DPDP Notice Design: Rewriting Consent Screens Under the DPDP Act and Rules
By Ravi Sisodia · Reviewed by CA Divyanshu Sengar · Updated 5 October 2026
Rule 3 of the final DPDP Rules sets a clear standalone-notice standard, but as of 4 October 2026 that rule is still on the 18-month commencement track; product teams should use the remaining implementation window to rebuild consent flows.
Finin2min 2-Minute Summary
- Rule 3 requires notice to be understandable independently, use clear/plain language and itemise personal data and specified purposes.
- The notice must give a link/means for consent withdrawal, exercise of rights and complaint access.
- Rule 3 is notified but is scheduled to commence 18 months after Gazette publication; it is not yet an operative October 2026 obligation.
- Consent screens should separate essential service processing from optional purposes instead of using one broad bundle.
- Design evidence should preserve notice version, language, timestamp and the consent action linked to each purpose.
Current legal status comes before UI design
Build the notice from a processing inventory
For each screen, list personal-data elements, purpose, service/use enabled, recipient/system and retention trigger. If the purpose cannot be described specifically in plain language, the underlying data practice is probably not ready for a compliant notice.
Do not use a legal-policy link as the only notice. Rule 3's design is deliberately standalone.
Withdrawal should be as operational as consent
The future rule requires the notice to point to a practical route for withdrawal and rights. Product, CRM and data systems should therefore support revocation propagation; a front-end toggle that leaves downstream marketing active is not enough.
Preserve the exact consent record so the organisation can prove what the user saw and agreed to.
October 2026 status: Rule 3 text is final, commencement is still ahead
The final notice rule is already known, so product teams can design against stable wording. However, as of 4 October 2026, Rule 3 remains on the 18-month commencement schedule from the November 2025 Gazette publication. Treat the present period as controlled implementation and testing, not as evidence that a May 2027 duty is already legally in force.
Use the gap period to inventory every live consent surface - web, mobile, call centre, branch, partner API and legacy account migration. A compliant-looking new mobile screen does not solve older channels that still capture broad consent or provide no withdrawal route.
Testing should include a user who refuses one optional purpose, a user who withdraws later, and a user who changes language. Verify that downstream systems actually honour each state.
- Map every consent channel, including legacy/partner flows.
- Test partial refusal and later withdrawal.
- Preserve notice/version shown in each language.
- Do not label readiness controls as already-operative Rule 3 compliance.
Readiness test
- Itemised personal-data list.
- One or more specified purposes.
- Plain-language service/use description.
- Rights/withdrawal/complaint link.
- Purpose-level consent state.
- Notice version and timestamp.
- Downstream suppression test after withdrawal.
Questions readers commonly ask
Is Rule 3 already in force on 4 October 2026?
No. The notified rule is on the 18-month commencement track, scheduled for May 2027.
Can a privacy policy link replace the notice?
The final rule requires a notice understandable independently of other information.
Should every purpose be bundled into one checkbox?
Avoid unnecessary bundling; consent should remain specific and informed.
What evidence should product teams keep?
Notice version, data/purpose shown, user action and downstream consent state.
Official / primary sources
- DPDP Rules, 2025 - final Gazette - Rule 3 notice requirements and commencement clause
- DPDP Act, 2023 - Consent and Data Fiduciary framework
- DPDP Act enforcement timeline - Phased commencement: core obligations after 18 months
Disclaimer
Important: General educational and professional-reference material. Apply the current Code, Rules, insurance contract/regulatory instrument or DPDP commencement status to the exact facts before acting. Educational and professional reference only; confirm the current law, rates and the facts of your case before relying on this page.