DPDP Privacy Notice Under Rule 3: What Europe's 2026 Transparency Sweep Teaches Indian SMEs

Ask most Indian founders where their privacy notice lives and they will point to a footer link: a long "Privacy Policy" page, often adapted from a template, last edited when the website went live. Under the DPDP Act, that page will not be enough. A DPDP privacy notice has a specific job, a specific format under Rule 3 of the DPDP Rules, 2025, and a fixed date from which it applies: 13 May 2027.

Europe offers a useful preview of how regulators look at notices. This year, 25 European data protection authorities have been checking exactly this question: do people know what is being done with their data?

What Europe's 2026 transparency push is checking

On 19 March 2026, the European Data Protection Board (EDPB) launched its Coordinated Enforcement Framework (CEF) action for 2026, focused on transparency and information obligations under Articles 12, 13 and 14 of the GDPR. The Board picked the topic at its October 2025 plenary. According to the EDPB, 25 authorities are taking part, contacting organisations across sectors either through formal enforcement or fact-finding exercises, with possible follow-up action. Findings are being pooled in the second half of 2026, and a consolidated report will go to the Board for adoption.

The choice is telling. A poor notice is where many other failures start: if a person does not know what you collect, they cannot object, withdraw, or complain in any meaningful way. The GDPR is a separate law, but the questions European authorities are asking this year map closely onto what the Data Protection Board of India will expect from May 2027.

What Section 5 and Rule 3 require in a DPDP privacy notice

Section 5 of the DPDP Act, 2023 says every request for consent must be accompanied or preceded by a notice. At a minimum, it must tell the Data Principal:

• the personal data and the purpose for which it will be processed;
• how she can exercise her rights, including withdrawing consent and her rights under Section 13 (grievance redressal);
• how she can complain to the Data Protection Board.

Rule 3 of the DPDP Rules, 2025 then sets the standard for how that notice is written. It must:

1. Stand on its own. The notice has to be understandable independently of any other information you publish. Telling users to "read our Terms of Service and Cookie Policy together with this notice" fails that test.
2. Use clear and plain language. It must give a fair account of what someone needs to know to give specific and informed consent.
3. Itemise the data. An itemised description of the personal data, so "name, mobile number, delivery address, UPI ID" rather than "information you provide to us".
4. Name the purpose and the service. The specified purpose, plus a specific description of the goods or services provided, or the uses enabled, by the processing.
5. Give working links. The particular communication link to your website or app, and a description of other means, through which the person can withdraw consent, exercise her rights, and complain to the Board.

There is one more line in Rule 3 that deserves attention: withdrawing consent must be possible with ease comparable to giving it. If sign-up takes one tap and opting out takes an email to a shared inbox and a ten-day wait, you have a problem.

Section 5(3) adds a language requirement. People must have the option to read the notice in English or in any of the 22 languages listed in the Eighth Schedule to the Constitution. For a D2C brand selling in Tamil Nadu, or a lending app with users in rural Maharashtra, that is a practical design task, not a footnote.

The legacy data problem

Section 5(2) is easy to miss. If you collected personal data with consent before the Act came into force, you still have to send those people a notice "as soon as it is reasonably practicable", covering the data and purposes processed so far. You may keep processing until they withdraw consent.

For a startup with 40,000 users on its CRM, that means an email, SMS or in-app notice campaign, with a plan for recording and honouring the withdrawals it triggers.

Five gaps we see in Indian privacy policies today

When we review policies for SMEs, the same weaknesses keep coming up:

• "Including but not limited to." Open-ended lists of data categories are the opposite of itemised.
• One purpose for everything. "To improve our services" covering analytics, marketing, credit scoring and model training at once.
• No withdrawal path. A grievance email address, but no button or setting to switch off a specific consent.
• No mention of the Board. Most Indian policies written before 2025 say nothing about complaining to a regulator.
• English only. Even where most customers prefer Hindi or a regional language.

None of these is expensive to fix.

A practical plan for the next six months

Tomorrow, 13 November 2026, the Consent Manager framework comes into operation. The notice obligation follows six months later. Here is a sensible order of work:

Weeks 1 to 4: inventory. List every point where you collect personal data: sign-up forms, checkout, WhatsApp chatbots, job applications, event registrations, and offline forms that are later digitised. For each, record what data is collected and why. Our DPDP compliance checklist is a quick way to start.

Weeks 5 to 10: draft layered notices. Write a short, standalone notice for each collection point, shown at the moment of collection. Keep purposes separate so consent can be granular.

Weeks 11 to 16: build the controls. Add a consent dashboard or settings page where people can withdraw consent as easily as they gave it. Wire withdrawals through to your CRM, marketing tools and processors.

Weeks 17 to 22: translate and test. Prioritise the languages your customers actually use. Test notices with a few real users: can they say, in their own words, what you will do with their data?

Before May 2027: legacy notices. Send Section 5(2) notices to existing users and log delivery.

If you process data at scale or in sensitive categories, a privacy impact assessment will help you find the processing that most needs plain-language explanation. For a wider review, see our DPDP Act compliance services.

Why the notice comes first

India's Board will be able to read your notice without asking for a single internal document. It is the first thing a complainant will screenshot, and the cheapest part of DPDP compliance to get right now.

This article is general guidance for Indian businesses and is not legal advice. Please consult a qualified professional for advice on your specific situation.

Want a quick read on where your current notices stand? Run through our free DPDP checklist, or talk to our team about a notice and consent review.