A privacy policy and a consent request serve different purposes

Three documents can sit on the same checkout page and still do different jobs. A privacy policy explains an organisation’s broader practices. A collection notice explains the proposed processing at a relevant point. A consent request asks the person to make a particular choice. Treating them as interchangeable makes both the interface and the evidence harder to defend.

As of 22 October 2026, the DPDP notice and most consent provisions are scheduled for May 2027. The distinction below supports preparation under sections 5 and 6 and rule 3, read with the commencement notification.

The policy explains the organisation

A privacy policy may describe categories of information, general practices, contact routes and other matters relevant to the organisation. It can provide useful context across several services. Existing law may also require a published privacy policy, depending on the business and processing; rule 4 of the SPDI Rules is one relevant current provision.

However, a policy is not automatically evidence that a customer agreed to a specific optional use. Publishing a document proves that the document exists. It does not, on its own, show the customer received an adequate notice before a consent request or made a clear affirmative choice.

Keep the policy connected to reality. If it says customers can contact a privacy team, there must be a functioning route behind that description. If it describes data sharing, the organisation should be able to explain the actual recipients and purposes supporting the statement.

The notice explains this processing

The DPDP notice accompanies or precedes a consent request. It identifies personal data and purpose and explains relevant action routes. Rule 3 adds requirements for independent understandability, itemised description, specified purposes and usable links.

For a hypothetical online course provider, the notice at enrolment might explain the information used to create an account and deliver the course. A later research project using identifiable learning records may require a separate assessment and customer conversation. A broad policy phrase about “innovation” should not be treated as an answer to every new purpose.

The notice can link to supporting material, but essential meaning should not depend on the customer guessing which paragraph in a long document applies to the choice before them.

The request captures a decision

Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, with clear affirmative action. The choice must relate to the specified purpose and necessary personal data. A request should therefore make the decision clear: what is the person agreeing to, and what happens if they do not agree?

An optional alumni marketing choice should not be concealed in an enrolment button if the provider intends to rely on consent for that activity. A single event labelled “accepted terms” may be inadequate evidence of the separate choice. The provider needs to know what was presented and which action the person took.

Not every processing activity necessarily relies on consent. The Act includes certain legitimate uses in section 7. The organisation should assess the ground first, instead of adding consent language everywhere and later discovering that its operational decisions do not match it.

Test the three layers together

For the course provider, a reviewer can ask a learner to complete enrolment and then explain whether future promotional messages were optional. Next, ask the operations team to produce the associated notice version and permission event. The customer understanding and the system record should tell the same story.

A failure might appear in either direction. The screen offers a separate choice but the database stores only a general account flag. Or the database has a marketing flag, but the interface never clearly explained the use. Fixing only the policy would leave both problems unresolved.

Keep changes coordinated

Give the policy, notice and consent interface named owners, with a shared change trigger. A new form field, partner arrangement or marketing use should prompt a review of all relevant layers. Legal text and product implementation should not drift apart between annual reviews.

Maintain a small release record showing the approved wording, screen location, purpose, effective date and evidence format. This is a practical recommendation, not a prescribed DPDP document pack. It helps the business answer a future question about what a person was told and what they chose.

The useful distinction is operational: the policy gives context, the notice makes the proposed processing understandable, and the request captures the relevant decision. Customers and staff should be able to follow that sequence without treating a general terms checkbox as an unlimited permission slip.