a) performance of contract

To prevent fraud and abuse

Section 7 legitimate use

To improve the product through analytics

Consent (Section 6)

To send marketing and promotional messages

Specific marketing consent (Section 6)

To use anonymised data for research

Specific research consent (Section 6)

To comply with statutory and legal obligations

Section 7 legitimate use

Custom purpose (optional)

4. Retention & flags

Retention period (months)

Rights SLA (days)

We transfer data outside IndiaWe process data of children (under 18)

5. Grievance Officer (Rule 3(d))

Name

Email

Phone (optional)

Generated notice · live preview

PRIVACY NOTICE
[Your Organisation Name]
Effective date: 31 October 2026
Issued under Section 5 of the Digital Personal Data Protection Act, 2023 and Rule 3 of the DPDP Rules, 2025.

1. WHO WE ARE
[Your Organisation Name] ("we", "our") operates [your website URL]. This notice explains what personal data we collect, why, and how you can exercise your rights as a Data Principal under the DPDP Act 2023.

2. WHAT WE COLLECT (Rule 3(a))
We collect the following categories of personal data:
  1. Identity data — name, date of birth, photo.
  2. Contact data — email, phone, address.
  3. Device data — browser, OS, screen size, language.
  4. Usage data — pages viewed, features used, session times.

3. WHY WE COLLECT IT (Rule 3(b))
We process the data above for the following specific purposes:
  1. To provide the core service requested. Lawful basis: Consent + Section 7 legitimate use.
  2. To respond to customer-support queries. Lawful basis: Consent + Section 7(b).
  3. To prevent fraud and abuse. Lawful basis: Section 7 legitimate use.
  4. To comply with statutory and legal obligations. Lawful basis: Section 7 legitimate use.

4. HOW LONG WE KEEP IT (Section 8(7))
We retain your personal data for 24 months from the date of last engagement, unless a longer retention period is required by law (e.g. MCI Regulations 2002 for clinical records, NDPS Act 1985 for prescription records, Income Tax Act 1961 for financial records). After the retention period or upon a valid erasure request, we delete or anonymise your data and instruct our processors to do the same.

5. HOW TO WITHDRAW CONSENT (Rule 3(c))
You can withdraw your consent at any time, for any purpose, without affecting our processing on the same data prior to withdrawal. To withdraw consent:
  - Visit [your website URL]/preferences (or the "Manage cookies" link in our footer) to change cookie and marketing preferences.
  - Email grievance@[your website URL] to withdraw consent for any other purpose.
Withdrawal is as easy as giving consent and takes effect immediately. Upon withdrawal, we will cease the corresponding processing and instruct our processors to do the same.

6. YOUR RIGHTS AS A DATA PRINCIPAL (Sections 11-14)
You have the right to:
  - Access the personal data we hold about you (Section 11).
  - Correct inaccurate or incomplete data (Section 12).
  - Request erasure of your data, subject to statutory retention (Section 12).
  - Nominate someone to exercise your rights on your behalf (Section 14).
  - Receive a grievance redressal within 30 days (Section 13).
To exercise any right, email grievance@[your website URL] with your request and a proof of identity. We will respond within 30 days.

7. GRIEVANCE REDRESSAL (Rule 3(d))
Grievance Officer: [Grievance Officer Name]
Email: grievance@[your website URL]
Response timeline: within 30 days of receiving your request.

8. RIGHT TO COMPLAIN TO THE DATA PROTECTION BOARD (Rule 3(e))
If your complaint is not resolved to your satisfaction, you have the right to file a complaint with the Data Protection Board of India (DPB) once the Board is operational. Visit dpbi.gov.in (URL once notified) or the MeitY portal for the current filing procedure.

9. CROSS-BORDER TRANSFERS (Section 16)
We store and process your personal data within India. We do not currently transfer personal data outside India.

10. CHANGES TO THIS NOTICE
We will update this notice when our processing changes. The "Effective date" at the top reflects the most recent update. Material changes will be notified to you by email or an on-site banner before they take effect.

— End of notice —

Output is a starting template. Have your counsel review before publishing — particularly if you are a Significant Data Fiduciary.

How this helps

Why a Section 5 notice is the most cost-effective DPDP fix

Closes the highest-frequency scanner finding

Across thousands of DPDP scans on Indian sites, "no Rule 3 notice" or "missing grievance officer" is the most common finding. The Schedule 1 cap is ₹50 cr — and a proper notice closes it in an afternoon, not a quarter.

Earns the cooperation factor under Section 33(2)

A published, itemised notice signals to the Data Protection Board that you are operating in good faith. Section 33(2) explicitly treats cooperation and visible safeguards as mitigators when calculating any future penalty.

Common questions

FAQ

Is this notice DPDP Act 2023 + Rules 2025 compliant?

Yes — it includes all five Rule 3 mandatory items (data categories, purpose, withdrawal mechanism, grievance officer contact, DPB complaint right). The generated text is plain-English so it also meets the "clear and plain language" standard of Section 5.

Does it replace my existing privacy policy?

It complements it. The DPDP "consent notice" must be served at the moment of collection and is separate from a longer privacy policy. Use this tool for the notice; keep your fuller policy for general transparency.

Can I customise it for my industry?

Yes. The form lets you list industry-specific purposes (e.g. lab testing, lending, KYC, edtech enrolment) — those flow into the generated notice as itemised purposes.

Is this legal advice?

No. The output is a starting template — you should still have a lawyer review it before publishing, particularly if you are a Significant Data Fiduciary or in a regulated sector.

Next steps

DPDP Privacy Notice Generator

Why a Section 5 notice is the most cost-effective DPDP fix

Closes the highest-frequency scanner finding

Earns the cooperation factor under Section 33(2)

FAQ

Use this with our other DPDP tools

DPA Generator →

Banner Builder →

Gap Analysis →