DPDP Consent Notice for Visitors: What to Tell People at the Gate

Published on 10/18/2026 • Updated on 10/22/2026

A visitor gives his name and phone number at the gate and signs the register. Nobody told him why you need the number, how long you keep it, or whom to ask if he wants it removed. Under the Digital Personal Data Protection Act, 2023, that missing explanation is the gap a notice is meant to fill.

This guide explains what the notice must contain under Rule 3 of the DPDP Rules, 2025, when consent is the right basis and when it is not, and how to show the notice at a gate, on a kiosk and on a QR screen. It includes sample wording you can adapt. It is general information, not legal advice. Confirm the final text with your legal adviser.

Notice and consent: the basic idea

The Act lets a Data Fiduciary process personal data with the consent of the person, or for certain legitimate uses listed in the Act. Where you rely on consent, the request must come with a notice. The Press Information Bureau release of 17 November 2025 describes the Rules as requiring clear, itemised notices in plain language.

Rule 3 sets what the notice contains. Rule 3 and the other duties it supports come into force after eighteen months from publication, which means around mid-May 2027. Check the exact date with your legal adviser. Building the notice now is cheap, and it gives you time to test it.

What the notice must contain

Under Rule 3 of the DPDP Rules, 2025, the notice should be given in clear and plain language, understandable independently of any other document, and should include an itemised description of the personal data, the specific purpose and the goods or services or uses enabled by the processing. It should also give a communication link or means to withdraw consent, to exercise the person's rights and to complain to the Board.

Sample notice wording

Adapt this text to your site. It is an example, not a legal template.

The retention period above is an assumption for the example. Choose yours with your legal adviser, because other laws or contracts may require a longer period for some records.

Where and how to show it

• At a manned gate: a printed board at eye level, in English and the local language.
• On a kiosk: a screen shown before the first field, with a clear Accept button.
• On a QR check-in page: a short notice above the form with a link to the full text.
• For a pre-registered visitor: include the notice in the invitation message.

The notice should be easy to see before the data is entered, not after. A notice hidden in a footer link does not meet the intent of the Rules.

When consent is the right basis

Consent suits data that is not needed to let the person in, such as a photo used for marketing or a newsletter sign-up at reception. For core entry records, such as name and phone number to let a host know of an arrival, your legal adviser may consider other bases the Act allows. The point is to decide deliberately and write it down.

Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, according to the Act. A pre-ticked box or a notice that says that entry means consent is risky.

Visitors who are children

If a child can be a visitor, for instance at a school or hospital, Rule 10 requires verifiable consent from a parent or lawful guardian before processing a child's data, with exemptions in the Rules. Plan a simple way for the parent to confirm. Our guide to DPDP in schools covers this in more detail.

Handling requests and withdrawals

A notice promises a route for contact, so the route has to work. Decide who receives the email, who answers, and how fast. Rule 14 expects a grievance response within ninety days at most. Aim for a few working days, since visitor data is small and easy to find when it is stored digitally.

Train the security desk to pass such requests on, not to answer from memory. A guard who says that nothing can be done is the fastest way to turn a small request into a complaint.

Keep the log of requests with the visitor records policy, and review it each quarter with your adviser. It shows that the route is used and answered, which matters more than the wording on the board.

A worked example at a factory gate

Note the evidence line. Keeping the notice version and the time of acceptance helps you show what the person saw.

Common mistakes

A fourth mistake is collecting more than you need. If you do not use a visitor's home address, do not ask for it. Fewer fields mean a shorter notice and less to protect.

A fifth is forgetting contractors and delivery staff, who pass through the same gate and fall under the same duties.

A two-week rollout

Get the notice in place well before the commencement date.

Review the notice every six months or whenever you change a field. Also review it after any incident, because an incident often shows what visitors were not told.

Five-minute self-check

Check your current gate against these points.

Two or more no answers mean this is worth fixing before anything else on your list.

Reader Q&A

Bottom line

A good visitor notice is short, plain and shown before the data is typed. It names the data, the reason, the retention period and a contact for questions.

Write it once, test it with a guard and a visitor, keep a record of versions, and review it when the process changes.

Author of the Blog Post

Aadeshwar Modi

Technical Content Writer at VisitorFlow

Aadeshwar Modi is a marketing technical content writer who loves writing on technology and AI topics.