What a Valid DPDP Consent Notice Must Say
A DPDP consent notice has to be clear enough for an ordinary user to understand. Here is what it should cover, how to write it, and how withdrawal should work.
In this article
Under India’s Digital Personal Data Protection Act, consent is only as good as the notice behind it. If people cannot understand what they are agreeing to, the consent is weak, however many boxes they tick. The notice is where you earn trust or lose it.
Many companies already have a privacy policy. A DPDP consent notice is different. It sits at the moment of collection, it is short, and it tells a person exactly what will happen to their data. This article explains what to include and how to write it so that ordinary users can follow it.
1. What the notice needs to cover
A notice should give a person enough information to make a real choice. Check the Act and the DPDP Rules for the precise list that applies to you, but most notices typically need to cover the points below.
| Notice element | What to write |
|---|---|
| The personal data | Name the data you collect, such as name, phone number and location. |
| The purpose | Say why you need each item, in words a customer would use. |
| How to withdraw | Explain how to withdraw consent, and make it as easy as giving it. |
| How to use rights | Tell people how to access, correct or erase their data. |
| How to complain | Give a contact for grievances and mention the Data Protection Board. |
| Who to contact | Name the person or team that answers privacy questions. |
Keep each item specific. "To improve our services" says almost nothing. "To send you delivery updates by SMS" tells the person exactly what they are agreeing to.
If you collect data for several purposes, list each purpose separately and let people choose where the law and your business allow it. Bundling every purpose into one yes or no makes the choice less meaningful, and it makes withdrawal harder to handle later.
2. Write it in plain language
The best notices read like a helpful conversation, not a contract. Short sentences, common words and one idea per line make a notice easier to read on a phone screen, which is where most people will see it.
Here is an example of plain wording for a delivery app: "We use your phone number to send order updates and to let the delivery partner call you. We do not use it for marketing unless you say yes below." It names the data, the purpose and the choice in a few lines.
Language matters too. If your customers use the service in a regional language, offer the notice in that language as well. Check the Rules for what they say about languages, and think about who your users really are rather than what is easiest for the legal team.
Layout helps. Put the key facts first, use headings, and link to the full privacy policy for detail. Do not bury the purpose under paragraphs of general text.
3. Make withdrawal and records work in practice
A notice promises things. Your systems have to keep those promises. If the notice says people can withdraw consent with one tap, the app needs that tap, and the data flows behind it need to stop.
Work with your engineering team on three practical questions. Where is consent recorded, with the date and the version of the notice? What happens downstream when someone withdraws, including in your vendors’ systems? How do you show, later, which notice a person saw when they agreed?
Version control is easy to forget. Every time you change the notice, keep a copy with its date. If a question comes up months later, you can show exactly what the person was told at the time.
Test the journey yourself. Sign up as a new user, read the notice on a small phone, then try to withdraw. If any step is confusing for you, it will be confusing for your customers. Small fixes found this way often make the biggest difference.
Finally, connect the notice to your data inventory. Each purpose in the notice should match a purpose in your records. When the two drift apart, either the notice is incomplete or the business is using data in ways nobody planned. Our DPDP Act readiness article covers the inventory work.
Getting notices right is one of the most visible parts of DPDP work, because every user sees them. If you would like a review of your current notice and consent flow, our DPDP compliance team is glad to take a look with you.