India, Oct. 11 -- Under the Digital Personal Data Protection Act, 2023 (DPDPA), a privacy notice must do more than meet statutory disclosure requirements. It must communicate clearly enough for a data principal to understand how their personal data will be used and make a genuinely informed decision about consent.

Yet a peculiar irony lies in how most organisations approach privacy notices. Enormous effort goes into making the notice legally compliant: ticking every statutory box, referencing every required provision, and surviving regulatory scrutiny. Far less effort goes into asking the more fundamental question: will the person reading this actually understand it?

Under the DPDPA, a privacy notice is not a procedural formality. It is...