DPDP Act Consent Notice: What Every Indian Business Must Publish

The Digital Personal Data Protection Act, 2023 changed the compliance baseline for every organisation in India that handles personal data. It applies to companies incorporated in India, to foreign companies processing data of persons in India, and to any entity offering goods or services to individuals in India. The first obligation most businesses encounter is the consent notice — the short, plain-language document that must be shown to a person before their data is collected. It is also the obligation most businesses get wrong, because they treat it as a privacy policy.

Consent notice is not a privacy policy

A privacy policy is a general statement about how an organisation handles data. A consent notice is a specific, itemised request presented at the point of collection, tied to a particular purpose. Under Section 5 of the Act, the data fiduciary must give the data principal a notice before or at the time of seeking consent. The notice must be independent, clear and in plain language, and it must contain the specified items. A link to a long privacy policy does not satisfy Section 5 on its own.

The practical difference matters. A privacy policy can say "we may share data with partners for marketing purposes". A consent notice must say, in the language the person understands, exactly what data is being collected, for what purpose, and what happens if they refuse.

The mandatory contents under Section 5

The Act requires the notice to state four things.

First, the personal data proposed to be processed and the purpose. The notice must describe the categories of data and the specific purpose for which each is collected. "Improving user experience" is not a purpose; "sending order status updates by SMS" is.

Second, the manner in which the data principal may exercise their rights. The Act gives data principals the right to access, correction, erasure, grievance redressal and nomination. The notice must explain how to exercise these rights and whom to contact.

Third, the manner of making a complaint to the Data Protection Board of India. This is a separate route from internal grievance redressal, and the notice must say so.

Fourth, whether consent is voluntary or necessary. Where the service cannot be provided without the data, the notice must say that clearly. Where consent is sought for an optional purpose, it must be presented separately and must not be bundled with the core service.

Plain language and the language requirement

Section 5 requires the notice to be available in English or in any language listed in the Eighth Schedule to the Constitution, at the option of the data principal. In practice, this means a business serving customers in Hindi, Tamil, Bengali or Marathi should be prepared to offer the notice in those languages, or at minimum offer a clear English version and a translation on request. The notice must be understandable to an ordinary reader, not written for lawyers.

Consent must be free, specific, informed and unambiguous

Section 6 sets the standard for valid consent. It must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. Four consequences follow:

• Pre-ticked boxes are not consent. Silence or inaction is not consent.
• Bundled consent for multiple unrelated purposes is not valid. Each purpose needs its own request.
• Consent must be as easy to withdraw as it was to give. Section 6(4) requires withdrawal to be available through the same channel.
• The burden of proving consent lies on the data fiduciary, not on the individual.

Consent managers and the withdrawal mechanism

The Act contemplates consent managers — registered entities through which a data principal can give, manage, review and withdraw consent. The implementing rules are still being notified, but businesses should design their systems so that consent records are granular, timestamped and easy to revoke. A single blanket consent for all processing will be difficult to defend when the Board asks for proof.

Legitimate uses: when you do not need consent

Section 7 lists the purposes for which consent is not required, including certain employment-related processing, medical emergencies, disaster response, and processing required by law or by a court order. These are narrow. "We need it for our business" is not a legitimate use. A business relying on Section 7 must still give notice in some cases, and must limit processing to what is necessary for that purpose.

Children's data

Section 9 requires verifiable parental consent before processing the personal data of a child below 18 years, and prohibits tracking, behavioural monitoring and targeted advertising directed at children. Any business with users under 18 — gaming, edtech, social media, retail loyalty programmes — needs an age-verification and parental-consent workflow, not just a checkbox.

Significant data fiduciaries

The Central Government may notify certain entities as significant data fiduciaries based on the volume and sensitivity of data processed, the risk to data principals, and other factors. Notified entities face additional obligations: appointing a Data Protection Officer based in India, appointing an independent auditor, conducting data protection impact assessments, and undertaking periodic audits. If your business operates at scale in health, finance or education, plan for this classification.

Penalties

The Act provides for financial penalties that can reach substantial amounts for failures in security safeguards, breach notification, and children's data obligations. The precise amounts are set out in the Schedule to the Act, and the Board has discretion based on factors including the nature and duration of the breach. Even where the penalty is modest, the reputational and operational cost of a Board inquiry is significant.

Drafting the consent notice: a checklist

• Identify each purpose separately and state the data collected for it.
• State clearly whether each consent is necessary or voluntary.
• Provide a plain-language explanation of the rights of access, correction, erasure, grievance redressal and nomination.
• Give the contact details of the grievance officer.
• State the route to complain to the Data Protection Board of India.
• Explain how to withdraw consent and what happens on withdrawal.
• Offer the notice in English and in a scheduled Indian language where the user base requires it.
• Keep a record of the version shown, the date and the affirmative action taken.
• Separate children's consent with a verifiable parental mechanism.
• Align the privacy policy to the consent notice so the two do not contradict each other.

Frequently asked questions

Does the DPDP Act apply to small businesses?

Yes. The Act applies to processing of digital personal data regardless of the size of the entity. Certain obligations are graded, and start-ups may receive some flexibility under the rules, but a basic consent notice and grievance mechanism apply to all data fiduciaries.

Can consent be obtained through a website banner?

Yes, provided the banner presents the notice in clear language, offers granular choices for separate purposes, records the affirmative action, and makes withdrawal as easy as giving consent. A single "I agree" button covering all purposes is unlikely to be sufficient.

What is the difference between a data fiduciary and a data processor?

A data fiduciary decides the purpose and means of processing. A processor processes data on behalf of the fiduciary. The fiduciary bears the compliance obligation and must have a written contract with the processor.

What happens if consent is withdrawn?

The fiduciary must stop processing for that purpose unless another lawful basis applies. The notice should state the consequence of withdrawal, including whether the service will be discontinued.

Applying the same standard to employees and vendors

Consent notices are usually written for customers and then forgotten for everyone else. The Act does not make that distinction. An employment application form, an onboarding pack, a vendor registration portal and a recruitment portal all collect personal data and all need a notice that meets Section 5.

For employees, the notice should be issued at or before the point of collection — typically with the offer letter or the onboarding form — and should cover recruitment data, payroll and statutory deductions, attendance and biometric data, health records, performance data, and CCTV footage in the workplace. Where an employer relies on Section 7 for employment-related processing, the notice should still explain the categories of data and the purposes, because the transparency obligation is not switched off by the absence of a consent requirement. Biometric attendance is a particular risk area: it involves sensitive data, it is often collected without an adequate notice, and it is commonly outsourced to a vendor who becomes a data processor.

For vendors and service providers, the data processing agreement is the operative document. It should identify the categories of personal data shared, the purpose, the security measures the processor must maintain, the breach notification timeline, the restrictions on onward transfer and the return or deletion of data on termination. The fiduciary remains liable for the processor's failures, so the contract needs teeth: audit rights, indemnity and a termination right on material breach.

Retention and erasure

The Act permits retention of personal data only for as long as necessary for the purpose for which it was collected, subject to legal retention requirements. In practice, this means a retention schedule: how long recruitment records, payroll records, customer transaction data, marketing consent records and CCTV footage are kept, and what happens at the end of each period. Statutory requirements override the general rule — tax and labour law prescribe minimum retention periods for payroll and financial records — so the schedule should be built around those minimums rather than an arbitrary "delete after two years" policy.

Erasure requests must be honoured unless a legal obligation requires retention. A business that cannot delete a record because it never mapped where the data sits has a problem that no consent notice can fix. The notice should therefore be drafted only after the data map exists, so that what it promises is actually achievable.

Compliance drafting support

If you need a DPDP Act consent notice, privacy policy or data processing agreement drafted, our drafting team prepares plain-language, purpose-specific documents aligned to Sections 5, 6 and 7 of the Act, ready to publish on your website or app.