Rule 3 — DPDP Rules, 2025
(1) Every Data Fiduciary shall give to each Data Principal a notice in clear and plain language, prior to processing personal data, containing— (a) a description of the personal data sought to be collected and the purpose for which it is to be processed; (b) a description of the rights available to the Data Principal under the Act and the manner in which they may be exercised; (c) the manner in which the Data Principal may make a complaint to the Board. (2) The notice shall— (a) be presented in such a manner that the Data Principal is made aware of the specific items listed in sub-rule (1); (b) not be embedded in, or presented as part of, any other document or statement.
Source: Digital Personal Data Protection Rules, 2025. Official text available at truconsent.io/resources/dpdp-rules.pdf.
Rule 3 operationalises Section 5's notice requirement with three tests: content (what must be disclosed), clarity (clear and plain language), and separateness (the notice cannot be buried inside a terms document or combined with other statements). A notice that passes on content but fails on separateness — for example, a privacy policy that embeds consent notice language in paragraph 47 of 50 — is non-compliant. The notice must stand alone, be clearly labelled, and be presented before any data collection begins.
An app that presents a 4,000-word privacy policy and asks users to 'agree to all' before proceeding fails Rule 3(2)(b). The consent notice for each purpose must be presented separately from the privacy policy, the terms of service, and any other document. The notice for marketing communications must be distinct from the notice for account creation.
A notice that reads 'By continuing, you acknowledge our data processing as described in Schedule II, Annexure B, Clause 4.3(ii)' is not in clear and plain language. The Data Principal must be able to understand the purpose and their rights from the notice itself, without cross-referencing other documents.
A consumer platform serving users across multiple Indian states must be able to present notices in the language the Data Principal has indicated as their preference. For a platform serving users who communicate in Tamil, the notice must be available in Tamil — presenting only an English notice is not compliant with the 'clear and plain language' requirement for that user.