DPDP consent notice: does yours meet Section 5 and Rule 3?

Under the Digital Personal Data Protection Act, 2023, a Data Fiduciary (the person or business deciding why and how personal data is processed) cannot ask for consent without also giving a notice. Section 5(1) requires every request for consent under Section 6 to be accompanied or preceded by a notice. Rule 3 of the DPDP Rules, 2025 sets out what that notice must contain and how it must be presented. If the notice falls short, the consent built on it is open to challenge.

What Section 5(1) requires

The notice must tell the Data Principal:

1. the personal data and the purpose for which it is proposed to be processed;
2. how she may exercise her rights under Section 6(4), to withdraw consent, and Section 13, to grievance redressal; and
3. how she may make a complaint to the Data Protection Board of India.

Section 5(1) adds that this must be done “in such manner and as may be prescribed”. Rule 3 is that prescription.

What Rule 3 adds

Rule 3 sets three requirements, in clauses (a), (b) and (c).

(a) It must stand on its own. The notice must be presented, and be understandable, independently of any other information you have made, are making or may make available. In practice, the minimum content belongs in the notice itself rather than behind a link to a longer privacy policy.

(b) It must give a fair account in clear and plain language. It must include the details the person needs to give specific and informed consent, and at the minimum:

• an itemised description of the personal data; and
• the specified purpose or purposes, with a specific description of the goods or services to be provided, or the uses to be enabled, by the processing.

(c) It must give the way in and the ways out. It must give the particular communication link to your website or app, or both. It must also describe any other means by which the person can:

• withdraw her consent, with the ease of doing so comparable to the ease with which she gave it;
• exercise her rights under the Act; and
• make a complaint to the Board.

Language and contact details

Section 5(3) requires you to give the person the option to read the notice in English or in any language specified in the Eighth Schedule to the Constitution, which lists India’s scheduled languages. Section 6(3) applies the same language option to the consent request itself and requires it to be in clear and plain language. The request must also give the contact details of a Data Protection Officer, where applicable, or of another person you have authorised to respond to communications about her rights.

Checklist for a draft notice

Rule 3 does not list retention periods or recipients in its minimum. Including them can build trust, but they are your choice rather than part of the legal test.

A good notice does not rescue bad consent

Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose. The Act’s own illustration is a telemedicine app that asks for both health-service processing and access to the user’s phone contacts. Because the contact list is not necessary for the service, the consent is limited to the telemedicine processing.

Section 6(2) makes any part of a consent that infringes the Act, the Rules or any other law invalid to that extent. Its illustration is an insurance customer asked to consent to waiving her right to complain to the Board; that part is invalid.

Section 6(10) puts the burden on you. If consent is the basis of processing and a question arises in a proceeding, the Data Fiduciary must prove that a notice was given and that consent was given in line with the Act and the Rules. Keep the notice version shown, the time, and the action the person took.

Consent you already hold: Section 5(2)

Where a person gave consent before the date of commencement, Section 5(2)(a) requires you to give her a notice as soon as reasonably practicable. It must cover the data and the purpose for which it has been processed, how to exercise her rights under Sections 6(4) and 13, and how to complain to the Board. Section 5(2)(b) lets you continue processing until she withdraws consent.

Section 1(2) reads “commencement” in a provision as the date that provision comes into force. Section 5 comes into force on 13 May 2027 under clause (c) of G.S.R. 843(E). On that reading, every consent collected before 13 May 2027, including any you collect from today, needs a Section 5(2) notice. The DPDP Act commencement timeline sets out what else starts that day.

Where a notice is not tied to consent

Section 5(1) attaches the notice to requests for consent. Section 4(1) allows processing on two grounds: consent, or certain legitimate uses listed in Section 7. If a processing activity rests on a legitimate use, test it against that ground on its own terms instead of assuming the consent-notice rules settle it.

Start date, and where to begin

Sections 5 and 6 (other than Section 6(9)) and Rule 3 apply from 13 May 2027 (Rule 1(4) for the Rule). Draft notices from your data map: one row per purpose, with the data items and the legal basis, makes the itemised description in Rule 3(b) straightforward to write.

If the person is under eighteen, a parent’s verifiable consent comes first. See children’s data under the Act.