Every request for consent under the DPDP Act has to come with, or after, a notice. Rule 3 of the DPDP Rules, 2025 sets out what it must say. It applies from 13 May 2027, and it is the first thing a Data Fiduciary will be asked to produce in a dispute about consent.
Last reviewed · Sources: G.S.R. 843(E), G.S.R. 846(E), Lok Sabha Q.3960 (12 Aug 2026)
Under section 5 of the Act and Rule 3, the notice must stand on its own and, in clear and plain language, give an itemised description of the personal data, the specified purpose and the goods, services or uses it enables, and a link and means to withdraw consent, exercise rights and complain to the Board.
| Element | What it means in practice | Source |
|---|---|---|
| Stands on its own | Readable without the privacy policy, terms or any other document | Rule 3(a) |
| Itemised personal data | Each data item listed, not 'personal information such as…' | Rule 3(b)(i) · Sec 5(1)(i) |
| Specified purpose | Each purpose, and the goods, services or uses it enables | Rule 3(b)(ii) · Sec 5(1)(i) |
| How to withdraw | A link, and withdrawal as easy as consenting | Rule 3(c)(i) · Sec 6(4) |
| How to exercise rights | A link or other means to make a rights request | Rule 3(c)(ii) · Sec 5(1)(ii) |
| How to complain to the Board | The route to the Data Protection Board | Rule 3(c)(iii) · Sec 5(1)(iii) |
| Language choice | English or any Eighth Schedule language, at the Data Principal's option | Sec 5(3), 6(3) |
| Contact for questions | Your DPO, or a person authorised to respond | Sec 6(3) · Rule 9 |
The notice must be in clear and plain language and give a fair account of what the Data Principal needs to give specific and informed consent (Rule 3(b)). The elements above are the minimum, not the whole.
The Data Principal must have the option to read the notice in English or in any of the 22 languages in the Eighth Schedule to the Constitution (sections 5(3) and 6(3)). The Act does not require you to show all 23 at once, but each must be available when a Data Principal chooses it.
A machine translation nobody has checked is a weak footing for informed consent. Have each language reviewed, version it with the English text, and record which language each Data Principal saw.
A starting structure that covers every element of Rule 3. Replace the bracketed text, keep one row per purpose, and have it reviewed before use.
[Company name] — how we will use your personal data We are asking for your consent to use the personal data listed below for the purposes stated next to it. You can say yes to some purposes and no to others. Purpose 1: [e.g. Delivering your order] Personal data: [name, delivery address, mobile number] What this enables: [delivery of goods you purchase] Purpose 2: [e.g. Sending offers by WhatsApp] Personal data: [mobile number, purchase history] What this enables: [personalised offers] Withdraw consent: [link] — as easy as it was to give. Your rights (access, correction, erasure, nomination, grievance): [link] Questions: [DPO or contact name, email] Complain to the Data Protection Board of India: [link] Read this notice in: [English | हिन्दी | தமிழ் | …] Notice version [v1.2], [date]
Yes. Section 5(2) requires a Data Fiduciary to notify Data Principals who consented before commencement, as soon as reasonably practicable, with the same three elements. It may keep processing on that consent until the Data Principal withdraws it.
The Act's own illustration has an e-commerce provider sending the notice by email, in-app notification or another effective method. Keep a record of the dispatch, since it is part of the same evidence trail.
Under section 5 of the Act and Rule 3, the notice must stand on its own and, in clear and plain language, give an itemised description of the personal data, the specified purpose and the goods, services or uses it enables, and a link and means to withdraw consent, exercise rights and complain to the Board.
The Data Principal must have the option to read the notice in English or in any of the 22 languages in the Eighth Schedule to the Constitution (sections 5(3) and 6(3)). The Act does not require you to show all 23 at once, but each must be available when a Data Principal chooses it.
Yes. Section 5(2) requires a Data Fiduciary to notify Data Principals who consented before commencement, as soon as reasonably practicable, with the same three elements. It may keep processing on that consent until the Data Principal withdraws it.
This guide summarises the DPDP Act, 2023 and the DPDP Rules, 2025; the Gazette texts govern. This is informational and is not legal advice. Liability under the DPDP Act, 2023 remains with the Data Fiduciary.
