The statutory minimum
Section 5(1) of the DPDP Act requires that every request for consent be accompanied or preceded by a notice informing the Data Principal of: the personal data proposed to be processed and the purpose of the processing; the manner in which the Data Principal may exercise their rights under Section 6(4) (withdrawal) and Section 13 (grievance redressal); and the manner in which a complaint may be made to the Data Protection Board.
Section 5(3) requires the Data Fiduciary to give the Data Principal the option to access the notice in English or any language specified in the Eighth Schedule to the Constitution.
Where personal data was collected before the Act's commencement on the basis of earlier consent, Section 5(2) requires a fresh notice to be given as soon as reasonably practicable; processing may continue until the Data Principal withdraws consent.
Drafting failures we see most often
- One consent covering unrelated purposes. Section 6(1) limits consent to the data necessary for the specified purpose, so analytics, marketing and service delivery need separate treatment.
- Consent bundled into acceptance of the terms of use. Consent must be unconditional and given by a clear affirmative action.
- Pre-ticked boxes or a continue button that reads as agreement. Neither is a clear affirmative action.
- No withdrawal route. Section 6(4) requires withdrawal to be as easy as giving consent.
- A notice that describes the categories of data but never states the purpose for each.
- No mention of the Data Protection Board complaint route, which Section 5(1)(iii) requires.
A structure that works
- What we collect — listed field by field, not 'information such as'.
- Why we collect it — one purpose per row against the fields it needs.
- How long we keep it, and what triggers erasure.
- How to withdraw consent, with the link or address that actually does it.
- How to raise a grievance, with the name and email of the person responsible and the response time.
- How to complain to the Data Protection Board if the grievance is not resolved.
- Language options for the notice.