Notice given by Data Fiduciary to Data Principal
- Status
- Upcoming
- Applies from
- 13 May 2027Rule 1(4)
- Penalty
- Up to Rs 50 croreAct, Schedule, item 7
- Binds
- Every Data Fiduciary
In plain English
Sets what a consent notice must contain and how it must read. The notice has to stand on its own, without sending the reader to a privacy policy or terms page, and it must use clear and plain language. At the minimum it lists the personal data item by item, states the purpose and describes the goods, services or uses the processing enables.
It must also give the link to your website or app, and any other means, through which the person can withdraw consent as easily as they gave it, exercise their rights under the Act and complain to the Data Protection Board.
What you must do
Rewrite each consent notice so it is understandable on its own, with an itemised list of the personal data and the specific purpose.
Describe the goods, services or uses the processing enables, in plain language.
Give the link and other means for withdrawing consent, exercising rights and complaining to the Board, and make withdrawal as easy as giving consent.
Links marked Product, Service or Free tool are Infofacility's own.
Note
Rule 3 goes with s. 5 of the Act, which requires the notice to accompany or precede every request for consent, and to be re-served for consent obtained before the Act commenced.
Gazette text · Rule 3The notice given by the Data Fiduciary to the Data Principal shall—
- The notice given by the Data Fiduciary to the Data Principal shall—
- (a)be presented and be understandable independently of any other information that has been, is or may be made available by such Data Fiduciary;
- (b)give, in clear and plain language, a fair account of the details necessary to enable the Data Principal to give specific and informed consent for the processing of her personal data, which shall include, at the minimum, —
- (i)an itemised description of such personal data; and
- (ii)the specified purpose or purposes of, and specific description of the goods or services to be provided or uses to be enabled by, such processing; and
- (i)
- (c)give, the particular communication link for accessing the website or app, or both, of such Data Fiduciary, and a description of other means, if any, using which such Data Principal may—
- (i)withdraw her consent, with the ease of doing so being comparable to that with which such consent was given;
- (ii)exercise her rights under the Act; and
- (iii)make a complaint to the Board.
- (i)
- (a)
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy)
Act sections and tools that apply
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy) · Change log