Privacy Notice Checklist for Websites and Apps
Reviewed by CA Nikhil Gupta · Last reviewed 26 May 2026
A website and app privacy-notice framework covering itemised data, specified purposes, contact details, rights links, consent withdrawal, vendors and retention.
For broader context, see the Data Privacy, DPDP and Cyber Law — Full Compliance Hub.
A notice should describe the real product data flow. A polished template that omits pixels, support recordings or vendor sharing can mislead users.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
Rule 3 requires a future notice to be understandable independently, use clear language, itemise personal data and specify purposes and enabled goods, services or uses.
The notice should provide a link or method for consent withdrawal, rights exercise and Board complaints when the relevant rule commences.
A privacy notice is different from terms, a cookie banner, security policy and marketing preference centre, though they should not contradict one another.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- Rule 3 requires a future notice to be understandable independently, use clear language, itemise personal data and specify purposes and enabled goods, services or uses.
- The notice should provide a link or method for consent withdrawal, rights exercise and Board complaints when the relevant rule commences.
- A privacy notice is different from terms, a cookie banner, security policy and marketing preference centre, though they should not contradict one another.
- Sector, consumer, telecom, banking, insurance and employment obligations can require additional disclosures before the main DPDP provisions commence.
The five-point review
| Check | What to examine |
|---|---|
| Data fields | Account, device, location, payment, support and analytics. |
| Purpose | Service, fraud, legal compliance, personalisation and marketing. |
| Sharing | Processors, group entities and regulated recipients. |
| Lifecycle | Collection, storage, transfer, retention and deletion. |
| User action | Consent, withdrawal, rights and grievance. |
Practical example
An app notice says it collects only name and mobile number, but its SDK sends advertising identifiers, precise location and purchase events to three vendors. The notice should be rebuilt from the technical data map rather than the signup form.
How to apply the framework
Create a notice matrix mapping each data category to purpose, legal route, recipient, retention, security and user control. Product, engineering, marketing, support and legal should approve the same source table.
Version the notice and preserve the user-facing screen shown at collection. A footer update does not prove what a user saw before giving consent.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review data fields, purpose and sharing together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Action checklist
- Scan website and app flows.
- Itemise data and purposes.
- Describe sharing accurately.
- Publish contact and rights routes.
- Archive every version.
- Test mobile readability.
Evidence to keep
- Notice matrix
- SDK and vendor inventory
- Screenshots and versions
- Consent records
- Grievance workflow
Warning signs
- Copied template
- Broad ‘business purposes’ wording
- Vendor sharing omitted
- Withdrawal harder than signup
- No version archive
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.
Frequently Asked Questions
Source and review trail
Use the current official instrument, portal or regulator publication before acting. This panel separates the category authority from page-specific references.
- Primary category
- Data Protection, Cyber & IT Law
- Official starting point
- www.meity.gov.in