Introduction
India's Digital Personal Data Protection Act, 2023 (DPDP Act), together with the Digital Personal Data Protection Rules, 2025, has raised the bar for transparency in data processing. One of the most practical requirements concerns the privacy notice. The law treats the notice as the foundation of informed consent. In a country with deep linguistic diversity, that foundation must be accessible in the languages people actually understand.
This article explains the legal requirements around privacy notices under the DPDP framework, with a special focus on the language obligation, and what organisations need to do to prepare.
What Is a Privacy Notice Under the DPDP Act?
Section 5 of the DPDP Act requires every Data Fiduciary to give a notice to the Data Principal when seeking consent under Section 6. The notice must inform the individual of:
- The personal data proposed to be processed and the purpose of that processing
- The manner in which the individual may exercise rights under Section 6(4) (withdrawal of consent) and Section 13
- The manner in which a complaint may be made to the Data Protection Board of India
Rule 3 of the DPDP Rules, 2025 adds important operational detail. The notice must:
- Be presented and understandable independently of any other information provided by the Data Fiduciary
- Be in clear and plain language
- Contain an itemised description of the personal data
- Specify the purpose(s) of processing and describe the goods, services, or uses enabled by that processing
- Provide a communication link (to the website or app) and a description of other means through which the individual can withdraw consent, exercise rights, and complain to the Board
Withdrawal of consent must be as easy as giving it. A privacy policy buried inside terms and conditions does not meet this standard. The notice must stand on its own.
Key Requirements of a Valid DPDP Privacy Notice
| Requirement | Source | What It Means in Practice |
|---|---|---|
| Standalone notice | Rule 3(a) | Must be understandable on its own, not buried in T&Cs |
| Clear & plain language | Rule 3(b) | Easy for an ordinary person to understand |
| Itemised personal data | Rule 3(b)(i) | Specific categories of data (not vague phrases) |
| Specific purpose + goods/services | Rule 3(b)(ii) | Clear link between data and the service/use |
| Rights & withdrawal mechanism | Section 5 + Rule 3(c) | Easy way to withdraw consent and exercise rights |
| Complaint mechanism | Section 5 + Rule 3(c) | Clear path to the Data Protection Board |
| Language option | Section 5(3) | Available in English or any Eighth Schedule language |
The Language Requirement: English or Any Eighth Schedule Language
Section 5(3) of the DPDP Act states:
The Data Fiduciary shall give the Data Principal the option to access the contents of the notice in English or any language specified in the Eighth Schedule to the Constitution.
This is a statutory right of the Data Principal. The Eighth Schedule currently lists 22 languages:
| No. | Language | No. | Language | No. | Language |
|---|---|---|---|---|---|
| 1 | Assamese | 9 | Konkani | 17 | Sanskrit |
| 2 | Bengali | 10 | Maithili | 18 | Santali |
| 3 | Bodo | 11 | Malayalam | 19 | Sindhi |
| 4 | Dogri | 12 | Manipuri | 20 | Tamil |
| 5 | Gujarati | 13 | Marathi | 21 | Telugu |
| 6 | Hindi | 14 | Nepali | 22 | Urdu |
| 7 | Kannada | 15 | Odia | ||
| 8 | Kashmiri | 16 | Punjabi |
The law does not require every organisation to publish notices in all 22 languages from day one. It requires that the individual be given the option to access the notice in English or any of these languages. In practice, organisations should prioritise the languages relevant to their user base and maintain a process to provide other scheduled languages on request.
Take Action: Build Compliant Privacy Notices
The DPDP Act makes the privacy notice the cornerstone of informed consent.
Organisations that act early will not only meet compliance requirements but also build trust with their users.
Next steps you can take:
- Audit your existing privacy notices against the DPDP Act and Rules, 2025
- Identify the languages most relevant to your user base
- Prepare clear, standalone notices in English and at least one Eighth Schedule language
- Implement easy mechanisms for consent withdrawal and complaints
📌 Don’t wait until enforcement begins. Start preparing your multilingual, user‑friendly privacy notices today.
[Learn more & get started →](/contact)