Notice under the DPDP Act for digital products

A privacy notice should inform the user, not test their stamina.

A notice under the DPDP Act is a product control as much as a legal document. India Code identifies the Digital Personal Data Protection Act, 2023 as Act 22 of 2023, enacted on 11 August 2023, and lists Section 5 on notice, Section 6 on consent and other provisions relevant to processing and obligations. India Code also lists DPDP Rules, 2025 material and notifications dated 13 November 2025, with a corrigendum dated 11 December 2025. Teams should verify current official rules and commencement material before final publication decisions.

For digital products, the notice must be reviewed where users actually encounter the product: signup screens, checkout flows, dashboards, mobile prompts, employee portals, support journeys and consent interfaces. A PDF linked in the footer cannot fix a journey that collects data without a clear explanation at the right moment.

What to review

Review each collection point. Identify what personal data is collected, why it is collected, whether consent is requested, whether another processing ground is relied on, and how the user can act on the information.

Review the language. The notice should be specific enough for the processing activity but plain enough for the user. Avoid vague phrases that hide multiple purposes. If the product collects data for account creation, payments, security, analytics and marketing, the notice design should not flatten those uses into a single broad statement.

Review version control. Teams should know which notice applied to which launch or flow. Product updates, new vendors, new purposes and withdrawal changes should trigger notice review.

Implementation steps

1. Map notices to actual product screens, forms, APIs, dashboards and user journeys.
2. Align each notice with the data inventory and purpose map.
3. Check consent, withdrawal and complaint routes against the same journey.
4. Maintain approved text, version history, launch date and screenshots.
5. Test whether support teams can answer user questions using the notice record.
6. Review the notice after product, vendor, campaign or retention changes.

Notice work should involve product and design teams. Placement, timing, language and interaction design affect whether the notice functions in practice.

Common mistakes

• Treating a website privacy policy as the only notice for all digital product collection points.
• Using broad purpose language that does not match actual product, analytics or vendor workflows.
• Failing to keep version history and screenshots showing what notice users saw at launch.

How DataNuance can help

DataNuance can review DPDP notices for Indian digital products, including onboarding flows, app screens, consent journeys, dashboards, support routes and version records.

For a DPDP notice review for a digital product, contact DataNuance.

FAQs

Is a privacy policy the same as a notice?

Not always. A notice should be connected to the relevant collection and processing context, not only a general policy page.

When should notice text appear?

It should appear at a point that makes sense for the user journey and the processing decision involved.

Should notices be version controlled?

Yes. Version records help show what information was provided for a given product flow or launch.

Who should review product notices?

Legal, product, design, support and security teams may all need input depending on the processing activity.

Sources

• Digital Personal Data Protection Act, 2023 on India Code: https://www.indiacode.nic.in/handle/123456789/22037?view_type=browse
• MeitY Digital Personal Data Protection Rules, 2025 page: https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa?pageTitle=Digital-Personal-Data-Protection-Rules-2025.pdf