Consent Notice Under DPDP

What the Act and Rules say

Section 5 requires that every request for consent under Section 6 be accompanied or preceded by a notice from the Data Fiduciary. The notice must inform the Data Principal of the personal data proposed to be processed and the purpose; the manner in which rights under the Act may be exercised; and the manner in which a complaint may be made to the Data Protection Board.

Where personal data was collected before the Act’s relevant provisions commence, Section 5 also addresses giving notice as soon as reasonably practicable, covering the personal data and purpose and related rights information — unless the Data Principal has already consented and continues to process is consistent with that earlier consent, subject to the Act’s terms. Organizations with legacy datasets should plan how and when such notices are delivered.

Rule 3 of the Digital Personal Data Protection Rules, 2025 elaborates presentation and content expectations for that notice once the Rule’s commencement date applies. In substance, the Rules expect the notice to be clear, standalone in presentation relative to other information where required, and available in English or any language specified in the Eighth Schedule to the Constitution, with an option for the Data Principal to access it in the language of their preference among those covered. The notice should enable an informed consent decision — including understanding what data and purpose are involved, and how to withdraw consent or exercise other rights.

Notice under Section 5 is distinct from a general privacy policy published for brand or website hygiene. A privacy policy may help, but it does not automatically satisfy the notice that must accompany or precede a consent request. See alsoConsent under DPDPfor how notice sits in the wider consent lifecycle.

What it means in practice

Practically, notice design is a product, legal and operations problem together. Legal teams define what must be said for each purpose; product and channel owners decide where the notice appears (web, app, branch, call centre, paper); and compliance needs version control so that later audits can show which notice the Data Principal saw when they consented.

Map purposes first. Each consent request should map to a specified purpose and the personal data categories needed for that purpose. Generic “we may use your data for business purposes” language rarely supports specific, informed consent. Where multiple purposes exist, present them so the Data Principal can understand and choose — not only accept a bundled package.

Make rights and complaint information findable from the same flow. Section 5 expects Data Principals to know how to exercise rights and how to complain to the Board. Hiding that information in a distant footer while pressing for consent undermines the notice’s role.

Plan language and accessibility. Rule 3’s language expectations matter for Indian audiences. Notices that only exist in one language, or that are buried inside long contractual text, create both compliance and customer-trust risk. Keep a controlled library of notice versions tied to consent records.

Common mistakes

• Treating a website privacy policy as automatically satisfying Section 5 notice for every consent request.
• Presenting consent before the Data Principal can reasonably understand data and purpose.
• Omitting rights or Board complaint pathways from the notice experience.
• Failing to version notices, so consent records cannot show what was communicated at the time of decision.