DPDP Insights › Questions › What should our privacy notice say, and where must people se

Question

What should our privacy notice say, and where must people see it?

Short answer: Yes, at every point where you collect data

A notice must tell people, in plain words, what data you collect, why, how they can withdraw consent, how they can use their rights and how they can complain to the Data Protection Board. It has to stand on its own, separate from long terms and conditions, and be shown at the point where data is collected.

What the law says

Section 5 and Rule 3 ask for a notice that can be understood on its own, with an itemised list of the data and the purpose for each item. Data you already hold from before the Act also needs a notice, as soon as reasonably practicable.

Section 5 · Rule 3: When you ask for consent, give a clear notice that stands on its own: what data, for what purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board. For data collected before the Act, a notice is due as soon as reasonably practicable.
Section 6: Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, limited to the data needed for the purpose, and as easy to withdraw as it was to give.
Sections 11–14 · Rule 14: People can ask for a summary of their data and who it was shared with, ask for correction, completion, updating or erasure, complain, and nominate someone to act for them. You must publish how to do this.

Steps

List every point where personal data comes in: forms, apps, counters, calls, emails, partner feeds.
Write one short notice per collection point, with the data items and purpose side by side.
Add how to withdraw consent, how to make a request and the DPO or contact person's details.
Offer the notice in English and in the languages your customers actually use.
Keep each version with the date it went live.

Evidence to keep

Screenshots or copies of the notice at each collection point, with dates
Notice version history
Translations, where used

Common mistakes

Hiding the notice inside terms and conditions
One notice for everything, with no link between data items and purposes
Forgetting old data collected before the Act

How it plays out by sector

Banking, financial services and insurance: A bank's account opening form, its mobile app sign-up and its loan application each need their own short notice, separate from the terms and conditions.
IT, ITeS, BPO and GCC: Your careers page, candidate portal, employee onboarding and website forms need notices. For client data, the client gives the notice.
Central government: ministries and departments: A scheme portal should show what data is collected, why, and a contact for questions and corrections, even where consent is not the basis.
Public sector undertakings and utilities: LPG booking, new connection forms, ticket counters and bill payment portals each need a notice.
Healthcare and hospitals: Registration desks, appointment apps, lab forms and health-camp sign-ups need short notices in the languages patients speak.

From each seat

DPO / Privacy lead: You own the wording and the version history. Keep a folder with every live notice, its date and who approved it; that folder is usually the first thing an auditor asks for.
Legal & compliance: Approve the wording and keep it simple. A notice a regulator can read in two minutes is better than a complete one nobody reads.
Operations head: Your counters, forms and call scripts are where notices are actually seen. Check that each one shows the current version.
Administration department: Reception and gates are collection points. Put the short notice there.
Marketing department: Landing pages, contest forms and event sign-ups each need a short notice.

What a good answer from management sounds like

“We have listed all our collection points, and each one now shows a short notice. Legal has approved the wording, and the old notices are archived with dates.” Effort and time: Light to medium · 4 to 8 weeks.