Does the DPDP Act Require Separate Notices for Different Categories of Data Principals?

Introduction

The Digital Personal Data Protection Act, 2023 (DPDP Act) does not expressly require every organisation to issue a separate privacy notice for every category of Data Principal. Instead, the statutory framework prescribes certain core requirements for notices and introduces additional obligations depending on the nature of the Data Principal, the purpose of processing, and the legal basis relied upon for processing personal data.

This distinction is particularly important for organisations dealing with children, persons with disability who have lawful guardians, employees, customers and users, or multiple categories of Data Principals across different products and services.

Accordingly, while a single privacy notice may be capable of covering multiple categories of Data Principals in some circumstances, a one-size-fits-all notice may not always be appropriate from a compliance and transparency perspective. Organisations should assess whether their notices accurately reflect the applicable processing purposes, consent requirements and statutory safeguards for each relevant context. The issue has become more important following the notification of the Digital Personal Data Protection Rules, 2025 (DPDP Rules) on 13 November 2025. The substantive provisions relating to notices, consent, processing of children’s data and several other obligations are scheduled to come into force 18 months after notification, i.e. on 13 May 2027.

What Does the DPDP Act Say About Privacy Notices?

Section 5 of the DPDP Act deals with the notice to be given by a Data Fiduciary when seeking consent from a Data Principal. The notice must inform the Data Principal of the personal data proposed to be processed and the purpose for which such personal data is proposed to be processed. The notice requirement is therefore closely connected to the requirement that consent be informed and specific.

Rule 3 of the DPDP Rules, 2025 provides greater detail on the form and content of such notices. It requires the notice to:

• be presented and understandable independently of other information made available by the Data Fiduciary;
• be in clear and plain language;
• provide an itemised description of the personal data proposed to be processed;
• specify the purpose or purposes of processing and describe the goods, services or uses enabled by such processing; and
• provide the relevant means for withdrawing consent, exercising rights under the DPDP Act and making a complaint to the Data Protection Board of India.

The Rules also require the relevant mechanisms for withdrawing consent to be as easy as the mechanism through which consent was given. Importantly, neither Section 5 nor Rule 3 creates a blanket requirement that a separate notice must be issued merely because Data Principals belong to different categories. The more relevant question is whether the notice, in the particular circumstances, enables the Data Principal to understand what personal data is being processed, why it is being processed and how the Data Principal can exercise the rights available under the law.

Does the DPDP Act Have Different Rules for Different Categories of Data Principals?

Yes. Although the basic notice framework applies broadly, the DPDP Act creates additional requirements for certain categories of Data Principals and processing activities.

1. Adults: Can One Notice Cover Multiple Categories of Adult Data Principals?

In principle, yes. An organisation may use a common privacy notice for multiple categories of adult Data Principals where the notice clearly and accurately describes the relevant processing activities. For example, an e-commerce platform may have one privacy notice covering customers and registered users if the notice clearly identifies:

• the categories of personal data collected;
• the purposes for which each category is processed;
• the services or uses enabled by the processing;
• how consent may be withdrawn;
• how Data Principals may exercise their rights; and
• how complaints may be made.

However, the fact that one document is permissible does not mean that organisations should combine every processing activity into a lengthy, generic privacy policy. Where substantially different products, services or processing purposes are involved, modular or purpose-specific notices may provide greater clarity and better support compliance.

The objective should therefore not be to determine how few notices an organisation can maintain, but whether each Data Principal receives sufficiently clear and specific information about the processing relevant to them.

2. Children: Why a Separate Parental Consent and Notice Journey May Be Appropriate

Children receive additional protection under Section 9 of the DPDP Act. Before processing the personal data of a child, a Data Fiduciary must obtain verifiable consent of the parent or lawful guardian in the prescribed manner. The Act also prohibits processing likely to cause a detrimental effect on the well-being of a child and prohibits tracking or behavioural monitoring of children and targeted advertising directed at children, subject to the statutory and regulatory exemptions.

Rule 10 of the DPDP Rules, 2025 sets out the requirements for obtaining verifiable parental consent. Among other things, the Data Fiduciary must take appropriate technical and organisational measures to obtain verifiable consent before processing the child’s personal data and must exercise due diligence to establish that the person identifying themselves as the parent is an identifiable adult. This does not necessarily mean that the law expressly mandates a document titled “Children’s Privacy Notice” separate from every other privacy notice.

The more important requirement is that the consent and verification process complies with the statutory framework and that the information provided to the parent or guardian is sufficient to support informed consent. In practice, however, organisations processing children’s personal data should strongly consider a dedicated parental notice and consent journey. Such a process can make it easier to:

• identify that the Data Principal is a child;
• direct the relevant information to the parent or lawful guardian;
• explain the categories and purposes of processing;
• implement the required parental verification process;
• document verifiable consent; and
• demonstrate compliance through appropriate records.

Organisations should also assess whether any statutory or Rules-based exemption applies to their processing. Rule 12 and the Fourth Schedule prescribe specific exemptions from certain obligations relating to children’s personal data for specified classes of Data Fiduciaries and specified purposes, subject to conditions.

3. Persons with Disability Who Have a Lawful Guardian

The DPDP Act also specifically addresses the personal data of a person with disability who has a lawful guardian. Section 9 requires a Data Fiduciary to obtain verifiable consent of the lawful guardian before processing such personal data in the manner prescribed.

Rule 11 of the DPDP Rules, 2025 deals specifically with this situation. It requires the Data Fiduciary, while obtaining verifiable consent from a person identifying themselves as the lawful guardian, to exercise due diligence to verify that the guardian has been appointed by a court, a designated authority or a local-level committee under the applicable guardianship law. This is an important distinction from the treatment of children’s data.

Accordingly, organisations should not simply assume that an ordinary adult consent flow can be reused where the Data Principal is a person with disability who has a lawful guardian. The organisation may need an appropriately designed guardian-facing consent and verification process, depending on the circumstances of the processing. Again, the legal requirement concerns the nature and verification of consent and the applicable safeguards, rather than a blanket statutory command that every organisation must maintain a physically separate privacy notice for this category.

4. Employees: Should Employers Have a Separate Employee Privacy Notice?

The DPDP framework does not prescribe a separate statutory notice merely because a person is an employee. However, employee data processing presents a materially different compliance context from customer or user data processing.

Section 7 of the DPDP Act identifies certain circumstances in which personal data may be processed for specified legitimate uses. These include circumstances connected with the provision of a service or benefit to the Data Principal by the State or certain entities, compliance with law and, subject to the statutory conditions, processing necessary for purposes connected with employment. Therefore, not all employee-data processing will necessarily be based on consent. This distinction is important when designing employee privacy documentation.

An employee privacy notice may need to address processing such as:

• employee identification and contact information;
• payroll and statutory records;
• attendance and access-control information;
• performance and employment-related records;
• information processed for workplace security; and
• other personal data processed in connection with the employment relationship.

The applicable legal basis, purpose, retention requirements and rights may differ from those applicable to a company’s customers or website users. For this reason, while the DPDP Act does not expressly mandate a standalone “employee privacy notice” in every case, maintaining dedicated employee-facing privacy documentation is generally a more effective compliance approach than attempting to incorporate employment processing into a consumer-facing privacy notice.

5. Can One Organisation Have Multiple Privacy Notices?

Yes. The DPDP Act does not require an organisation to maintain one universal privacy notice. A business may use:

• a general privacy notice for website visitors and customers;
• an employee privacy notice;
• a dedicated parental notice and consent flow for children’s data;
• a guardian-facing consent process for persons with disability who have lawful guardians; and
• product- or service-specific notices where the processing activities materially differ.

The important consideration is not the number of notices but whether the information provided to the relevant Data Principal is clear, specific, accurate and sufficiently connected to the processing for which consent is being sought. A modular notice architecture can therefore be particularly useful for organisations with complex data-processing operations.

Notice Requirements Under the DPDP Act: A Practical Comparison

What About Personal Data Collected Before the DPDP Act Becomes Fully Applicable?

The DPDP framework also addresses personal data for which consent was obtained before the relevant provisions of the Act come into force. Under Section 5(2), where personal data was collected before the commencement of the Act on the basis of consent, the Data Fiduciary is required to provide the Data Principal with the prescribed information as soon as reasonably practicable after the relevant provisions come into force.

This makes legacy-data remediation an important part of DPDP compliance planning. Organisations should identify existing consent-based databases and assess whether the notices and consent mechanisms used at the time of collection provide the information required under the DPDP framework. Where they do not, organisations should plan an appropriate notice-refresh mechanism, including through effective digital communication channels where appropriate.

When Will the DPDP Notice Requirements Apply?

The DPDP Act and DPDP Rules do not become fully operational on a single date. The Government’s commencement notification provides for a phased implementation. The core provisions of the DPDP Act, including Sections 3 to 5, Sections 6(1) to 6(8) and 6(10), Sections 7 to 17 and several other provisions, are scheduled to come into force 18 months after 13 November 2025 i.e. on 13 May 2027.

Similarly, Rule 3 and Rules 5 to 16, among other provisions, are scheduled to come into force 18 months after publication of the Rules. Rule 4, concerning Consent Managers, is scheduled to come into force one year after publication, i.e. 13 November 2026. This phased commencement gives organisations a defined period to review and redesign their privacy notices, consent mechanisms and internal data-governance processes before the substantive requirements become applicable.

What Should Organisations Do Now?

Organisations preparing for DPDP compliance should consider the following steps:

1. Map Data Principals and Processing Activities: Identify the different categories of Data Principals whose personal data is processed, including customers, users, employees, children and persons represented by lawful guardians.

2. Map Personal Data to Specific Purposes: For each processing activity, identify the categories of personal data collected and the precise purpose for which the data is processed.

3. Identify the Applicable Legal Basis: Determine whether processing is based on consent or falls within a legitimate use or another applicable provision of the DPDP Act.

4. Review Existing Privacy Notices: Assess whether existing notices identify personal data and processing purposes with the level of specificity contemplated by Section 5 and Rule 3.

5. Design Special Consent Journeys Where Required: For children’s data and the personal data of persons with disability who have lawful guardians, organisations should develop appropriate verification and consent mechanisms that satisfy Rules 10 and 11.

6. Separate Employee Documentation Where Appropriate: Employee processing should be assessed independently from customer and consumer processing. A dedicated employee privacy notice can help communicate employment-related processing more clearly.

7. Prepare for Legacy Data: Identify personal data collected under earlier consent mechanisms and establish a process for providing the required notices once the relevant DPDP provisions become applicable.

8. Build a Modular Notice Framework: Rather than relying on a single, lengthy privacy policy, organisations with multiple products, services or processing contexts should consider modular notices that allow the relevant information to be presented to the appropriate Data Principal.

Frequently Asked Questions

1. Does the DPDP Act require a separate privacy notice for every category of Data Principal?

No. The DPDP Act does not impose a blanket requirement for a separate notice for every category of Data Principal. However, different categories may trigger different consent, verification or processing requirements. Organisations should therefore use separate or adapted notices where necessary to accurately communicate the relevant processing and comply with those additional requirements.

2. Is a separate privacy notice legally mandatory for children’s data?

The DPDP Act requires verifiable parental consent before processing a child’s personal data, subject to specified exemptions. The Rules prescribe the mechanism for obtaining such consent. While the law does not simply state that every organisation must publish a document separately titled a “children’s privacy notice”, a dedicated parental notice and consent journey is generally the more appropriate compliance approach.

3. Can one privacy policy cover customers and employees?

In principle, a single policy can address multiple categories of Data Principals if it accurately and clearly describes the relevant processing. However, employee processing can involve different purposes and legal bases from customer processing. A dedicated employee privacy notice is therefore generally preferable.

4. Does the DPDP Act recognise sensitive personal data as a separate category?

No. Unlike certain earlier Indian data-protection frameworks, the DPDP Act does not establish a separate statutory category of “sensitive personal data”. Instead, the Act imposes additional obligations in particular contexts, including processing of children’s personal data and obligations applicable to Significant Data Fiduciaries.

5. When will the DPDP notice requirements become applicable?

The core provisions governing notices and consent are scheduled to become applicable on 13 May 2027, 18 months after publication of the commencement notification dated 13 November 2025. Organisations should nevertheless begin reviewing their privacy notices and consent architecture well before that date.

6. What are the penalties for non-compliance under the DPDP Act?

The Schedule to the DPDP Act provides for significant financial penalties. These include penalties of up to ₹50 crore for certain general breaches, up to ₹200 crore for breaches relating to children’s data, and up to ₹250 crore for failure to take reasonable security safeguards to prevent personal data breaches. The applicable penalty depends on the nature of the breach.

Conclusion

The DPDP Act does not adopt a simple rule that every category of Data Principal must receive a separate privacy notice. Instead, the framework requires organisations to ensure that Data Principals receive appropriate and sufficiently specific information about the processing of their personal data, while imposing additional requirements in certain contexts. These requirements are particularly significant for children and persons with disability who have lawful guardians, where the Act and Rules prescribe specific mechanisms for verifiable consent.

For businesses, the practical answer is therefore not necessarily to create a separate notice for every category of Data Principal. Rather, organisations should develop a risk-based and context-specific notice architecture that combines a clear core privacy notice with separate or modular notices and consent journeys wherever the nature of the processing makes them necessary.

With the core notice and consent provisions scheduled to apply from 13 May 2027, organisations should use the transition period to map their Data Principals, processing purposes and legal bases, identify gaps in existing privacy notices, and implement appropriate consent and verification mechanisms. A well-designed DPDP notice framework can help organisations move beyond a generic privacy policy towards a more transparent, purpose-specific and defensible approach to personal data governance.