How to draft a DPDP privacy notice from your real data map

A downloaded template lists data you never collect and misses data you do. It says “we may collect device information” while your enrolment form quietly asks for a date of birth, a mobile number and a photograph of an ID card. That mismatch is the problem.

Your notice should describe your own enrolment form, checkout page and paper enquiry card. Open each one and read the fields aloud.

That list is the raw material. The rest is wording. Reading the real form also catches the referral field somebody added two years ago and forgot.

Build a table from the data map with one row per field: name, mobile number, email, delivery address, order history, photo, bank account for refunds. Beside each, write the single reason you ask for it.

Be honest about reasons. “To send the invoice” is a purpose, while “to improve our services” is vague and stretches over everything. If a field has no clear purpose, drop it from the form.

Group fields that share a purpose. A delivery address and a phone number both serve the courier, so the notice can say so once and keep the page short.

Tell the person exactly how to withdraw consent. Give an address or a settings page, not a vague promise. If every marketing email carries an unsubscribe link, say so, and if withdrawal needs a message to a named inbox, print that inbox.

Add how to ask for a copy of their data, a correction or an erasure, and say who reads those requests and what the person will see in reply. Keep the steps few.

Test the route before you publish. Send yourself an erasure request. Watch whether it reaches a human being within a working day.

Name a contact for complaints. A job title and a monitored email address are enough for a small firm. Add a line on what happens once a complaint arrives and roughly when the person will hear back.

The notice should also tell people they can complain to the Data Protection Board of India if your reply does not settle the matter. Confirm the current wording with your lawyer, since procedure details can shift as rules are issued.

Write for a reader standing at a checkout counter with a phone in one hand. Short lines. No legal Latin. No clause numbers.

Show the notice where the data is collected: beside the web form, on the app sign-up screen, at the bottom of the paper enquiry card. A bare link is weaker than a short summary that carries a link to the full text.

Give every version a number and a date. When someone consents, store that version number with their record, so that if the notice changes next year you can still show what each person saw on the day.

Send the draft to your lawyer with the data map attached. They can check it against the Act far faster with the facts in front of them. Then publish, and diarise a review each time you add a field.