When you choose Create request, we compose the notice from five things. They are your firm's name, the Purpose you wrote, the items you ask for, the retention rule and your grievance contact. The rest of the text is fixed and you cannot edit it. A request cannot be created while the grievance contact is missing, because a notice without one is incomplete. The notice you publish is written in English. Your client can read it in another language instead.
Your client sees the notice in two forms. Before they agree, the upload page shows a short summary with the rows Collecting, Purpose, Retention, Your rights, Grievance and Complaints. A Read the full notice button opens the whole text. After they finish, the full notice appears again on their receipt. In both places it is the stored version, word for word.
The law sets what a notice must contain (DPDP Act, section 5). Our guide explains what a notice must contain. The full notice has eight sections, in this order:
| Section | What it says |
|---|
| What we are collecting | The items you listed, as you named them. |
| Why we are collecting it | Your purpose, word for word, then a fixed sentence saying the data is used only for that purpose. |
| How long we will keep it | Your retention rule, as described below. |
| Your rights | Five fixed lines: a summary of the data held, correction, erasure, withdrawing consent and nominating someone to act for them. A last line tells them to use the rights link on their receipt or to write to your grievance contact. |
| Grievance contact | The name and email of your grievance contact. |
| Complaints | The right to complain to the Data Protection Board of India if the grievance is not resolved. |
| Your consent | That by ticking the box and submitting, your client gives free, specific, informed, unconditional and unambiguous consent for the stated purpose only. |
| Role of Confidential Dispatch | That we process what your client submits on your behalf and use it for no purpose of our own. It also says that you decide how the data is used and are responsible for it under the law. |
The retention section states the first period in days, so 1 year appears as 365 days. A law's period appears in years when it is a whole number of years and in days otherwise. When you choose As long as they're a client, the section says the data is kept while the person remains your client and deleted when that relationship ends. When you name a law, the section adds the law and its period, and the rights section gains a line, just before its last, about records the law requires you to keep.
Two other kinds of request use the same sections with a few sentences swapped. A request that records consent only says you hold the documents in your own systems and are responsible for deleting them. A consent renewal says nothing new is collected and states the new date.
Every notice is stored as a numbered version with its SHA-256 fingerprint. A stored version is never edited. If you create another request with exactly the same purpose text and the composed notice differs, it is stored as the next version of that purpose. If it is identical, the existing version is used. Every consent records the exact version it was given to, so a later version never changes what an earlier client agreed to. Each new version is recorded as "Notice version published" in your audit trail. Choose View published notice on a request to read what your clients read.
For example
Amaltas Deshmukh & Co sends Anita Deshpande a request on 1 July 2027. The first period is 1 year and the request names a law with a period of 5 years. Her notice says the data is kept for up to 365 days after the purpose is served. It then says Amaltas Deshmukh & Co is required by law, with the law's name in brackets, to keep it for a further 5 years before it is deleted. The summary row on her upload page reads "Up to 365 days after the purpose is served, then a further 5 years as the law requires".