What is a privacy notice?
A privacy notice is the statement a business gives a person at the moment it asks for their consent, explaining what personal data it will process, why, and how the person can change their mind. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), every request for consent must be accompanied or preceded by such a notice, and the person must be able to read it in English or in any language listed in the Eighth Schedule to the Constitution.
The DPDP Rules 2025 set out what the notice must contain. It must be presented so that it can be understood independently of any other information, in clear and plain language, and give at least an itemised description of the personal data, the specified purpose of processing and the goods, services or uses that processing enables. It must also give a link to the business's website or app, and any other means, through which the person can withdraw consent as easily as they gave it, exercise their rights as a Data Principal and complain to the Data Protection Board of India.
A privacy notice is not a privacy policy. The policy is the full, published document describing all of a business's data practices; the notice is the short, purpose-specific statement shown at the opt-in, which links to the policy. Nor is it a Consent Record: the notice is what the person reads before agreeing, the record is the evidence kept afterwards, including which notice version they saw. The WhatsApp Business Messaging Policy separately requires businesses to secure the notices and permissions applicable law demands, including maintaining a published privacy policy. Most of the DPDP Act's duties, including the Rule 3 notice requirements, take effect on 13 May 2027; a WhatsApp opt-in designed to meet them now will not need rebuilding.
Key takeaways
- A privacy notice is the short, standalone statement shown when asking for consent: what data, for what purpose, and how to withdraw or complain.
- Under India's DPDP Rules 2025 it must be understandable on its own, in clear and plain language, with itemised data and purposes.
- It must give a link or other means to withdraw consent as easily as it was given, exercise rights and complain to the Data Protection Board.
- A notice is not a privacy policy: the policy is the full published document, which WhatsApp's own policy requires you to maintain.
- Most DPDP duties, notice included, take effect on 13 May 2027, but Meta's policy already requires a published privacy policy.
Why the difference matters
Why does a privacy notice matter?
The notice is what makes consent informed. Without it, an opt-in is a tick against wording nobody read, which fails the DPDP standard and makes later withdrawals and complaints harder to handle. A clear notice also sets expectations: customers who know they will get order updates and, if they choose, two offers a month block far less than customers who are surprised.
How does a privacy notice work?
- Step 1
List the data, item by item
Mobile number, name, order and delivery details, chat messages: each item the WhatsApp journey uses, rather than "your information".
- Step 2
Tie each item to a purpose
Order and delivery updates; offers, only for people who choose them; support conversations. One purpose per line, matching the consent choices offered.
- Step 3
Say what the processing enables
The goods, services or uses the person gets in return, such as delivery tracking or appointment reminders.
- Step 4
Explain the three exits
How to withdraw consent (reply STOP, tap a button or use a settings link), how to exercise rights such as access, correction, erasure and grievance redressal, and how to complain to the Board.
- Step 5
Make it standalone and readable
Show it next to the checkbox, or in the chat before the YES button, in the customer's language, with a link to the full privacy policy for everything else.
- Step 6
Version it
Give every notice text a version ID and store it in the consent record, so you can prove which notice each person saw.
Example: A coffee subscription checkout in Mysuru
A Mysuru coffee subscription used to show "By continuing you agree to our Privacy Policy" under its checkout button. It now shows two unticked boxes with a five-line notice: "We'll use your mobile number and order details to send delivery updates on WhatsApp, and, only if you tick the second box, coffee offers about twice a month. Reply STOP or use the link below to withdraw at any time. See how to access, correct or delete your data, or complain to the Data Protection Board, here. Full privacy policy: link." The same notice appears in Kannada for customers who browse in Kannada, and each opt-in is stored with notice version 3.
A privacy notice: key facts and limits
- Law
- DPDP Act 2023, section 5; DPDP Rules 2025, Rule 3
- Must be
- Standalone, in clear and plain language
- Minimum content
- Itemised data, specified purpose, goods or services enabled
- Exits it must explain
- Withdraw consent, exercise rights, complain to the Board
- Languages
- English or any Eighth Schedule language
- In force
- Most DPDP duties from 13 May 2027
- WhatsApp policy today
- Maintain a published privacy policy
Common mix-ups
Common mistakes with a privacy notice
Calling a policy link a notice
"By continuing you accept our privacy policy" points to another document; the DPDP Rules want a notice understandable on its own. Put the essentials next to the request and link the policy for detail.
One vague purpose
"To improve our services" covers everything and therefore nothing. Name each purpose, and match it to the consent choices you offer.
Withdrawal harder than consent
If joining takes one tap but leaving needs an email to a support address, the notice fails the as-easy-as rule. Offer STOP, a button or a settings link.
Notice after the tick
A notice sent in a welcome message after consent was collected does not inform that consent. Show it before or with the request.
Not versioning the text
Notices change; consent records that do not say which version a person saw cannot prove what they agreed to.
Rules of thumb
Best practices for a privacy notice
- Keep the WhatsApp-facing notice to four or five lines and link to the full policy for everything else.
- Offer the notice in the language the customer is already using in your app or website.
- Store the notice version with every consent record.
- Review the notice whenever you add a new message category or a new use of data.