Writing a consent notice that meets Section 5

The four items a DPDP notice must contain, the language requirement, and the drafting habits that cause a notice to fail.

The statutory minimum

Section 5(1) of the DPDP Act requires that every request for consent be accompanied or preceded by a notice informing the Data Principal of: the personal data proposed to be processed and the purpose of the processing; the manner in which the Data Principal may exercise their rights under Section 6(4) (withdrawal) and Section 13 (grievance redressal); and the manner in which a complaint may be made to the Data Protection Board.

Section 5(3) requires the Data Fiduciary to give the Data Principal the option to access the notice in English or any language specified in the Eighth Schedule to the Constitution.

Where personal data was collected before the Act's commencement on the basis of earlier consent, Section 5(2) requires a fresh notice to be given as soon as reasonably practicable; processing may continue until the Data Principal withdraws consent.

Drafting failures we see most often

One consent covering unrelated purposes. Section 6(1) limits consent to the data necessary for the specified purpose, so analytics, marketing and service delivery need separate treatment.
Consent bundled into acceptance of the terms of use. Consent must be unconditional and given by a clear affirmative action.
Pre-ticked boxes or a continue button that reads as agreement. Neither is a clear affirmative action.
No withdrawal route. Section 6(4) requires withdrawal to be as easy as giving consent.
A notice that describes the categories of data but never states the purpose for each.
No mention of the Data Protection Board complaint route, which Section 5(1)(iii) requires.

A structure that works

What we collect — listed field by field, not 'information such as'.
Why we collect it — one purpose per row against the fields it needs.
How long we keep it, and what triggers erasure.
How to withdraw consent, with the link or address that actually does it.
How to raise a grievance, with the name and email of the person responsible and the response time.
How to complain to the Data Protection Board if the grievance is not resolved.
Language options for the notice.

Checklist

The notice states the personal data collected and the purpose in plain terms.
It explains how to withdraw consent and how to complain to the Board.
It is available in English and the Eighth Schedule languages you serve.
Consent is sought separately from the terms of service, not bundled into acceptance.
No pre-ticked boxes, and no consent inferred from continued use.

Practical recommendations

Write the notice before designing the form; a notice retrofitted to an existing form usually omits a purpose.
Version the notice text and store the version identifier with each consent event.

Not sure how this applies to your site? Ask our lawyer for help.

Sources

• The Digital Personal Data Protection Act, 2023 — Sections 5, 6 and 13

Last reviewed: September 2026. This note is general information about published Indian law as it stood on the review date. It is not legal advice and does not create a lawyer-client relationship. Provisions change, and commencement dates differ from one provision to the next, so confirm the position for your own facts before acting. For advice, ask our lawyer.

Check your own site against this

The audit reads your live pages and grades them provision by provision. See what we check against or the audit packages.

Run a free audit