When a notice is needed
Every request for consent must be accompanied or preceded by a notice from the Data Fiduciary. The Act's example is a bank's video-based customer identification: the bank must describe the personal data and the purpose before or with its request for the data.
Sources: Act s.5(1)
What the Act says it must contain
The notice must tell the person the personal data and the purpose, how to withdraw consent and use the grievance process, and how to complain to the Board. The person must be able to read it in English or any language in the Eighth Schedule to the Constitution.
Sources: Act s.5(1)Act s.5(3)
What Rule 3 adds
Rule 3 says the notice must stand on its own, understandable without other information. In clear and plain language, it must give an itemised description of the personal data and the specified purpose. It must also give a specific description of the goods, services or uses the processing enables.
The notice must also give the link to the website or app, and describe any other means, for three things. They are withdrawing consent as easily as it was given, exercising rights under the Act, and complaining to the Board.
Sources: Rules r.3
Consent requests and older consents
The consent request itself must use clear and plain language, offer English or an Eighth Schedule language, and give contact details of the DPO or another person authorised to respond. For consent given before commencement, the Fiduciary must send a notice as soon as reasonably practicable, and may keep processing until the person withdraws.
Sources: Act s.6(3)Act s.5(2)
Key points
- Give the notice before or with every consent request.
- Itemise the data; state the purpose and the goods or services.
- Link to withdrawal, rights and Board complaints.
- Offer English or an Eighth Schedule language.
- Existing consents need a notice as soon as reasonably practicable.
In practice
A checklist for your organisation.
- Write one standalone notice per purpose, itemising each data field.
- Translate notices into the languages your customers use.
- Put withdrawal, rights and complaint links in every notice.
- Plan notices for customers who consented before commencement.
Check what you learned
5 questions. Choose an answer to see why it is right.
0 of 5 answered
Question 1 of 5
When must the notice reach the Data Principal?
Show the answer
B. Before or together with the consent request
Section 5(1) requires every request for consent to be accompanied or preceded by a notice.
Act s.5(1)Section 5(1) requires every request for consent to be accompanied or preceded by a notice.
Act s.5(1)Question 2 of 5
How must the notice describe the personal data under Rule 3?
Show the answer
D. As an itemised description
Rule 3(b)(i) requires, at the minimum, an itemised description of the personal data.
Rules r.3(b)Rule 3(b)(i) requires, at the minimum, an itemised description of the personal data.
Rules r.3(b)Question 3 of 5
Which means must the notice describe under Rule 3(c)?
Show the answer
A. Means to withdraw consent, exercise rights and complain to the Board
Rule 3(c) requires a link and other means to withdraw consent, exercise rights under the Act and make a complaint to the Board.
Rules r.3(c)Rule 3(c) requires a link and other means to withdraw consent, exercise rights under the Act and make a complaint to the Board.
Rules r.3(c)Question 4 of 5
In which languages must the person be able to access the notice?
Show the answer
D. English or any language in the Eighth Schedule to the Constitution
Section 5(3) requires the option to access the notice in English or any language specified in the Eighth Schedule to the Constitution.
Act s.5(3)Section 5(3) requires the option to access the notice in English or any language specified in the Eighth Schedule to the Constitution.
Act s.5(3)Question 5 of 5
A customer consented before the Act commenced. What must the Fiduciary do?
Show the answer
A. Give her a notice as soon as reasonably practicable
Section 5(2)(a) requires a notice as soon as reasonably practicable; section 5(2)(b) allows processing to continue until she withdraws.
Act s.5(2)Section 5(2)(a) requires a notice as soon as reasonably practicable; section 5(2)(b) allows processing to continue until she withdraws.
Act s.5(2)
Official sources for this lesson
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023
- Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)
- G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force
A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the DPDP dictionary.