Notice of Collection

Under the DPDP Act, a Notice of Collection refers to the communication provided by a Data Fiduciary to a Data Principal before or at the time of collecting personal data. The notice helps individuals understand what personal data is being collected, why it is being collected, how it will be processed, and other relevant details required under the Act.

The DPDP Act requires Data Fiduciaries to provide clear and specific information to Data Principals through a notice before seeking consent for processing personal data. A well-designed notice enables individuals to make informed decisions about sharing their personal data and supports transparency in data processing activities.

The notice typically includes details such as the categories of personal data being collected, the purpose of processing, the manner in which Data Principals can exercise their rights, and relevant contact information for privacy-related communication.

In practice, gaps emerge when:

• Notices use complex language that Data Principals cannot easily understand.
• Organizations collect additional personal data without updating notices.
• Processing purposes are unclear or too broad.
• Notices are not aligned across different collection points.
• Organizations cannot track changes to privacy notices over time.

Organizations address these challenges by maintaining clear privacy notices, linking notices with consent workflows, reviewing processing purposes, and ensuring consistency across digital touchpoints. Within Privy, capabilities such as consent management, notice management, preference tracking, and compliance workflows help organizations create transparent Data Principal interactions.