What does DPDP Rule 3 require in a consent notice? Rule 3 of the Digital Personal Data Protection Rules 2025 mandates that every consent notice must identify the Data Fiduciary by name, itemise each specific purpose of processing, list the categories of personal data collected per purpose, state whether consent is mandatory for service delivery, explain how Data Principals can exercise rights (access, correction, erasure, grievance), provide Grievance Officer contact details, and describe the consent withdrawal mechanism. The notice must be available in English and in any of the 22 scheduled languages upon request.
Answer 4 steps. Get a purpose-itemised, multi-language DPDP consent notice delivered to your inbox — fully formatted and ready to publish.
The DPDP Act 2023 imposes penalties of up to ₹250 crore per instance for failure to provide an adequate consent notice. The Data Protection Board can also issue directions requiring immediate remediation and suspension of data processing. For any organisation collecting personal data of Indian residents, a Rule 3-compliant consent notice is not optional — it is the legal foundation of your entire data processing framework.
Secure payment via Razorpay · Notice emailed within 2 business hours · PDF & Word format
Your Rule 3-Compliant Consent Notice has been sent to .
You will receive it within 2 business hours in PDF and Word format, ready to publish on your website or embed in your app.
Questions? Email hello@nitibharat.com
Please contact hello@nitibharat.com with your payment ID and we'll resolve it immediately.
Rule 3 requires every consent notice to clearly state the Data Fiduciary's name, each specific purpose of data processing, categories of personal data collected per purpose, whether consent is mandatory for service delivery, Data Principal rights (access, correction, erasure, grievance), Grievance Officer contact details, and the consent withdrawal mechanism. The notice must be in English and in at least one scheduled Indian language if requested.
Under the DPDP Act 2023, failure to provide an adequate consent notice can attract penalties of up to ₹250 crore per instance under Schedule 1. The Data Protection Board may also issue directions requiring immediate remediation, making a Rule 3-compliant notice an urgent compliance priority for all Data Fiduciaries.
Yes, but each purpose must be itemised separately and clearly within the notice. Rule 3 prohibits bundling unrelated purposes into a single blanket consent. For each purpose, you must state the data categories collected, whether consent is mandatory for service delivery, and the lawful basis. This Consent Notice Builder structures your notice correctly with purpose-by-purpose itemisation — up to 8 purposes in a single document.
