Writing a DPDP Consent Notice (With Examples in Plain English)

A valid DPDP consent notice tells a person, in plain language, exactly what data you are collecting, why, and how they can say no or withdraw later - and it must stand on its own, not be buried in a terms-and-conditions page.

Key facts at a glance

• Consent must be clear, affirmative and specific - pre-ticked boxes or silence do not qualify.
• A notice must be presented separately and prominently, not bundled into general T&Cs.
• Withdrawal of consent must be as easy as giving it.
• Full DPDP notice and consent obligations become enforceable on 13 May 2027.
• Consent should cover one specific purpose at a time - broad, catch-all consent is not compliant in spirit.
• Notices should be understandable, which in practice favours plain language over legal jargon.
• Penalties for non-compliance with security and consent obligations can reach up to Rs 250 crore per instance.

The Core Elements of a Valid Notice

A DPDP-compliant consent notice needs to answer four questions clearly:

1. What data is being collected (e.g. name, phone number, location, payment details).
2. Why it is being collected (the specific purpose - not a vague "to improve services").
3. How the person can access, correct, or withdraw consent for their data.
4. Who to contact with questions or complaints (typically your Data Protection Officer or a designated contact).

Example: Weak Notice (Avoid This)

"By using this app you agree to our Privacy Policy and Terms of Service, which may be updated from time to time. We may collect and use your information for business purposes."

This fails on almost every count: it is vague about what data and why, it is bundled with general terms, and "business purposes" is not a specific purpose.

Example: Compliant-Style Notice

"We collect your name, phone number and delivery address to process and deliver your order. We do not use this information for anything else without asking you again. You can view, correct or delete this information anytime from Account Settings, or by contacting privacy@yourcompany.in."

This version names the specific data, states one specific purpose, and tells the person exactly how to exercise their rights.

Consent Notice Checklist

Consent for Multiple Purposes

If you collect data for more than one purpose - say, order processing and marketing emails - DPDP practice favours separating these into distinct consent asks rather than one combined checkbox. A person should be able to agree to order processing while declining marketing emails.

This matters operationally too: if someone withdraws consent for marketing but not for order fulfilment, your systems need to be able to act on that distinction rather than treating consent as one on/off switch.

Consent Managers

The DPDP Rules 2025 introduce a Consent Manager framework (Rule 4), which becomes operational on 13 November 2026. Consent Managers are intended to act as a registered intermediary through which individuals can view and manage consents given across different data fiduciaries. Businesses do not need to build this themselves, but should be aware that consent records may eventually need to interoperate with this framework.

Common Mistakes to Avoid

• Treating a privacy policy and a consent notice as the same document - they serve different purposes.
• Asking for consent to "all future uses" of data instead of the specific purpose at hand.
• Making withdrawal harder than giving consent (e.g. requiring a phone call to opt out but a single click to opt in).
• Failing to update the notice when a new data use is introduced.
• Assuming consent obtained before DPDP enforcement automatically satisfies the Act's requirements going forward.

Getting your consent notices right now, well before the 13 May 2027 enforcement date, avoids a scramble later and reduces the chance of a data-principal complaint reaching the Data Protection Board.

If you are not sure whether your current notices and consent flows would hold up, ComplianceCheck's DPDP assessment gives you a clear picture in a few minutes.

Sources

• Ministry of Electronics and Information Technology, DPDP Act and Rules - meity.gov.in
• Data Protection Board of India

This guide is general information, not legal advice. Requirements vary by state, sector and headcount - confirm specifics with a compliance professional or the relevant authority.