---
title: "Rule 3: Notice given by Data Fiduciary to Data Principal"
url: https://dpdp.myndsolution.com/wiki/rules/rule-3-notice-given-by-data-fiduciary-to-data-principal/
description: "Rule 3 of the Digital Personal Data Protection Rules, 2025 (Notice given by Data Fiduciary to Data Principal). Official text verbatim, comes into force on…"
kind: rule
updated: 2026-09-09
official_source: https://egazette.gov.in/WriteReadData/2025/267650.pdf
text_type: official-text-plus-interpretation
publisher: MYND Integrated Solutions
license: Official Government of India texts are reproduced verbatim (public domain / open government data). Interpretation is CC BY 4.0, MYND Integrated Solutions.
disclaimer: Not legal advice. Official text prevails over any interpretation.
html_version: https://dpdp.myndsolution.com/wiki/rules/rule-3-notice-given-by-data-fiduciary-to-data-principal/
---
# Rule 3: Notice given by Data Fiduciary to Data Principal

*The Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) dated 13 November 2025. Comes into force on 13 May 2027.*

## Official text

The notice given by the Data Fiduciary to the Data Principal shall—

- **(a)** be presented and be understandable independently of any other information that has been, is or may be made available by such Data Fiduciary;

- **(b)** give, in clear and plain language, a fair account of the details necessary to enable the Data Principal to give specific and informed consent for the processing of her personal data, which shall include, at the minimum, —
  - **(i)** an itemised description of such personal data; and
  - **(ii)** the specified purpose or purposes of, and specific description of the goods or services to be provided or uses to be enabled by, such processing; and

- **(c)** give, the particular communication link for accessing the website or app, or both, of such Data Fiduciary, and a description of other means, if any, using which such Data Principal may—
  - **(i)** withdraw her consent, with the ease of doing so being comparable to that with which such consent was given;
  - **(ii)** exercise her rights under the Act; and
  - **(iii)** make a complaint to the Board.


## Made under

- [s. 5 Notice](https://dpdp.myndsolution.com/wiki/act/section-5-notice/)

## Interpretation in plain English (not legal advice)

> This is a plain-English interpretation of the official text, prepared by the DPDP Wiki editorial team. It is not the law and not legal advice, and it may be incomplete or wrong. Always rely on the official text of the Act, the Rules and the notifications, and take advice from a qualified professional for your situation.

Rule 3 sets out how a Data Fiduciary (an entity determining the purpose and means of processing personal data) must present a notice to a Data Principal (the individual whose data is being processed) when asking for consent. The notice must stand on its own. It must be understandable without requiring the individual to read any other information that the Data Fiduciary has made available or might make available in the future.

The notice must use clear and plain language to give a fair account of what is needed for the individual to give specific and informed consent. At a minimum, this means the notice must include an itemized description of the personal data being collected. It must also state the specific purposes for processing the data and describe the exact goods, services, or uses that the processing will enable.

Finally, the notice must tell the individual how to manage their consent and rights. It must include a specific communication link to the Data Fiduciary's website or app, along with a description of any other available methods. Through these channels, the individual must be able to withdraw their consent just as easily as they gave it, exercise their rights under the Act, and make a complaint to the Board (the Data Protection Board of India).

### Key points

- The notice must be understandable on its own, without relying on other information provided by the Data Fiduciary (a).
- It must use clear and plain language to help the Data Principal give specific and informed consent (b).
- The notice must include an itemized description of the personal data to be processed (b)(i).
- It must state the specific purposes of processing and describe the goods, services, or uses enabled by it (b)(ii).
- The notice must provide a link to a website or app, and describe other means, for the Data Principal to withdraw consent, exercise rights, or complain to the Board (c).
- The process to withdraw consent must be as easy as the process used to give it (c)(i).

### Common misreadings

- A Data Fiduciary cannot bury the notice details inside a larger privacy policy or terms of service, because the rule requires the notice to be understandable independently of any other information.
- The notice cannot just state a general purpose; it must provide an itemized description of the data and a specific description of the goods or services provided.

*Interpretation prepared 2026-09-09 from the official text only; the official text prevails.*

---
Cite as: DPDP Rules, 2025, r. 3. Official source: https://egazette.gov.in/WriteReadData/2025/267650.pdf